Repositories API

66 endpoints. Request and response schemas are described on the schemas page; the other tags are listed in the API index.

Endpoints

GET /api/v1/admin/quotas

List all quotas

Every live repository and every project with its quota and live usage, largest usage first, in one request. A repository or project without a limit is listed as unlimited. Admin only.

Parameters

Name	In	Type	Required	Description
scope	query	string	no	One of: repository, project.
limited	query	boolean	no	true keeps only quotas that enforce a limit.
q	query	string	no	Case-insensitive substring of the repository or project name.
page	query	integer	no	Default: 1. Minimum: 1.
limit	query	integer	no	Default: 500. Minimum: 1. Maximum: 2000.

Responses

Status	Description	Body
200	One page of quotas	application/json: QuotaOverviewList
400	Invalid scope	-
403	Admin access required	-

GET /api/v1/repositories

List repositories

List all repositories with optional filtering

Parameters

Name	In	Type	Required	Description
format	query	string	no	Filter by package format. One of: deb, rpm, maven, npm, docker, helm, pypi, nuget, go, cargo, rubygems, raw, conda, conan, ivy, sbt, terraform, apk, pacman.
page	query	integer	no	Page number (default: 1). Minimum: 1.
limit	query	integer	no	Items per page (default: 25, max: 100). Minimum: 1. Maximum: 100.
q	query	string	no	Only repositories whose name contains this text (case-insensitive, at most 200 characters). Maximum length: 200.
type	query	string	no	Only repositories of this type. One of: hosted, proxy, group.
project	query	string	no	Only repositories of the project with this name; an unknown project matches nothing
flagged	query	boolean	no	true keeps the repositories holding a critical or high vulnerability, a secret finding or a quarantined scan result (each artifact's latest scan counts)
near_quota	query	boolean	no	true keeps the repositories that have a size quota and have used at least quota_threshold of it
quota_threshold	query	number	no	Used fraction of the quota from which near_quota matches, above 0 and at most 1 (default 0.8). Exclusive minimum: 0. Maximum: 1.
unscanned	query	boolean	no	true keeps the repositories that were never scanned (no completed scan of any of their artifacts)
sort	query	string	no	Order: name, updated (last change of the repository), last_published (newest package first, empty repositories last) or size (largest first). Without it, the newest repository first. Ties are ordered by name. One of: name, updated, last_published, size.

Responses

Status	Description	Body
200	List of repositories	application/json: object
400	Invalid request	application/json: Error

Fields of the 200 response (application/json):

Field	Type	Required	Description
limit	integer	no	-
page	integer	no	-
repositories	array of Repository	no	-
total	integer	no	-

POST /api/v1/repositories

Create repository

Create a new repository (admin only)

Request body (required)

application/json: object

Field	Type	Required	Description
blocked	boolean	no	-
cache_ttl_seconds	integer	no	-
description	string	no	-
federated	boolean	no	Enable federation at creation. Only valid for hosted repositories of the formats raw, maven, npm, docker, helm, pypi, cargo, go and nuget (400 otherwise when true).
format	string	yes	One of: deb, rpm, maven, npm, docker, helm, pypi, nuget, go, cargo, rubygems, raw, conda, conan, ivy, sbt, terraform, apk, pacman.
immutable_releases	boolean	no	When true, deleting or overwriting a released version is refused with 409 (SNAPSHOT/pre-release versions stay mutable). An admin can override with ?force=true.
max_stale_seconds	integer	no	Seconds past a cached file's expiry during which it may still be served, with a Warning: 110 header, when the upstream is unreachable, times out or answers 5xx. 0 disables serve-stale; default 604800 (7 days); max 31536000.
member_repos	array of string	no	For group repos: ordered member repository names (first hit wins). Members must be hosted or proxy repositories of the group's format; groups cannot be nested.
merge_proxy_versions	boolean	no	Group repositories only, administrators only (403 otherwise). Default false: hosted members win a package name and proxy versions of the same name are hidden. true merges proxy versions into the group.
name	string	yes	Repository name (1-100 alphanumeric/hyphen/underscore)
negative_cache_ttl_seconds	integer	no	-
presign_downloads	boolean	no	Per-repository override of storage.presignDownloads: true always redirects eligible blob downloads to a presigned object-store URL, false always streams, null inherits the global setting. Metadata and manifests are never redirected. Nullable.
project	string	no	Name of the owning project. Defaults to the built-in system project, whose membership grants nothing. Unknown project: 404.
public	boolean	no	-
repo_type	string	no	hosted (default), proxy or group. Proxy repositories are supported for maven, sbt, ivy, deb, rpm, apk, pacman, docker, go, npm, nuget, pypi, cargo, rubygems, helm, conan, conda, terraform and raw; group repositories for maven, sbt, ivy, deb, rpm, apk, pacman, docker, go, npm, nuget, pypi, cargo, rubygems, helm, conan, conda, terraform and raw (deb, rpm and apk groups serve generated Release/Packages, repodata or APKINDEX merged across their members). Docker proxies and groups are served under /v2/ only. Other combinations are rejected with 400 validation_failed. Proxy and group repositories are read-only. One of: hosted, proxy, group.
sign_packages	boolean	no	Hosted rpm repositories only (400 otherwise when true). When true, uploaded RPMs are signed with the active GPG key; existing packages are not re-signed.
trash_retention_days	integer	no	Days a deleted item (or the repository itself) stays restorable in the trash before the retention purge removes it. null/absent = the server default (TRASH_RETENTION_DAYS); 0 = no trash, deletes are immediate and permanent. Nullable. Minimum: 0. Maximum: 36500.
upstream_password	string	no	-
upstream_url	string	no	Required for proxy repos, except docker (defaults to https://registry-1.docker.io), nuget (defaults to the service index https://api.nuget.org/v3/index.json), pypi (defaults to https://pypi.org/simple) cargo (defaults to https://index.crates.io) and go (defaults to https://proxy.golang.org). Plain http(s) base URL without credentials, query or fragment; validated against the outbound (SSRF) policy.
upstream_username	string	no	-

