curl -X POST 'https://api.github.com/orgs/example-org/private-registries' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "registry_type": "maven_repository",
  "url": "https://example.com",
  "visibility": "all"
}'

# POST /orgs/{org}/private-registries (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Create a private registry for an organization

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/orgs/example-org/private-registries' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "registry_type": "maven_repository",
  "url": "https://example.com",
  "visibility": "all"
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| org | path | string | Yes | The organization name. The name is not case sensitive. |
| registry_type | body | string | Yes | The registry type. |
| url | body | string | Yes | The URL of the private registry. |
| visibility | body | string | Yes | Which type of organization repositories have access to the private registry.... |
| username | body | string | No | The username to use when authenticating with the private registry. This field... |
| replaces_base | body | boolean | No | Whether this private registry should replace the base registry (e.g., npmjs.o... |
| encrypted_value | body | string | No | The value for your secret, encrypted with [LibSodium](https://libsodium.gitbo... |
| key_id | body | string | No | The ID of the key you used to encrypt the secret. Required when `auth_type` i... |
Other params: selected_repository_ids, auth_type, tenant_id, client_id, aws_region, account_id, role_name, domain, domain_owner, jfrog_oidc_provider_name, audience, identity_mapping_name, namespace, service_slug, api_host, workload_identity_provider, service_account

## Response example
{"name":"MAVEN_REPOSITORY_SECRET","registry_type":"maven_repository"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /orgs/{org}/private-registries — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Create a private registry for an organization

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 390 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/orgs/example-org/private-registries' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "registry_type": "maven_repository",  "url": "https://example.com",  "visibility": "all"}'

Parameters

Name	In	Type	Required	Description
org	path	string	Yes	The organization name. The name is not case sensitive.
registry_type	body	string	Yes	The registry type.
url	body	string	Yes	The URL of the private registry.
username	body	string	No	The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
replaces_base	body	boolean	No	Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
encrypted_value	body	string	No	The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint. Required when `auth_type` is `token` or `username_password`. Should be omitted for OIDC auth types.
key_id	body	string	No	The ID of the key you used to encrypt the secret. Required when `auth_type` is `token` or `username_password`. Should be omitted for OIDC auth types.
visibility	body	string	Yes	Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
selected_repository_ids	body	integer[]	No	An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. You can manage the list of selected repositories using the [Update a private registry for an organization](https://docs.github.com/rest/private-registries/organization-configurations#update-a-private-registry-for-an-organization) endpoint. This field should be omitted if `visibility` is set to `all` or `private`.
auth_type	body	string	No	The authentication type for the private registry. Defaults to `token` if not specified. Use `oidc_azure`, `oidc_aws`, `oidc_jfrog`, `oidc_cloudsmith`, or `oidc_gcp` for OIDC authentication. Use `anonymous` for registries that do not require authentication; `username`, `encrypted_value`, and `key_id` must be omitted.
tenant_id	body	string	No	The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
client_id	body	string	No	The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
aws_region	body	string	No	The AWS region. Required when `auth_type` is `oidc_aws`.
account_id	body	string	No	The AWS account ID. Required when `auth_type` is `oidc_aws`.
role_name	body	string	No	The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
domain	body	string	No	The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
domain_owner	body	string	No	The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
jfrog_oidc_provider_name	body	string	No	The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
audience	body	string	No	The OIDC audience. Optional for `oidc_aws`, `oidc_jfrog`, and `oidc_gcp`, and required for `oidc_cloudsmith` auth types.
identity_mapping_name	body	string	No	The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.
namespace	body	string	No	The Cloudsmith organization namespace. Required when `auth_type` is `oidc_cloudsmith`.
service_slug	body	string	No	The Cloudsmith service account slug. Required when `auth_type` is `oidc_cloudsmith`.
api_host	body	string	No	The Cloudsmith API host. Optional for `oidc_cloudsmith` auth type. If omitted, `api.cloudsmith.io` is used by default.
workload_identity_provider	body	string	No	The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`). Required when `auth_type` is `oidc_gcp`.
service_account	body	string	No	The GCP service account email to impersonate. Optional for `oidc_gcp` auth type. If omitted, the federated token is used directly (direct WIF).

Response 200 OK

{
  "name": "MAVEN_REPOSITORY_SECRET",
  "registry_type": "maven_repository",
  "auth_type": "token",
  "url": "https://example.com",
  "username": "monalisa",
  "replaces_base": false,
  "visibility": "all",
  "selected_repository_ids": [
    0
  ],
  "tenant_id": "string",
  "client_id": "string",
  "aws_region": "string",
  "account_id": "string",
  "role_name": "string",
  "domain": "string",
  "domain_owner": "string",
  "jfrog_oidc_provider_name": "string",
  "audience": "string",
  "identity_mapping_name": "string",
  "namespace": "string",
  "service_slug": "string",
  "api_host": "string",
  "workload_identity_provider": "string",
  "service_account": "string",
  "created_at": "2026-09-03T00:00:00Z",
  "updated_at": "2026-09-03T00:00:00Z"
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.