Create a registry robot

Create a robot account on the organisation's Ankra registry project, with a preset scope (push, which pushes and pulls, or pull) or its own list of permissions, and optionally an expiry in days. The robot is a project-level robot: it reaches the organisation's project and no other. Stating permissions that reach past pull and push additionally needs the credentials.reveal permission. The secret is returned once, in this response, together with the docker login command that uses it; the login is stored as a platform-managed registry credential named ankra-harbor-robot-<name>. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication).

POST /api/v1/org/registry-robots

Create a registry robot

Python

import requests

url = "https://platform.ankra.app/api/v1/org/registry-robots"

payload = { "name": "<string>" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

201

{
  "application": {
    "id": "<string>",
    "name": "<string>"
  },
  "created_at": "<string>",
  "credential_name": "<string>",
  "description": "<string>",
  "docker_login": "<string>",
  "expires_at": "<string>",
  "host": "<string>",
  "kind": "user",
  "managed": true,
  "name": "<string>",
  "permissions": [
    "<string>"
  ],
  "project": "<string>",
  "project_access": [
    {
      "permissions": [
        "<string>"
      ],
      "project": "<string>",
      "project_name": "<string>",
      "scope": "push"
    }
  ],
  "project_name": "<string>",
  "projects": [
    "<string>"
  ],
  "robot_name": "<string>",
  "rotated_at": "<string>",
  "scope": "push",
  "secret": "<string>",
  "account_email": "<string>",
  "provider": "harbor",
  "warning": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Body

application/json

name · string · required

description · string | null

expires_in_days · integer | null

Days until the registry stops honouring the robot. Omitted or null: it never expires.

Required range: 1 <= x <= 3650

permissions · string[] | null

The robot's own grants, each one of available_permissions from the listing, instead of a preset scope. Push carries pull with it. Stating both a preset scope and permissions is refused, and so is either beside projects.

project · string | null

The registry project the robot is bound to: omitted, null or default for the organisation's own, otherwise the name of one of its extra projects. A robot reaches that one project and no other. Refused beside projects.

projects · RegistryRobotProjectRequest · object[] | null

Every project a robot reaching several is bound to, 2 to 20 different ones, each with its own scope or permissions. A list of one is the same create as project. Refused beside project, scope or permissions. On the Ankra registry the robot is one Harbor system-level robot limited to the organisation's own projects; on an integrated Harbor that needs a system administrator admin credential; on Google Artifact Registry the one service account is bound on every repository.

Maximum array length: 20

Show child attributes

scope · enum<string> | null

A preset: push (push and pull) or pull. Defaults to push when neither a scope nor permissions are stated. custom is only accepted beside permissions.

Available options: push, pull, custom

Response

201

application/json

Successful Response

application · RegistryRobotApplication · object | null · required

The application an application robot belongs to; null for every other kind, and for one whose application is gone.

Show child attributes

created_at · string · required

credential_name · string · required

The registry credential holding the login. Unique across the listing, which a robot's name is not.

description · string · required

docker_login · string · required

expires_at · string | null · required

When the registry stops honouring the robot; null for one that never expires.

host · string · required

kind · enum<string> · required

Who the robot belongs to: a member (user), organisation provisioning (organisation: the ci and pull robots) or one application (application).

Available options: user, organisation, application

managed · boolean · required

True for a robot Ankra minted and whose secret it fans out itself. It is listed and read here, never rotated or revoked.

name · string · required

A member's robot: the name it was created under. A managed robot: ci, pull, or app-.

permissions · string[] · required

Every grant the robot holds, written resource:action; for a robot reaching several projects, every grant it holds on any of them.

project · string · required

project_access · RegistryRobotProjectAccess · object[] · required

Every project the robot reaches with the grants it holds there: one entry for a robot bound to one project, several for a robot reaching several, none for a managed robot whose project cannot be read.

Show child attributes

project_name · string · required

What a member addresses the project by: default for the organisation's own, the name it was created under for an extra project, and empty for a project on a registry the organisation runs itself.

projects · string[] · required

Every registry project the robot reaches; project and project_name are the first of them.

robot_name · string · required

rotated_at · string | null · required

scope · enum<string> · required

The preset the grants amount to, or custom when they are neither preset. For a robot reaching several projects, the preset every project holds alike, or custom when they differ.

Available options: push, pull, custom

secret · string · required

account_email · string

The service account a robot on Google Artifact Registry is; absent on Harbor.

provider · enum<string>

The kind of registry the robot lives on: harbor for the Ankra registry and any integrated Harbor, google_artifact_registry for an integrated Google Artifact Registry.

Available options: harbor, google_artifact_registry

warning · string

Set when the registry answered the secret but the platform could not store or record it: this response is then the only copy.