---
title: "PUT /v1/orgs/:slug/registries — create or update a credential for a host (Admin+)."
method: PUT
path: "/v1/orgs/{slug}/registries"
tags: ["registry-credentials"]
---

# PUT /v1/orgs/:slug/registries — create or update a credential for a host (Admin+).

`PUT /v1/orgs/{slug}/registries`

Writes the secret material to the store first, then records the metadata
pointer, so the DB never references a secret that failed to land.

## Path parameters

- `slug` string, required

## Request body

- UpsertRegistryCredentialRequest — PUT /v1/orgs/{slug}/registries
  - `password` string, required — Password or access token. Stored in OpenBao — never persisted to the DB.
  - `registry_host` string, required — Registry host, e.g. `ghcr.io` or `localhost:5000`. Canonicalized server-side; Docker Hub aliases fold to `docker.io`.
  - `username` string, required — Registry username.

## Response `200`

Credential created or updated

- RegistryCredentialResponse — Registry credential metadata returned in list/upsert responses. Never includes the secret or the internal vault path.
  - `created_at` string, date-time, required
  - `id` string, uuid, required
  - `registry_host` string, required
  - `updated_at` string, date-time, required
  - `username` string, required

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — Insufficient permissions

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)