Change the projects a registry robot reaches

Change which projects the robot reaches. Where the registry can change the robot in place, its login and secret keep working: on Harbor that takes a robot reaching several projects and a user as the admin credential, because no robot may hold Harbor’s robot update right. Any other change replaces the robot, and only with allow_new_secret: the answer carries the new secret once, and whatever logs in with the current one stops working. Asking for what the robot already holds changes nothing. The robot keeps its name, description and expiry. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication).

PUT /api/v1/org/registry-robots/{robot_name}/projects

Change the projects a registry robot reaches

Python

import requests

url = "https://platform.ankra.app/api/v1/org/registry-robots/{robot_name}/projects"

payload = { "projects": [
        {
            "permissions": ["<string>"],
            "project": "<string>"
        }
    ] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

200

{
  "application": {
    "id": "<string>",
    "name": "<string>"
  },
  "created_at": "<string>",
  "credential_name": "<string>",
  "description": "<string>",
  "expires_at": "<string>",
  "host": "<string>",
  "kind": "user",
  "managed": true,
  "name": "<string>",
  "permissions": [
    "<string>"
  ],
  "project": "<string>",
  "project_access": [
    {
      "permissions": [
        "<string>"
      ],
      "project": "<string>",
      "project_name": "<string>",
      "scope": "push"
    }
  ],
  "project_name": "<string>",
  "projects": [
    "<string>"
  ],
  "robot_name": "<string>",
  "rotated_at": "<string>",
  "scope": "push",
  "secret_changed": true,
  "account_email": "<string>",
  "provider": "harbor",
  "docker_login": "<string>",
  "secret": "<string>",
  "warning": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

robot_name · string · required

Body

application/json

The projects a robot should reach from now on, replacing the ones it reaches.

projects · RegistryRobotProjectRequest · object[] · required

Every project the robot should reach, 1 to 20 different ones, each with its own scope or permissions.

Show child attributes

allow_new_secret · boolean · default: false

Let Ankra replace the robot when the registry cannot change it in place. The robot gets a new secret, and its login changes when it moves between one project and several. Whatever logs in with the current secret stops working.

Response

200

application/json

Successful Response

application · RegistryRobotApplication · object | null · required

The application an application robot belongs to; null for every other kind, and for one whose application is gone.

Show child attributes

created_at · string · required

credential_name · string · required

The registry credential holding the login. Unique across the listing, which a robot's name is not.

description · string · required

expires_at · string | null · required

When the registry stops honouring the robot; null for one that never expires.

host · string · required

kind · enum<string> · required

Who the robot belongs to: a member (user), organisation provisioning (organisation: the ci and pull robots) or one application (application).

Available options: user, organisation, application

managed · boolean · required

True for a robot Ankra minted and whose secret it fans out itself. It is listed and read here, never rotated or revoked.

name · string · required

A member's robot: the name it was created under. A managed robot: ci, pull, or app-.

permissions · string[] · required

Every grant the robot holds, written resource:action; for a robot reaching several projects, every grant it holds on any of them.

project · string · required

project_access · RegistryRobotProjectAccess · object[] · required

Every project the robot reaches with the grants it holds there: one entry for a robot bound to one project, several for a robot reaching several, none for a managed robot whose project cannot be read.

Show child attributes

project_name · string · required

What a member addresses the project by: default for the organisation's own, the name it was created under for an extra project, and empty for a project on a registry the organisation runs itself.

projects · string[] · required

Every registry project the robot reaches; project and project_name are the first of them.

robot_name · string · required

rotated_at · string | null · required

scope · enum<string> · required

The preset the grants amount to, or custom when they are neither preset. For a robot reaching several projects, the preset every project holds alike, or custom when they differ.

Available options: push, pull, custom

secret_changed · boolean · required

Whether the robot was replaced. When false, its login and secret still work.

account_email · string

The service account a robot on Google Artifact Registry is; absent on Harbor.

provider · enum<string>

The kind of registry the robot lives on: harbor for the Ankra registry and any integrated Harbor, google_artifact_registry for an integrated Google Artifact Registry.

Available options: harbor, google_artifact_registry

docker_login · string

The login command for the new secret; only when the secret changed.

secret · string

The new secret, answered once; only when the secret changed.

warning · string

Set when the change was made but something after it did not finish, and says what is left.