Registry credentials

Registry credentials store authentication details for private container registries. When an app or template uses an image from a private registry (such as ghcr.io, registry.gitlab.com, or a self-hosted registry), the platform looks up stored credentials for that registry host and authenticates the pull on the instance.

All path parameters are required. Request bodies are required for create and update operations.

Credentials are stored per workspace. The registry host is canonicalized server-side when the credential is created, so aliases and full URLs are normalized to a consistent form. Passwords and tokens are stored encrypted and are never returned in any API response.

List registry credentials

GET/v1/workspaces/{wid}/registriesList registry credentials

Returns stored registry credentials for a workspace with pagination. Passwords are never included in the response.

Path parameters

Name	Type	Description
wid	string	Workspace ID

Query parameters

Name	Type	Description
q	string	Quick search by registry host, username, or ID
id	string[]	Filter to specific credential IDs
registry	string	Registry host substring to filter
username	string	Username substring to filter
owner	string[]	Filter by workspace IDs

All query parameters are optional, including the shared pagination parameters. Returns 200 OK with a KeysetResultRegistryCredentialView containing items and pagination fields. Each credential has id, owner, registry, username, and created_at.

curl -A 'curl/8.5' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  "https://api.galaxygate.net/v1/workspaces/1524141521580666880/registries"

Add or replace a registry credential

POST/v1/workspaces/{wid}/registriesAdd or replace a registry credential

Saves credentials for a private container registry. Before persisting, the platform validates the credentials against the live registry. If a credential for the same registry host already exists in the workspace it is replaced.

Path parameters

Name	Type	Description
wid	string	Workspace ID

Request body

Field	Type	Required	Description
registry	string	yes	Registry host, for example ghcr.io. Accepts full URLs and common aliases. They are canonicalized server-side.
username	string	yes	Username for the registry
password	string	yes	Password, personal access token, or deploy token

curl -X POST -A 'curl/8.5' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "registry": "ghcr.io",
    "username": "myuser",
    "password": "ghp_xxxxxxxxxxxx"
  }' \
  "https://api.galaxygate.net/v1/workspaces/1524141521580666880/registries"

Returns 201 Created with the new credential view (without the password).

Fetch a registry credential

GET/v1/workspaces/{wid}/registries/{cid}Fetch a registry credential

Returns a single stored credential by ID. The password is never returned.

Path parameters

Name	Type	Description
wid	string	Workspace ID
cid	string	Credential ID

Returns 200 OK with the registry credential view.

Update a registry credential

PATCH/v1/workspaces/{wid}/registries/{cid}Update a registry credential

Updates the username and/or password of a stored credential. The registry host is immutable. To change it, delete this credential and create a new one. Omitted fields are left unchanged. When either field changes, the new credentials are revalidated against the live registry before being persisted.

Path parameters

Name	Type	Description
wid	string	Workspace ID
cid	string	Credential ID

Request body

Both fields are optional. An empty object leaves the credential unchanged. Neither field may be set to null or a blank string.

Field	Type	Description
username	string	New username for the registry
password	string	New password, personal access token, or deploy token

Returns 200 OK with the updated credential view (without the password).

Delete a registry credential

DELETE/v1/workspaces/{wid}/registries/{cid}Delete a registry credential

Removes a stored registry credential from the workspace. Future app deployments and updates will no longer find these stored credentials for registry authentication.

Path parameters

Name	Type	Description
wid	string	Workspace ID
cid	string	Credential ID

Returns 204 No Content.

Re-test stored credentials

POST/v1/workspaces/{wid}/registries/{cid}/testRe-test stored credentials

Reauthenticates the stored credentials against the live registry without modifying them. Useful for diagnosing pull failures after a password rotation.

Path parameters

Name	Type	Description
wid	string	Workspace ID
cid	string	Credential ID

Returns 204 No Content on success, or 400 Bad Request with an ApiError JSON body containing error and status if the credentials no longer work.