---
title: "Update a private registry for an organization"
method: PATCH
path: "/orgs/{org}/private-registries/{secret_name}"
tags: ["private-registries"]
---

# Update a private registry for an organization

`PATCH /orgs/{org}/private-registries/{secret_name}`

Updates a private registry configuration with an encrypted value for an organization. Encrypt your secret using [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages). For more information, see "[Encrypting secrets for the REST API](https://docs.github.com/rest/guides/encrypting-secrets-for-the-rest-api)."
For OIDC-based registries (`oidc_azure`, `oidc_aws`, `oidc_jfrog`, `oidc_cloudsmith`, or `oidc_gcp`), the `encrypted_value` and `key_id` fields should be omitted.

OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

## Path parameters

- `org` string, required
- `secret_name` string, required

## Request body

- object
  - `registry_type` 'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry' — The registry type.
  - `url` string, uri — The URL of the private registry.
  - `username` string, nullable — The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
  - `replaces_base` boolean — Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
  - `encrypted_value` string — The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint.
  - `key_id` string — The ID of the key you used to encrypt the secret.
  - `visibility` 'all' | 'private' | 'selected' — Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
  - `selected_repository_ids` integer[] — An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. This field should be omitted if `visibility` is set to `all` or `private`.
  - `auth_type` 'token' | 'username_password' | 'oidc_azure' | 'oidc_aws' | 'oidc_jfrog' | 'oidc_cloudsmith' | 'oidc_gcp' — The authentication type for the private registry. This field cannot be changed after creation. If provided, it must match the existing `auth_type` of the configuration. To change the authentication type, delete and recreate the configuration.
  - `tenant_id` string — The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
  - `client_id` string — The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
  - `aws_region` string — The AWS region. Required when `auth_type` is `oidc_aws`.
  - `account_id` string — The AWS account ID. Required when `auth_type` is `oidc_aws`.
  - `role_name` string — The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
  - `domain` string — The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
  - `domain_owner` string — The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
  - `jfrog_oidc_provider_name` string — The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
  - `audience` string — The OIDC audience. Optional for `oidc_aws`, `oidc_jfrog`, and `oidc_gcp`, and required for `oidc_cloudsmith` auth types.
  - `identity_mapping_name` string — The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.
  - `namespace` string — The Cloudsmith organization namespace. Required when `auth_type` is `oidc_cloudsmith`.
  - `service_slug` string — The Cloudsmith service account slug. Required when `auth_type` is `oidc_cloudsmith`.
  - `api_host` string — The Cloudsmith API host. Optional for `oidc_cloudsmith` auth type. If omitted, `api.cloudsmith.io` is used by default.
  - `workload_identity_provider` string — The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`). Required when `auth_type` is `oidc_gcp`.
  - `service_account` string — The GCP service account email to impersonate. Optional for `oidc_gcp` auth type. If omitted, the federated token is used directly (direct WIF).

## Response `204`

Response

## Other responses

- `404` — Resource not found
- `422` — Validation failed, or the endpoint has been spammed.

---

[API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)