Responses

Status	Description	Body
201	Repository created	application/json: Repository
400	Invalid request	-
403	Admin access required	-
404	The addressed resource was not found	application/json: Error
409	A repository with this name already exists, or the name is reserved by a repository in the trash until it is purged or restored (error codes conflict, name_reserved)	application/json: Error

GET /api/v1/repositories/{name}/activity

Repository activity

Audit events recorded against one repository (deletions, restores, purges, repository and project changes), newest first, with actor and subject names resolved. package_name and version keep only the events that record that package version: deletions, restores and purges do, other events never match. Keyset paging only: follow next_cursor while has_more is true; no row is counted. Client addresses are not returned. Requires global admin or the maintainer or owner role in the repository's project (a caller who cannot read the repository gets 404).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
package_name	query	string	no	Exact package name as recorded with the event.
version	query	string	no	Exact version as recorded with the event.
actor	query	string	no	Case-insensitive substring of the actor name or actor id.
action	query	string	no	Case-insensitive substring of the action name.
cursor	query	string	no	Opaque next_cursor of the previous page; omit for the newest entries.
limit	query	integer	no	Default: 25. Minimum: 1. Maximum: 100.

Responses

Status	Description	Body
200	One page of activity	application/json: ActivityPage
400	Malformed cursor	-
403	Admin or project maintainer access required	-
404	Repository not found	-

GET /api/v1/repositories/{name}/apk-key

Get the apk signing key

Returns the public half of the key that signs the APKINDEX of a hosted or group apk repository, generating the key on first use. Requires the global manage permission.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name

Responses

Status	Description	Body
200	The signing key	application/json: ApkSigningKey
400	The repository is not a hosted or group apk repository	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	application/json: Error
409	OPENARTIFACT_SECRET_KEY is not set (code secret_key_required)	application/json: Error

POST /api/v1/repositories/{name}/apk-key

Replace the apk signing key

Generates a new signing key (empty body) or imports the given RSA private key, and re-signs the repository's indexes. Clients must install the new public key. Requires the global manage permission.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name

Request body

application/json: object

Field	Type	Required	Description
key_name	string	no	File name of the public key, ending in .rsa.pub; only with private_key (default openartifact-<repository>.rsa.pub)
private_key	string	no	PEM private key (PKCS#8 or the PKCS#1 form abuild-keygen writes), at least 2048 bits; omit to generate a new key

Responses

Status	Description	Body
200	The new signing key	application/json: ApkSigningKey
400	Invalid key or the repository is not a hosted or group apk repository	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	application/json: Error
409	OPENARTIFACT_SECRET_KEY is not set (code secret_key_required)	application/json: Error

POST /api/v1/repositories/{name}/apks

Upload an Alpine apk package

Upload a .apk into a hosted apk repository (multipart/form-data). The package is stored under <branch>/<repo>/<arch>, where arch is the package architecture (required in the request only for noarch packages). Requires write access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name

Request body (required)

multipart/form-data: object

Field	Type	Required	Description
arch	string	no	Target architecture directory; required for noarch packages, otherwise it must equal the package architecture
branch	string	no	Target branch directory, for example v3.20 (default edge)
file	string (binary)	yes	The .apk package
repo	string	no	Target repository directory, for example main (default main)

Responses

Status	Description	Body
200	Package stored	application/json: ApkUploadResult
400	Invalid package, invalid input or wrong repository format	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	application/json: Error
409	Package already exists	application/json: Error
413	File too large	application/json: Error

GET /api/v1/repositories/{name}/artifacts/search

Search artifacts

Search artifacts by properties

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
key	query	string	yes	-
value	query	string	yes	-

