GitHub: Create a private registry for an organization

← Private registries operations · Get started

Operation github.private_registries_create_org_private_registry

Provider route: POST /orgs/{org}/private-registries. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["privateRegistries"]["privateRegistriesCreateOrgPrivateRegistry"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.privateRegistries.privateRegistriesCreateOrgPrivateRegistry(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.private_registries.private_registries_create_org_private_registry(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.org	string	Required within parent
body	object	Required within parent
body.account_id	string	Optional	The AWS account ID. Required when `auth_type` is `oidc_aws`.
body.api_host	string	Optional	The Cloudsmith API host. Optional for `oidc_cloudsmith` auth type. If omitted, `api.cloudsmith.io` is used by default.
body.audience	string	Optional	The OIDC audience. Optional for `oidc_aws`, `oidc_jfrog`, and `oidc_gcp`, and required for `oidc_cloudsmith` auth types.
body.auth_type	string	Optional	The authentication type for the private registry. Defaults to `token` if not specified. Use `oidc_azure`, `oidc_aws`, `oidc_jfrog`, `oidc_cloudsmith`, or `oidc_gcp` for OIDC authentication. Use `anonymous` for registries that do not require authentication; `username`, `encrypted_value`, and `key_id` must be omitted. One of: token, username_password, oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, oidc_gcp, anonymous
body.aws_region	string	Optional	The AWS region. Required when `auth_type` is `oidc_aws`.
body.client_id	string	Optional	The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
body.domain	string	Optional	The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
body.domain_owner	string	Optional	The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
body.encrypted_value	string	Optional	The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint. Required when `auth_type` is `token` or `username_password`. Should be omitted for OIDC auth types. Pattern: ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$
body.identity_mapping_name	string	Optional	The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.
body.jfrog_oidc_provider_name	string	Optional	The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
body.key_id	string	Optional	The ID of the key you used to encrypt the secret. Required when `auth_type` is `token` or `username_password`. Should be omitted for OIDC auth types.
body.namespace	string	Optional	The Cloudsmith organization namespace. Required when `auth_type` is `oidc_cloudsmith`.
body.registry_type	string	Required within parent	The registry type. One of: maven_repository, nuget_feed, goproxy_server, npm_registry, rubygems_server, cargo_registry, composer_repository, docker_registry, git_source, helm_registry, hex_organization, hex_repository, pub_repository, python_index, terraform_registry
body.replaces_base	boolean	Optional	Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages. Default: false
body.role_name	string	Optional	The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
body.selected_repository_ids	array	Optional	An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. You can manage the list of selected repositories using the [Update a private registry for an organization](https://docs.github.com/rest/private-registries/organization-configurations#update-a-private-registry-for-an-organization) endpoint. This field should be omitted if `visibility` is set to `all` or `private`.
body.selected_repository_ids[]	integer	Each item
body.service_account	string	Optional	The GCP service account email to impersonate. Optional for `oidc_gcp` auth type. If omitted, the federated token is used directly (direct WIF).
body.service_slug	string	Optional	The Cloudsmith service account slug. Required when `auth_type` is `oidc_cloudsmith`.
body.tenant_id	string	Optional	The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
body.url	string	Required within parent	The URL of the private registry. Format: uri
body.username	JSON	Optional
body.username (anyOf 1)	string	Alternative	The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
body.username (anyOf 2)	null	Alternative
body.visibility	string	Required within parent	Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry. One of: all, private, selected
body.workload_identity_provider	string	Optional	The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`). Required when `auth_type` is `oidc_gcp`.

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Create a private registry for an organization — response body

Referenced models: Create a private registry for an organization — response body

Schemas

Create a private registry for an organization — response body

Field	Type	Presence	Description and constraints
$	object	Root	Private registry configuration for an organization
account_id	string	Optional	The AWS account ID.
api_host	string	Optional	The Cloudsmith API host.
audience	string	Optional	The OIDC audience.
auth_type	string	Optional	The authentication type for the private registry. Known values: token, username_password, oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, oidc_gcp, anonymous
aws_region	string	Optional	The AWS region.
client_id	string	Optional	The client ID of the Azure AD application.
created_at	string	Required within parent	Format: date-time
domain	string	Optional	The CodeArtifact domain.
domain_owner	string	Optional	The CodeArtifact domain owner.
identity_mapping_name	string	Optional	The JFrog identity mapping name.
jfrog_oidc_provider_name	string	Optional	The JFrog OIDC provider name.
name	string	Required within parent	The name of the private registry configuration.
namespace	string	Optional	The Cloudsmith organization namespace.
registry_type	string	Required within parent	The registry type. Known values: maven_repository, nuget_feed, goproxy_server, npm_registry, rubygems_server, cargo_registry, composer_repository, docker_registry, git_source, helm_registry, hex_organization, hex_repository, pub_repository, python_index, terraform_registry
replaces_base	boolean	Optional	Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When `true`, Dependabot will only use this registry and will not fall back to the public registry. When `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages. Default: false
role_name	string	Optional	The AWS IAM role name.
selected_repository_ids	array	Optional	An array of repository IDs that can access the organization private registry when `visibility` is set to `selected`.
selected_repository_ids[]	JSON	Each item
selected_repository_ids[] (anyOf 1)	integer	Alternative
selected_repository_ids[] (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
service_account	string	Optional	The GCP service account email to impersonate. If omitted, the federated token is used directly (direct WIF).
service_slug	string	Optional	The Cloudsmith service account slug.
tenant_id	string	Optional	The tenant ID of the Azure AD application.
updated_at	string	Required within parent	Format: date-time
url	string	Optional	The URL of the private registry. Format: uri
username	string	Optional	The username to use when authenticating with the private registry.
visibility	string	Required within parent	Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry. Known values: all, private, selected
workload_identity_provider	string	Optional	The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`).

Policy, approvals and errors

SDK function policy ID: github.private_registries_create_org_private_registry. Catalog operation: private-registries/create-org-private-registry. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source