---
title: "Update a private registry for an organization"
method: PATCH
path: "/orgs/{org}/private-registries/{secret_name}"
tags: ["private-registries"]
---

# Update a private registry for an organization

`PATCH /orgs/{org}/private-registries/{secret_name}`

Updates a private registry configuration with an encrypted value for an organization. Encrypt your secret using [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages). For more information, see "[Encrypting secrets for the REST API](https://docs.github.com/rest/guides/encrypting-secrets-for-the-rest-api)."
For OIDC-based registries (`oidc_azure`, `oidc_aws`, or `oidc_jfrog`), the `encrypted_value` and `key_id` fields should be omitted.

OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

## Path parameters

- `org` string, required
- `secret_name` string, required

## Request body

- object
  - `registry_type` 'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry' — The registry type.
  - `url` string, uri — The URL of the private registry.
  - `username` string, nullable — The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
  - `replaces_base` boolean — Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
  - `encrypted_value` string — The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint.
  - `key_id` string — The ID of the key you used to encrypt the secret.
  - `visibility` 'all' | 'private' | 'selected' — Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
  - `selected_repository_ids` integer[] — An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. This field should be omitted if `visibility` is set to `all` or `private`.
  - `auth_type` 'token' | 'username_password' | 'oidc_azure' | 'oidc_aws' | 'oidc_jfrog' — The authentication type for the private registry. This field cannot be changed after creation. If provided, it must match the existing `auth_type` of the configuration. To change the authentication type, delete and recreate the configuration.
  - `tenant_id` string — The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
  - `client_id` string — The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
  - `aws_region` string — The AWS region. Required when `auth_type` is `oidc_aws`.
  - `account_id` string — The AWS account ID. Required when `auth_type` is `oidc_aws`.
  - `role_name` string — The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
  - `domain` string — The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
  - `domain_owner` string — The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
  - `jfrog_oidc_provider_name` string — The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
  - `audience` string — The OIDC audience. Optional for `oidc_aws` and `oidc_jfrog` auth types.
  - `identity_mapping_name` string — The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.

## Response `204`

Response

## Other responses

- `404` — Resource not found
- `422` — Validation failed, or the endpoint has been spammed.

## Changes

- **2026-03-25** (2022-11-28) `da449e251ccf` — 11 info
  - added the new optional request property `account_id`
  - added the new optional request property `audience`
  - added the new optional request property `auth_type`
  - added the new optional request property `aws_region`
  - …7 more

[Change history](https://skmtc.dev/github/apis/rest/changes/orgs/:org/private-registries/:secret_name/patch.md)

---

[API](https://skmtc.dev/github/apis/rest.md) · [All operations](https://skmtc.dev/github/apis/rest/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/github/rest/revisions/da449e251ccf/schema)