Responses

Status	Description	Body
200	Search results	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

GET /api/v1/repositories/{name}/artifacts/{artifact_id}/properties

List artifact properties

List properties for a specific artifact

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
artifact_id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	Artifact properties	application/json: map of string
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

PUT /api/v1/repositories/{name}/artifacts/{artifact_id}/properties

Set artifact properties

Replace all properties for a specific artifact

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
artifact_id	path	string (uuid)	yes	-

Request body (required)

application/json: map of string

Responses

Status	Description	Body
200	Properties updated	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

PATCH /api/v1/repositories/{name}/artifacts/{artifact_id}/properties

Update artifact properties

Patch properties for a specific artifact

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
artifact_id	path	string (uuid)	yes	-

Request body (required)

application/json: map of string

Responses

Status	Description	Body
200	Properties updated	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

DELETE /api/v1/repositories/{name}/artifacts/{artifact_id}/properties/{key}

Delete artifact property

Delete a specific property from an artifact

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
artifact_id	path	string (uuid)	yes	-
key	path	string	yes	-

Responses

Status	Description	Body
204	Property deleted	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Property not found	-

PUT /api/v1/repositories/{name}/comps

Upload RPM comps.xml

Replace the comps (package groups) XML of a hosted RPM repository. The body is the raw XML document. Requires write access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name

Request body (required)

application/xml: string

text/xml: string

Responses

Status	Description	Body
200	comps stored	application/json: CompsUploadResult
400	Invalid XML or not an RPM repository	application/json: Error
404	Repository not found	application/json: Error
413	Body too large	application/json: Error

POST /api/v1/repositories/{name}/debs

Upload a DEB package

Upload a package into a hosted deb repository (multipart/form-data). Requires write access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name

Request body (required)

multipart/form-data: object

Field	Type	Required	Description
component	string	no	Target component (default main)
distribution	string	no	Target distribution (default stable)
file	string (binary)	yes	The .deb package

Responses

Status	Description	Body
200	Package stored	application/json: PackageUploadResult
400	Invalid input or wrong repository format	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	application/json: Error
405	Proxy and group repositories are read-only	application/json: Error
409	Package already exists	application/json: Error
413	File too large	application/json: Error

DELETE /api/v1/repositories/{name}/debs/{id}

Delete a DEB package

Delete a package from a hosted repository. Requires write access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name
id	path	string (uuid)	yes	Package ID

Responses

Status	Description	Body
200	Package deleted	application/json: PackageDeleteResult
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or package not found	application/json: Error
409	Release versions are immutable in this repository	application/json: Error

GET /api/v1/repositories/{name}/license/policies

List license policies

List license policies for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of license policies	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

POST /api/v1/repositories/{name}/license/policies

Create license policy

Create a license policy for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: LicensePolicy

Responses

Status	Description	Body
201	License policy created	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

PUT /api/v1/repositories/{name}/license/policies/{id}

Update license policy

Update a license policy for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Request body (required)

application/json: LicensePolicy

Responses

Status	Description	Body
200	License policy updated	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

DELETE /api/v1/repositories/{name}/license/policies/{id}

Delete license policy

Delete a license policy

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	License policy deleted	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

POST /api/v1/repositories/{name}/license/scan

Scan licenses

Detect the licenses of an artifact from its stored package file (the wheel METADATA, package.json, Cargo.toml, .nuspec, pom or gemspec it declares) and from its license properties, evaluate the license policies and record the result. A violated policy with action block quarantines the artifact: downloads answer 403 ARTIFACT_QUARANTINED until an admin approves it.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
artifact_id	string	yes	-

Responses

Status	Description	Body
200	License scan result with the policy violations	application/json: LicenseScanRunResult
400	Invalid body	-
403	Admin access required	-
404	Repository not found	-
422	The artifact's metadata is too large or ambiguous to be read safely (unsafe_artifact), or its license cannot be read from its file while a blocking license policy applies (unreadable_artifact)	-

GET /api/v1/repositories/{name}/license/scans

List license scans

List license scans for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of license scans	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

Fields of the 200 response (application/json):

Field	Type	Required	Description
scans	array of LicenseScanResult	no	-

GET /api/v1/repositories/{name}/license/scans/{id}

Get license scan

Get details of a specific license scan

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	License scan details	application/json: LicenseScanResult
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Scan not found	-

POST /api/v1/repositories/{name}/license/scans/{id}/quarantine

Quarantine or approve license scan artifact

Quarantine (quarantined: true) or approve (quarantined: false) the artifact of a license scan (admin only). An artifact quarantined by a blocking license policy stays quarantined, also across re-scans of the same licenses, until it is approved here.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
quarantined	boolean	yes	-

Responses

Status	Description	Body
200	Updated license scan	application/json: LicenseScanResult
400	Invalid body	-
403	Admin access required	-
404	Repository or scan not found	-

