curl -X PATCH 'https://api.github.com/orgs/example-org/private-registries/example-secret-name' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

# PATCH /orgs/{org}/private-registries/{secret_name} (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Update a private registry for an organization

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X PATCH 'https://api.github.com/orgs/example-org/private-registries/example-secret-name' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| org | path | string | Yes | The organization name. The name is not case sensitive. |
| secret_name | path | string | Yes | The name of the secret. |
| registry_type | body | string | No | The registry type. |
| url | body | string | No | The URL of the private registry. |
| username | body | string | No | The username to use when authenticating with the private registry. This field... |
| replaces_base | body | boolean | No | Whether this private registry should replace the base registry (e.g., npmjs.o... |
| encrypted_value | body | string | No | The value for your secret, encrypted with [LibSodium](https://libsodium.gitbo... |
| key_id | body | string | No | The ID of the key you used to encrypt the secret. |
Other params: visibility, selected_repository_ids, auth_type, tenant_id, client_id, aws_region, account_id, role_name, domain, domain_owner, jfrog_oidc_provider_name, audience, identity_mapping_name, namespace, service_slug, api_host, workload_identity_provider, service_account

## Response example
null

---
Need an API key? Get one at https://github.com/settings/tokens

PATCH

PATCH /orgs/{org}/private-registries/{secret_name} — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Update a private registry for an organization

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 370 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X PATCH 'https://api.github.com/orgs/example-org/private-registries/example-secret-name' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{}'

Parameters

Name	In	Type	Required	Description
org	path	string	Yes	The organization name. The name is not case sensitive.
secret_name	path	string	Yes	The name of the secret.
registry_type	body	string	No	The registry type.
url	body	string	No	The URL of the private registry.
username	body	string	No	The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
replaces_base	body	boolean	No	Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
encrypted_value	body	string	No	The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint.
key_id	body	string	No	The ID of the key you used to encrypt the secret.
visibility	body	string	No	Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
selected_repository_ids	body	integer[]	No	An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. This field should be omitted if `visibility` is set to `all` or `private`.
auth_type	body	string	No	The authentication type for the private registry. This field cannot be changed after creation. If provided, it must match the existing `auth_type` of the configuration. To change the authentication type, delete and recreate the configuration.
tenant_id	body	string	No	The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
client_id	body	string	No	The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
aws_region	body	string	No	The AWS region. Required when `auth_type` is `oidc_aws`.
account_id	body	string	No	The AWS account ID. Required when `auth_type` is `oidc_aws`.
role_name	body	string	No	The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
domain	body	string	No	The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
domain_owner	body	string	No	The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
jfrog_oidc_provider_name	body	string	No	The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
audience	body	string	No	The OIDC audience. Optional for `oidc_aws`, `oidc_jfrog`, and `oidc_gcp`, and required for `oidc_cloudsmith` auth types.
identity_mapping_name	body	string	No	The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.
namespace	body	string	No	The Cloudsmith organization namespace. Required when `auth_type` is `oidc_cloudsmith`.
service_slug	body	string	No	The Cloudsmith service account slug. Required when `auth_type` is `oidc_cloudsmith`.
api_host	body	string	No	The Cloudsmith API host. Optional for `oidc_cloudsmith` auth type. If omitted, `api.cloudsmith.io` is used by default.
workload_identity_provider	body	string	No	The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`). Required when `auth_type` is `oidc_gcp`.
service_account	body	string	No	The GCP service account email to impersonate. Optional for `oidc_gcp` auth type. If omitted, the federated token is used directly (direct WIF).

Response 200 OK

null

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.