Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.

Scopes

containers:write

Body

application/json
provider
enum<string>
required

Registry provider. See ContainerRegistryProvider.

Available options:
ghcr,
dockerhub,
ecr,
gar,
acr,
generic
auth_kind
enum<string>
required

How Strix authenticates. Use none for public images on generic or dockerhub. Use basic_token for a username and token. ghcr, gar and acr require it. Use aws_assume_role for ecr. This kind stores no credential. Strix assumes the IAM role in aws_role_arn on every pull.

Available options:
basic_token,
aws_assume_role,
none
registry_host
string | null

Registry host. Required for generic (for example registry.example.com), gar (a regional host such as us-central1-docker.pkg.dev), ecr (123456789012.dkr.ecr.us-east-1.amazonaws.com) and acr (myregistry.azurecr.io). Ignored for ghcr and dockerhub, whose hosts are fixed.

label
string | null

Display name for the connection. Defaults to the registry host.

username
string | null

Username for basic_token. Required for ghcr (GitHub username), dockerhub when a token is given, and acr (service principal application id). Ignored for gar, which always signs in as _json_key.

secret
string | null

Token or password for basic_token. For gar, the service account key file (JSON) of an account with the Artifact Registry Reader role. Strix encrypts the value and never returns it.

github_owner
string | null

GitHub package owner name, not a URL. For an organization, set this name and github_owner_type: organization. Personal connections default to username.

github_owner_type
enum<string> | null

For ghcr, select user for the token owner's personal packages or organization for organization packages. Defaults to user. Other providers reject GitHub account fields.

Available options:
user,
organization,
null
aws_role_arn
string | null

IAM role ARN for aws_assume_role. Must be in the account that owns the registry. Get the trust policy inputs from GET /containers/registries/ecr-setup.

Response

The connected registry.

registry
object
required

A connected container registry. The response never contains the stored credential.