GET /api/v1/repositories/{name}/members

Get group repository members

List the member repositories of a group repository in resolution order

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of members	application/json: object
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
members	array of RepositoryMember	no	-

PUT /api/v1/repositories/{name}/members

Update group repository members

Replace the ordered member repositories of a group repository. Members must be hosted or proxy repositories of the group's format; groups cannot be nested.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
member_repos	array of string	yes	List of member repository names

Responses

Status	Description	Body
200	Members updated	application/json: object
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
members	array of RepositoryMember	no	-

GET /api/v1/repositories/{name}/packages

List packages in repository

List all packages in a specific repository

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
page	query	integer	no	Minimum: 1.
limit	query	integer	no	Minimum: 1. Maximum: 100.
q	query	string	no	Only list rows whose listed name or version contains this text (case-insensitive, at most 200 characters). Maximum length: 200.
sort	query	string	no	Row order: newest first (created, the default) or by name and version (name). One of: created, name.
format	query	string	no	Only list packages of this format
package_name	query	string	no	Only list rows whose listed package name equals this value exactly (all versions of one package)
group	query	string	no	package returns one entry per package (format and name) instead of one per file: its latest version, version count, latest size and the scan state of the latest version. total then counts packages. The q, format and package_name filters apply to the rows before they are grouped. One of: package.
flagged	query	boolean	no	With group=package, true keeps the packages whose latest version has a critical or high vulnerability, a secret finding or a quarantined scan result. Rejected without group=package.

Responses

Status	Description	Body
200	List of packages: one entry per file (PackageFile), or one per package (PackageGroup) with group=package	application/json: object
400	Invalid sort, group, flagged or q	-
403	Forbidden	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
limit	integer	no	-
packages	array of any	no	-
page	integer	no	-
total	integer	no	-

POST /api/v1/repositories/{name}/packages

Upload a RPM package

Upload a package into a hosted rpm repository (multipart/form-data). Requires write access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name

Request body (required)

multipart/form-data: object

Field	Type	Required	Description
file	string (binary)	yes	The .rpm package

Responses

Status	Description	Body
200	Package stored	application/json: PackageUploadResult
400	Invalid input or wrong repository format	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	application/json: Error
405	Proxy and group repositories are read-only	application/json: Error
409	Package already exists	application/json: Error
413	File too large	application/json: Error

GET /api/v1/repositories/{name}/packages/{id}

Get a package version

One package version, by the row id of the package listing: the metadata its format stores, its declared dependencies and the files of the version. Requires read access to the repository. Dependencies are returned for npm (dependencies, devDependencies, peerDependencies, optionalDependencies), cargo, nuget (kind is the target framework), rubygems, conda, deb (Depends, Pre-Depends), rpm (requires) and go (go.mod require directives); the other formats do not store them server-side and return an empty list. Metadata holds only what the format's table stores: for pypi, helm, maven, docker and conan there are no declared dependencies, and docker layers or the image config are not part of the response.

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name
id	path	string (uuid)	yes	Row id from the package listing

Responses

Status	Description	Body
200	The package version	application/json: PackageDetail
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	No read access to the repository	-
404	Repository or package not found (a package of another repository is not found either)	-

DELETE /api/v1/repositories/{name}/packages/{id}

Delete a package

Delete a package row (an id of the package listing) from a hosted repository of any format: into the trash when the repository keeps one, else for good, refreshing the format's generated metadata. A conan recipe revision goes with its files. Released versions of immutable repositories answer 409 unless an admin passes force. Requires write access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name
id	path	string (uuid)	yes	Package ID

Responses

Status	Description	Body
200	Package deleted	application/json: PackageDeleteResult
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or package not found	application/json: Error
409	Release versions are immutable in this repository	application/json: Error

GET /api/v1/repositories/{name}/packages/{id}/delta

Download a binary delta

Returns a binary diff that turns the package whose sha256 is given in from into the target package. The delta is generated on demand and cached. Applies to rpm and deb packages. Requires read access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name
id	path	string (uuid)	yes	Target package ID
from	query	string	yes	sha256 (64 hex characters) of the package the client already has. Pattern: ^[0-9a-fA-F]{64}$.

Responses

Status	Description	Body
200	Binary delta Headers: X-Delta-From, X-Delta-Size, X-Delta-To.	application/octet-stream: string (binary)
400	Missing or invalid from	application/json: Error
403	Forbidden	application/json: Error
404	Repository, target or source package not found	application/json: Error
413	Package too large for delta generation	application/json: Error

GET /api/v1/repositories/{name}/packages/{id}/deltas

List deltas of a package

List the pre-computed deltas targeting a package. Requires read access.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	Repository name
id	path	string (uuid)	yes	Target package ID

Responses

Status	Description	Body
200	Available deltas	application/json: PackageDeltaList
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or package not found	application/json: Error

GET /api/v1/repositories/{name}/packages/{id}/download

Download a package

Streams the blob of a row returned by the package listing (any format) as an attachment named after the listing filename. Docker tags download their manifest as sha256_<hex>.json.

