Skip to main content
POST
Create a registry robot

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization
string | null
x-ankra-organisation-id
string | null

Body

application/json
name
string
required
description
string | null
expires_in_days
integer | null

Days until the registry stops honouring the robot. Omitted or null: it never expires.

Required range: 1 <= x <= 3650
permissions
string[] | null

The robot's own grants, each one of available_permissions from the listing, instead of a preset scope. Push carries pull with it. Stating both a preset scope and permissions is refused, and so is either beside projects.

project
string | null

The registry project the robot is bound to: omitted, null or default for the organisation's own, otherwise the name of one of its extra projects. A robot reaches that one project and no other. Refused beside projects.

projects
RegistryRobotProjectRequest · object[] | null

Every project a robot reaching several is bound to, 2 to 20 different ones, each with its own scope or permissions. A list of one is the same create as project. Refused beside project, scope or permissions. On the Ankra registry the robot is one Harbor system-level robot limited to the organisation's own projects; on an integrated Harbor that needs a system administrator admin credential; on Google Artifact Registry the one service account is bound on every repository.

Maximum array length: 20
scope
enum<string> | null

A preset: push (push and pull) or pull. Defaults to push when neither a scope nor permissions are stated. custom is only accepted beside permissions.

Available options:
push,
pull,
custom

Response

Successful Response

application
RegistryRobotApplication · object | null
required

The application an application robot belongs to; null for every other kind, and for one whose application is gone.

created_at
string
required
credential_name
string
required

The registry credential holding the login. Unique across the listing, which a robot's name is not.

description
string
required
docker_login
string
required
expires_at
string | null
required

When the registry stops honouring the robot; null for one that never expires.

host
string
required
kind
enum<string>
required

Who the robot belongs to: a member (user), organisation provisioning (organisation: the ci and pull robots) or one application (application).

Available options:
user,
organisation,
application
managed
boolean
required

True for a robot Ankra minted and whose secret it fans out itself. It is listed and read here, never rotated or revoked.

name
string
required

A member's robot: the name it was created under. A managed robot: ci, pull, or app-.

permissions
string[]
required

Every grant the robot holds, written resource:action; for a robot reaching several projects, every grant it holds on any of them.

project
string
required
project_access
RegistryRobotProjectAccess · object[]
required

Every project the robot reaches with the grants it holds there: one entry for a robot bound to one project, several for a robot reaching several, none for a managed robot whose project cannot be read.

project_name
string
required

What a member addresses the project by: default for the organisation's own, the name it was created under for an extra project, and empty for a project on a registry the organisation runs itself.

projects
string[]
required

Every registry project the robot reaches; project and project_name are the first of them.

robot_name
string
required
rotated_at
string | null
required
scope
enum<string>
required

The preset the grants amount to, or custom when they are neither preset. For a robot reaching several projects, the preset every project holds alike, or custom when they differ.

Available options:
push,
pull,
custom
secret
string
required
account_email
string

The service account a robot on Google Artifact Registry is; absent on Harbor.

provider
enum<string>

The kind of registry the robot lives on: harbor for the Ankra registry and any integrated Harbor, google_artifact_registry for an integrated Google Artifact Registry.

Available options:
harbor,
google_artifact_registry
warning
string

Set when the registry answered the secret but the platform could not store or record it: this response is then the only copy.