Rotate a registry robot's secret

Mint a new secret for the robot and return it once. The previous secret stops working. A robot the registry no longer has is minted again under the same name with its recorded permissions and the rest of its lifetime. A rotation never extends a robot: an expired one, and a robot Ankra manages, are refused with 409. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication).

POST /api/v1/org/registry-robots/{robot_name}/rotate

Rotate a registry robot's secret

Python

import requests

url = "https://platform.ankra.app/api/v1/org/registry-robots/{robot_name}/rotate"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

200

{
  "application": {
    "id": "<string>",
    "name": "<string>"
  },
  "created_at": "<string>",
  "credential_name": "<string>",
  "description": "<string>",
  "docker_login": "<string>",
  "expires_at": "<string>",
  "host": "<string>",
  "kind": "user",
  "managed": true,
  "name": "<string>",
  "permissions": [
    "<string>"
  ],
  "project": "<string>",
  "project_access": [
    {
      "permissions": [
        "<string>"
      ],
      "project": "<string>",
      "project_name": "<string>",
      "scope": "push"
    }
  ],
  "project_name": "<string>",
  "projects": [
    "<string>"
  ],
  "robot_name": "<string>",
  "rotated_at": "<string>",
  "scope": "push",
  "secret": "<string>",
  "account_email": "<string>",
  "provider": "harbor",
  "warning": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

robot_name · string · required

Response

200

application/json

Successful Response

application · RegistryRobotApplication · object | null · required

The application an application robot belongs to; null for every other kind, and for one whose application is gone.

Show child attributes

created_at · string · required

credential_name · string · required

The registry credential holding the login. Unique across the listing, which a robot's name is not.

description · string · required

docker_login · string · required

expires_at · string | null · required

When the registry stops honouring the robot; null for one that never expires.

host · string · required

kind · enum<string> · required

Who the robot belongs to: a member (user), organisation provisioning (organisation: the ci and pull robots) or one application (application).

Available options: user, organisation, application

managed · boolean · required

True for a robot Ankra minted and whose secret it fans out itself. It is listed and read here, never rotated or revoked.

name · string · required

A member's robot: the name it was created under. A managed robot: ci, pull, or app-.

permissions · string[] · required

Every grant the robot holds, written resource:action; for a robot reaching several projects, every grant it holds on any of them.

project · string · required

project_access · RegistryRobotProjectAccess · object[] · required

Every project the robot reaches with the grants it holds there: one entry for a robot bound to one project, several for a robot reaching several, none for a managed robot whose project cannot be read.

Show child attributes

project_name · string · required

What a member addresses the project by: default for the organisation's own, the name it was created under for an extra project, and empty for a project on a registry the organisation runs itself.

projects · string[] · required

Every registry project the robot reaches; project and project_name are the first of them.

robot_name · string · required

rotated_at · string | null · required

scope · enum<string> · required

The preset the grants amount to, or custom when they are neither preset. For a robot reaching several projects, the preset every project holds alike, or custom when they differ.

Available options: push, pull, custom

secret · string · required

account_email · string

The service account a robot on Google Artifact Registry is; absent on Harbor.

provider · enum<string>

The kind of registry the robot lives on: harbor for the Ankra registry and any integrated Harbor, google_artifact_registry for an integrated Google Artifact Registry.

Available options: harbor, google_artifact_registry

warning · string

Set when the registry answered the secret but the platform could not store or record it: this response is then the only copy.