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	Package file	application/octet-stream: string (binary)
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Package not found in this repository, or the row has no stored file	-
501	No blob store configured	-

GET /api/v1/repositories/{name}/quota

Get repository quota

Get quota configuration for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	Quota configuration	application/json: Quota
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	-

PUT /api/v1/repositories/{name}/quota

Set repository quota

Set quota configuration for a repository. Requires global admin, or the maintainer or owner role in the repository's project (a caller who cannot read the repository gets 404).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: Quota

Responses

Status	Description	Body
200	Quota updated	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

DELETE /api/v1/repositories/{name}/quota

Delete repository quota

Remove quota configuration for a repository. Requires global admin, or the maintainer or owner role in the repository's project (a caller who cannot read the repository gets 404).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
204	Quota deleted	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

POST /api/v1/repositories/{name}/quota/reconcile

Reconcile repository quota usage

Recompute the repository's usage counters (size and artifact count) from its package rows, correcting drift left by a database crash or a restore. Limits are unchanged. Admin only.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	Quota with the recomputed usage	application/json: Quota
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Admin access required	-
404	Repository not found	-

GET /api/v1/repositories/{name}/sbom

List SBOM reports

List SBOM reports for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of SBOM reports	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

Fields of the 200 response (application/json):

Field	Type	Required	Description
reports	array of SBOMReport	no	-

POST /api/v1/repositories/{name}/sbom/generate

Generate SBOM

Generate a Software Bill of Materials for a repository artifact. Components are the dependencies declared by the stored package file (manifest and lockfile) merged with the artifact's dependencies property.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
artifact_id	string (uuid)	yes	-
format	string	yes	cyclonedx (JSON), spdx (2.3 tag-value), spdx-json (2.3 JSON) or spdx3-json (SPDX 3.0.1 JSON-LD). One of: cyclonedx, spdx, spdx-json, spdx3-json.
metadata	object	no	-
spec_version	string	no	CycloneDX 1.4, 1.5 (default) or 1.6; SPDX 2.3; SPDX 3 3.0.1. Optional.

Responses

Status	Description	Body
201	SBOM generation started	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error
422	The artifact's package file is too large or ambiguous to be read safely (unsafe_artifact)	-

GET /api/v1/repositories/{name}/sbom/{id}

Get SBOM report

Get details of a specific SBOM report

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	SBOM report details	application/json: SBOMReport
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	SBOM report not found	-

DELETE /api/v1/repositories/{name}/sbom/{id}

Delete SBOM report

Delete a specific SBOM report

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	SBOM report deleted	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	SBOM report not found	-

GET /api/v1/repositories/{name}/sbom/{id}/download

Download SBOM report

Download an SBOM report file

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-
attest	query	string	no	true returns the document as a signed in-toto attestation in a DSSE envelope; bundle returns a Sigstore bundle, the input of cosign verify-blob-attestation. Verify with the key from /.well-known/openartifact/attestation-key.pem. One of: true, bundle.

Responses

Status	Description	Body
200	SBOM file, or its attestation with attest	application/octet-stream: string (binary); application/vnd.dev.sigstore.bundle.v0.3+json: object; application/vnd.dsse.envelope.v1+json: object
400	Invalid attest value, or the SBOM is not a JSON document (SPDX tag-value cannot be attested)	-
403	Forbidden	application/json: Error
404	SBOM report not found	-
501	Attestations are not enabled	-

POST /api/v1/repositories/{name}/secrets/scan

Scan secrets

Trigger a secrets scan for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
201	Secrets scan started	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

GET /api/v1/repositories/{name}/secrets/scans

List secrets scans

List secrets scans for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of secrets scans	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

Fields of the 200 response (application/json):

Field	Type	Required	Description
scans	array of ScanResult	no	-

GET /api/v1/repositories/{name}/secrets/scans/{id}

Get secrets scan

Get details of a specific secrets scan

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	Secrets scan details	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Scan not found	-

DELETE /api/v1/repositories/{name}/secrets/scans/{id}

Delete secrets scan

Delete a secrets scan

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	Secrets scan deleted	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Scan not found	-

POST /api/v1/repositories/{name}/secrets/scans/{id}/quarantine

Quarantine secrets scan artifact

Quarantine an artifact found in a secrets scan

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	Artifact quarantined	-
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

