Registry credentials

Registry credentials store authentication details for private container registries. When an app or template uses an image from a private registry (such as ghcr.io, registry.gitlab.com, or a self-hosted registry), the platform looks up stored credentials for that registry host and authenticates the pull on the instance.

Credentials are stored per workspace. The registry host is canonicalized server-side when the credential is created, so aliases and full URLs are normalized to a consistent form. Passwords and tokens are stored encrypted and are never returned in any API response.

List registry credentials

GET/v1/workspaces/{wid}/registriesList registry credentials

Returns stored registry credentials for a workspace with pagination. Passwords are never included in the response.

Path parameters

Name	Type	Description
wid	integer	Workspace ID

Query parameters

Name	Type	Description
q	string	Quick search by registry host, username, or ID
id	integer[]	Filter to specific credential IDs
registry	string	Registry host substring to filter
username	string	Username substring to filter

Plus the shared pagination parameters. Returns a paged list of registry credential views.

curl -A 'curl/8.5' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  "https://api.galaxygate.net/v1/workspaces/1524141521580666880/registries"

Add or replace a registry credential

POST/v1/workspaces/{wid}/registriesAdd or replace a registry credential

Saves credentials for a private container registry. Before persisting, the platform validates the credentials against the live registry. If a credential for the same registry host already exists in the workspace it is replaced.

Path parameters

Name	Type	Description
wid	integer	Workspace ID

Request body

Field	Type	Required	Description
registry	string	yes	Registry host, for example ghcr.io. Accepts full URLs and common aliases; they are canonicalized server-side.
username	string	yes	Username for the registry
password	string	yes	Password, personal access token, or deploy token

curl -X POST -A 'curl/8.5' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "registry": "ghcr.io",
    "username": "myuser",
    "password": "ghp_xxxxxxxxxxxx"
  }' \
  "https://api.galaxygate.net/v1/workspaces/1524141521580666880/registries"

Returns 201 Created with the new credential view (without the password).

Fetch a registry credential

GET/v1/workspaces/{wid}/registries/{id}Fetch a registry credential

Returns a single stored credential by ID. The password is never returned.

Path parameters

Name	Type	Description
wid	integer	Workspace ID
id	integer	Credential ID

Returns the registry credential view.

Update a registry credential

PATCH/v1/workspaces/{wid}/registries/{id}Update a registry credential

Updates the username and/or password of a stored credential. The registry host is immutable; to change it, delete this credential and create a new one. Omitted fields are left unchanged. When either field changes, the new credentials are revalidated against the live registry before being persisted.

Path parameters

Name	Type	Description
wid	integer	Workspace ID
id	integer	Credential ID

Request body

All fields are optional, but at least one should be supplied. Neither field may be set to null.

Field	Type	Description
username	string	New username for the registry
password	string	New password, personal access token, or deploy token

Returns the updated credential view (without the password).

Delete a registry credential

DELETE/v1/workspaces/{wid}/registries/{id}Delete a registry credential

Removes a stored registry credential from the workspace. Existing apps that use images from this registry will no longer be able to pull updated images.

Path parameters

Name	Type	Description
wid	integer	Workspace ID
id	integer	Credential ID

Returns 204 No Content.

Re-test stored credentials

POST/v1/workspaces/{wid}/registries/{id}/testRe-test stored credentials

Reauthenticates the stored credentials against the live registry without modifying them. Useful for diagnosing pull failures after a password rotation.

Path parameters

Name	Type	Description
wid	integer	Workspace ID
id	integer	Credential ID

Returns 204 No Content on success, or 400 Bad Request with a description in the X-Message header if the credentials no longer work.