---
title: "Get a private registry for an organization"
method: GET
path: "/orgs/{org}/private-registries/{secret_name}"
tags: ["private-registries"]
---

# Get a private registry for an organization

`GET /orgs/{org}/private-registries/{secret_name}`

Get the configuration of a single private registry defined for an organization, omitting its encrypted value.

OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

## Path parameters

- `org` string, required
- `secret_name` string, required

## Response `200`

The specified private registry configuration for the organization

- OrgPrivateRegistryConfiguration — Private registry configuration for an organization
  - `name` string, required — The name of the private registry configuration.
  - `registry_type` 'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry', required — The registry type.
  - `auth_type` 'token' | 'username_password' | 'oidc_azure' | 'oidc_aws' | 'oidc_jfrog' | 'oidc_cloudsmith' | 'oidc_gcp' — The authentication type for the private registry.
  - `url` string, uri — The URL of the private registry.
  - `username` string, nullable — The username to use when authenticating with the private registry.
  - `replaces_base` boolean — Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When `true`, Dependabot will only use this registry and will not fall back to the public registry. When `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
  - `visibility` 'all' | 'private' | 'selected', required — Which type of organization repositories have access to the private registry.
  - `tenant_id` string — The tenant ID of the Azure AD application.
  - `client_id` string — The client ID of the Azure AD application.
  - `aws_region` string — The AWS region.
  - `account_id` string — The AWS account ID.
  - `role_name` string — The AWS IAM role name.
  - `domain` string — The CodeArtifact domain.
  - `domain_owner` string — The CodeArtifact domain owner.
  - `jfrog_oidc_provider_name` string — The JFrog OIDC provider name.
  - `audience` string — The OIDC audience.
  - `identity_mapping_name` string — The JFrog identity mapping name.
  - `namespace` string — The Cloudsmith organization namespace.
  - `service_slug` string — The Cloudsmith service account slug.
  - `api_host` string — The Cloudsmith API host.
  - `workload_identity_provider` string — The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`).
  - `service_account` string — The GCP service account email to impersonate. If omitted, the federated token is used directly (direct WIF).
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `404` — Resource not found

---

[API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)