POST /api/v1/repositories/{name}/uploads

Start a presigned upload

Hosted raw repositories on any storage backend with a staging area: S3-compatible and GCS (presigned URLs), Azure (SAS URLs), and the filesystem and OCI registry backends (short-lived HMAC-signed URLs served by this server, which need baseUrl to be set). Returns a short-lived presigned PUT URL to a staging object; upload the bytes directly to it, then call the complete endpoint. Files above 5 GiB (up to 5 TiB) must set multipart: the response then carries the part plan instead of a URL, and each part URL comes from the parts endpoint. Requires write permission on the repository and on the path. The response carries a bearer credential and is sent with Cache-Control: no-store. A user may have at most storage.presignMaxPendingUploads uploads outstanding (not completed, not expired).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: PresignedUploadRequest

Responses

Status	Description	Body
201	Upload target	application/json: PresignedUpload
400	Invalid path, size, part size or sha256 (code invalid_size also when a size above 5 GiB lacks multipart, or is too large for a single upload on Azure), or the repository is not a hosted raw repository	application/json: Error
401	Authentication required	-
403	Write permission denied	-
404	Repository not found	-
429	Too many outstanding uploads for this user (retry after the Retry-After header)	application/json: Error
501	The storage backend does not support presigned uploads	application/json: Error

POST /api/v1/repositories/{name}/uploads/{id}/abort

Abort a presigned upload

Discards an upload that will not be completed: the staging object, the parts uploaded so far and the upload record. Only the creator of the upload or an administrator may abort it. Abandoned uploads are also swept automatically after they expire.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	The upload was discarded	-
400	Invalid request	application/json: Error
401	Authentication required	-
403	Write permission denied, or the caller is neither the creator of the upload nor an administrator	-
404	Repository or upload not found (or expired and swept)	-
409	Code upload_completed: the upload is already completed. Code upload_in_progress: a complete is running (retry after the Retry-After header)	application/json: Error
501	The storage backend does not support presigned uploads	application/json: Error

POST /api/v1/repositories/{name}/uploads/{id}/complete

Complete a presigned upload

Verifies that the staged object has the declared size and sha256, moves it to its content-addressed key, records the artifact (overwriting an existing path, like a raw PUT) and deletes the staging object. Only the creator of the upload or an administrator may complete it. The server reads the object back (up to 5 TiB) in a detached job (30 minutes plus about one second per 20 MiB, at most 6 hours) that survives a client disconnect; the read and the move are conditional on the object version seen at verification, so an object re-uploaded in between is refused. The call is idempotent: the first success returns 201, a retry returns 200 with the same body, and a retry while a verification is running returns 409 upload_in_progress. On a size or sha256 mismatch, or when the object changed during verification, the staging object and the upload are discarded and nothing is recorded. The repository's storage quota is enforced (507 quota_exceeded: the upload stays pending, nothing is recorded, and completing again after freeing space works); license and secret scanning are not applied, as for a raw PUT.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-
force	query	boolean	no	Administrators only: true overwrites an existing file of a repository with immutable_releases. Ignored for everyone else.

Responses

Status	Description	Body
200	The upload was already completed; the original result	application/json: PresignedUploadResult
201	Artifact recorded	application/json: PresignedUploadResult
400	The repository is not a hosted raw repository	application/json: Error
401	Authentication required	-
403	Write permission denied, or the caller is neither the creator of the upload nor an administrator	-
404	Repository or upload not found (or expired and swept)	-
409	Code upload_missing: nothing has been uploaded to the upload URL yet. Code upload_in_progress: another complete is verifying this upload (retry after the Retry-After header). Code upload_incomplete: a part of a multipart upload is missing or has the wrong size (the message names the part numbers; upload them and call complete again). Code upload_changed: the staged object was overwritten during verification; the upload was discarded. Code immutable_release: the path already exists in a repository with immutable_releases; nothing was recorded and the upload stays pending (retry with force=true as an administrator)	application/json: Error
410	The upload expired	application/json: Error
422	Size or sha256 does not match the declaration; the upload was discarded	application/json: Error
501	The storage backend does not support presigned uploads	application/json: Error
507	Code quota_exceeded: the repository's storage quota would be exceeded; nothing was recorded and the upload stays pending	application/json: Error

POST /api/v1/repositories/{name}/uploads/{id}/parts

Sign the parts of a multipart upload

Returns presigned PUT URLs for up to 100 parts of a multipart upload, each for exactly the returned size. Call it as often as needed (URLs live as long as the single-upload URL, and every call extends the upload's deadline), PUT the parts in any order and in parallel, then call complete. A part may be re-uploaded. The response carries bearer credentials and is sent with Cache-Control: no-store. Only the creator of the upload or an administrator may call it.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Request body (required)

application/json: PresignedPartsRequest

Responses

Status	Description	Body
200	Part upload targets	application/json: PresignedParts
400	Code invalid_part_numbers: empty, duplicate, more than 100 or out-of-range part numbers. Code not_multipart: the upload is a single upload	application/json: Error
401	Authentication required	-
403	Write permission denied, or the caller is neither the creator of the upload nor an administrator	-
404	Repository or upload not found (or expired and swept)	-
409	Code upload_completed: the upload is already completed	application/json: Error
410	The upload expired	application/json: Error
501	The storage backend does not support multipart uploads	application/json: Error

