Registries
AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: read:registries
Registry credential metadata for the project (never passwords)
application/json- response
Response for GET /registries: metadata only, never passwords.
registries*array<>curl -X GET 'https://example.com/registries'{ "registries": [ { "description": "string", "host": "string", "kind": "string", "updated_at": "2019-08-24T14:15:22Z", "username": "string" } ]}AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: write:registries
application/json- body
Body form for PUT /registries (host in the body instead of the path).
The password is write-only: encrypted at rest, never returned.
description?string|nullhost*stringRegistry host (host[:port], no scheme/path). Docker Hub aliases
normalize to index.docker.io.
kind?stringAuth kind: one of basic, ghcr, gcr, ecr, ecr_role. For
ecr_role the username is the IAM role ARN the platform assumes
(ExternalId = the organization id) and the password is ignored.
"basic"password?stringRegistry password/token (max 64 KiB). Write-only — never echoed back
by any public read endpoint. Required for every kind but ecr_role,
which ignores it.
username*stringCredential stored
curl -X PUT 'https://example.com/registries' \ -H 'Content-Type: application/json' \ -d '{ "host": "string", "username": "string"}'AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: read:registries
host*stringRegistry host (host[:port], no scheme/path); Docker Hub aliases normalize to index.docker.io
Registry credential metadata (never the password)
application/json- response
Registry credential metadata as returned by every read endpoint (list and get, on both planes). Passwords are write-only: they never appear here or on any other response.
description?string|nullhost*stringNormalized registry host (Docker Hub aliases collapse to
index.docker.io).
kind*stringAuth kind (basic, ghcr, gcr, ecr, ecr_role). For ecr_role
the username is the IAM role ARN the platform assumes.
updated_at*stringdate-timeusername*stringcurl -X GET 'https://example.com/registries/string'{ "description": "string", "host": "string", "kind": "string", "updated_at": "2019-08-24T14:15:22Z", "username": "string"}AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: delete:registries
host*stringRegistry host (host[:port], no scheme/path); Docker Hub aliases normalize to index.docker.io
Credential removed (or none existed)
curl -X DELETE 'https://example.com/registries/string'AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: write:registries
host*stringRegistry host (host[:port], no scheme/path); Docker Hub aliases normalize to index.docker.io
application/json- body
Credential payload for PUT /registries/{host}. The password is
write-only: it is encrypted at rest and no public endpoint returns it.
description?string|nullkind?stringAuth kind: one of basic, ghcr, gcr, ecr, ecr_role. For
ecr_role the username is the IAM role ARN the platform assumes
(ExternalId = the organization id) and the password is ignored.
"basic"password?stringRegistry password/token (max 64 KiB). Write-only — never echoed back
by any public read endpoint. Required for every kind but ecr_role,
which ignores it.
username*stringCredential stored
curl -X PUT 'https://example.com/registries/string' \ -H 'Content-Type: application/json' \ -d '{ "username": "string"}'