GET /api/v1/repositories/{name}/usage

Get repository usage

What the repository holds (packages, versions, stored bytes, newest publish) next to its quota. Package and version counts scan the repository's package rows: use it for one repository on demand, not in a loop. Requires global admin or the maintainer or owner role in the repository's project (a caller who cannot read the repository gets 404).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	Repository usage	application/json: RepositoryUsage
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Admin or project maintainer access required	-
404	Repository not found	-

GET /api/v1/repositories/{name}/vex

Download a VEX document

Build an OpenVEX 0.2.0 (default) or CycloneDX VEX document from the latest vulnerability scans and the recorded VEX decisions. With artifact_id it covers one artifact, otherwise every scanned artifact of the repository. Status per vulnerability: the recorded decision; else fixed when the scan's fixed_in is at or below the artifact version; else affected when the scan quarantined the artifact; else under_investigation. not_affected only comes from a recorded decision. Admin only.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
format	query	string	no	One of: openvex, cyclonedx. Default: openvex.
spec_version	query	string	no	CycloneDX spec version (1.4, 1.5 or 1.6; default 1.5). CycloneDX only.
artifact_id	query	string	no	Restrict the document to one artifact (name@version).
attest	query	string	no	true returns the document as a signed in-toto attestation in a DSSE envelope; bundle returns a Sigstore bundle, the input of cosign verify-blob-attestation. Verify with the key from /.well-known/openartifact/attestation-key.pem. One of: true, bundle.

Responses

Status	Description	Body
200	VEX document, or its attestation with attest	application/json: object; application/vnd.dev.sigstore.bundle.v0.3+json: object; application/vnd.dsse.envelope.v1+json: object
400	Invalid format, spec_version or artifact_id	-
403	Forbidden	application/json: Error
404	Repository not found	-
501	Attestations are not enabled	-

GET /api/v1/repositories/{name}/vex/statements

List VEX decisions

List the VEX decisions recorded for a repository, optionally for one artifact. Admin only.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
artifact_id	query	string	no	-

Responses

Status	Description	Body
200	VEX decisions	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
statements	array of VEXStatement	no	-

PUT /api/v1/repositories/{name}/vex/statements

Record a VEX decision

Record (or replace) the decision for one vulnerability of one artifact. not_affected requires a justification; other statuses must not carry one. Admin only.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
action_statement	string	no	-
artifact_id	string	yes	-
impact_statement	string	no	-
justification	string	no	One of: component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary, inline_mitigations_already_exist.
status	string	yes	One of: affected, not_affected, fixed, under_investigation.
vuln_id	string	yes	e.g. CVE-2024-1234 or GHSA-xxxx

Responses

Status	Description	Body
200	Recorded decision	application/json: VEXStatement
400	Validation failed	-
403	Forbidden	application/json: Error
404	Repository not found	-

DELETE /api/v1/repositories/{name}/vex/statements/{id}

Delete a VEX decision

Delete a recorded VEX decision; the vulnerability falls back to its derived status. Admin only.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	Decision deleted	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or decision not found	-

POST /api/v1/repositories/{name}/vuln/scan

Scan vulnerabilities

Start a vulnerability scan for an artifact. The scan runs in the background: poll the scan until scan_status is completed, partial or failed. A scanner that cannot run (not installed, timeout, non-zero exit, unreadable output, upstream error, unsupported ecosystem) is recorded as failed instead of completed with zero findings.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: VulnScanRequest

Responses

Status	Description	Body
200	Vulnerability scan started (scan_status is scanning)	application/json: VulnScanResult
400	Invalid body or unknown scanner	-
403	Admin access required	-
404	Repository not found	-

GET /api/v1/repositories/{name}/vuln/scanners

List vulnerability scanners

Report which vulnerability scanners can run on the server: osv is always ready; trivy and grype need their binary and a downloaded vulnerability database (see the scanning guide). A client should disable a scanner that is not ready and show its message.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	Scanners in the order osv, trivy, grype	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Admin access required	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
scanners	array of VulnScanner	yes	-

GET /api/v1/repositories/{name}/vuln/scans

List vulnerability scans

List vulnerability scans for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of vulnerability scans	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

Fields of the 200 response (application/json):

Field	Type	Required	Description
scans	array of VulnScanResult	no	-

GET /api/v1/repositories/{name}/vuln/scans/{id}

Get vulnerability scan

Get details of a specific vulnerability scan

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
200	Vulnerability scan details	application/json: VulnScanResult
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Scan not found	-

DELETE /api/v1/repositories/{name}/vuln/scans/{id}

Delete vulnerability scan

Delete a vulnerability scan

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	Vulnerability scan deleted	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Scan not found	-

POST /api/v1/repositories/{name}/vuln/scans/{id}/quarantine

Quarantine vulnerability scan artifact

Quarantine (quarantined: true) or release (quarantined: false) the artifact of a vulnerability scan (admin only).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
id	path	string (uuid)	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
quarantined	boolean	yes	-

Responses

Status	Description	Body
200	Updated vulnerability scan	application/json: VulnScanResult
400	Invalid body	-
403	Admin access required	-
404	Repository or scan not found	-

GET /api/v1/repositories/{name}/webhooks

List repository webhooks

List webhooks for a specific repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	List of webhooks	application/json: object
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
webhooks	array of Webhook	no	-

POST /api/v1/repositories/{name}/webhooks

Create repository webhook

Create a new webhook for a repository

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
content_type	string	no	-
enabled	boolean	no	-
events	array of string	yes	Items: one of: artifact.uploaded, artifact.deleted, repository.created, repository.deleted, artifact.restored, artifact.purged, repository.restored, repository.purged, bundle.promoted.
max_retries	integer	no	-
name	string	yes	-
payload_format	string	no	Delivery body format. openartifact is the native JSON; cloudevents is CloudEvents 1.0 structured mode (application/cloudevents+json); slack, teams and discord are the services' incoming-webhook shapes. One of: openartifact, cloudevents, slack, teams, discord. Default: openartifact.
secret	string	no	-
ssl_verify	boolean	no	-
timeout_seconds	integer	no	-
url	string (uri)	yes	-

Responses

Status	Description	Body
201	Webhook created	application/json: Webhook
400	Invalid request	application/json: Error
403	Forbidden	application/json: Error
404	Repository or addressed resource not found	application/json: Error

GET /api/v1/repository/{name}

Get repository

Get details of a specific repository

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	Repository details	application/json: Repository
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Repository not found	-

PATCH /api/v1/repository/{name}

Update repository

Update repository configuration. Requires global admin, or the maintainer or owner role in the repository's project; a caller with neither and no read access gets 404. A project maintainer may not send project (use the transfer route), blocked or presign_downloads, nor make the repository public unless the project allows public repositories (403); member_repos must be readable by the caller (403).

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: object

Field	Type	Required	Description
blocked	boolean	no	-
cache_ttl_seconds	integer	no	-
description	string	no	-
immutable_releases	boolean	no	When true, deleting or overwriting a released version is refused with 409 (SNAPSHOT/pre-release versions stay mutable). An admin can override with ?force=true.
max_stale_seconds	integer	no	Seconds past a cached file's expiry during which it may still be served, with a Warning: 110 header, when the upstream is unreachable, times out or answers 5xx. 0 disables serve-stale; default 604800 (7 days); max 31536000.
member_repos	array of string	no	-
merge_proxy_versions	boolean	no	Group repositories only, administrators only (403 otherwise). Absent leaves it unchanged.
negative_cache_ttl_seconds	integer	no	-
presign_downloads	boolean	no	Per-repository override of storage.presignDownloads: true always redirects eligible blob downloads to a presigned object-store URL, false always streams, null inherits the global setting. Metadata and manifests are never redirected. Omit to leave unchanged; send null to inherit. Nullable.
project	string	no	Move the repository to the named project (global admin only; unknown project: 404). Access of the old and new project's members changes immediately.
public	boolean	no	-
sign_packages	boolean	no	Hosted rpm repositories only (400 otherwise when true). When true, uploaded RPMs are signed with the active GPG key; existing packages are not re-signed.
trash_retention_days	integer	no	Absent leaves it unchanged; an explicit null resets it to the server default; 0..36500 sets it (0 = no trash). Nullable. Minimum: 0. Maximum: 36500.
upstream_password	string	no	-
upstream_url	string	no	-
upstream_username	string	no	-

Responses

Status	Description	Body
200	Repository updated	application/json: Repository
400	Invalid request (for example trash_retention_days out of range)	-
403	Admin access required	-
404	Repository not found	-

DELETE /api/v1/repository/{name}

Delete repository (to the trash)

Delete a repository (global admin, or maintainer or owner of its project). The request must confirm the repository name, as the confirm query parameter or a JSON body {"confirm": "<name>"}; otherwise 400 confirmation_required. When the repository's trash retention is above 0 the repository is moved to the trash (hidden everywhere, its name stays reserved, restorable and purged after the retention window); with retention 0 it is deleted permanently, contents included.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
confirm	query	string	no	Must equal the repository name (alternatively send it in the JSON body).

Request body

application/json: object

Field	Type	Required	Description
confirm	string	no	Must equal the repository name.

Responses

Status	Description	Body
204	Repository deleted (moved to the trash, or permanently deleted when retention is 0)	-
400	Missing or mismatched confirmation (error code confirmation_required)	application/json: Error
403	Admin access required	-
404	Repository not found	-
409	The repository is still referenced (for example by a release bundle or promotion); only possible when it is deleted permanently	-