nprasad2077/docker-docs
1
0 Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-04 10:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: document a PAT repository scope plus Cloud Sandboxes (#26360)

Browse Source 
## Summary

A personal access token can hold one repository scope and Cloud
Sandboxes access (`sandbox:use`). The docs still said each token has one
permission level.

@netlify /security/access-tokens/personal-access-tokens/

Preview:
-
https://deploy-preview-26360--docsdocker.netlify.app/security/access-tokens/personal-access-tokens/
-
https://deploy-preview-26360--docsdocker.netlify.app/security/access-tokens/
-
https://deploy-preview-26360--docsdocker.netlify.app/security/access-tokens/reference/
-
https://deploy-preview-26360--docsdocker.netlify.app/ai/sandboxes-api/authentication/

Generated by Cursor

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Alexa KristensenandCursor authored and GitHub committed 2026-10-16 06:55:42 -05:00
1 parent 5a5401f376
commit 6232991f54
10 files changed
+206 -124
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

content/guides/genai-claude-code-mcp.md
+1 -1
View File
@@ -71,7 +71,7 @@ Make sure you have:
1. Select the **Docker Hub**MCP server
1. Add the MCP server, then open the **Configuration** tab
1. Enter your Docker Hub username
1. [Create a read-only personal access token](/security/access-tokens/personal-access-tokens/#create-a-personal-access-token) and enter your access token under **Secrets**
1. [Create a read-only personal access token](/security/access-tokens/personal-access-tokens/#create) and enter your access token under **Secrets**
1. Save the configuration
![Docker Hub](images/genai-claude-code-mcp-catalog-docker-hub.avif "Docker Hub")
content/manuals/ai/sandboxes-api/authentication.md
+15 -7
View File
@@ -1,7 +1,13 @@
---
title: Authentication and authorization
description: Authenticate requests to the Docker Sandboxes API with access tokens and learn which permissions your application needs.
keywords: docker sandboxes API authentication, sandbox authorization, bearer token, sandbox permissions, owner scope
description: >-
Authenticate requests to the Docker Sandboxes API with a personal
access token or browser sign-in, and learn which permissions your
application needs.
keywords: >-
docker sandboxes API authentication, sandbox authorization, bearer
token, sandbox permissions, personal access token, PAT, sandbox:use,
Allow Cloud Sandboxes access, Cloud Sandboxes
weight: 30
aliases:
- /ai/sandboxes/api/authentication/
@@ -42,9 +48,11 @@ the application. SDK sign-in is separate from `docker login` and `sbx login`.
## Authenticate automation with a PAT
Use a [personal access token](/manuals/security/access-tokens/personal-access-tokens.md)
for CI jobs and unattended applications. When creating the token, select the
`sandbox:use` permission in your Docker account's personal access token
settings. Registry permissions alone don't grant Cloud Sandboxes access.
for CI jobs and unattended applications. When creating the token, select
**Allow Cloud Sandboxes access**. That grants the `sandbox:use` scope. The
same token can also have a repository permission, for example to push
images and use Cloud Sandboxes. Registry permissions alone don't grant
Cloud Sandboxes access.
Provide your Docker ID and PAT to the SDK. For example, read them from your
application's environment:
@@ -111,8 +119,8 @@ Account permissions also control access to optional features. See
## Authenticate direct API requests
If you call the REST API without the SDK, obtain and renew access tokens in
your application. Exchange your Docker ID and a PAT with `sandbox:use`
permission using the [Docker Hub authentication API](/reference/api/hub/latest/operations/AuthCreateAccessToken/):
your application. Exchange your Docker ID and a PAT with the `sandbox:use`
scope using the [Docker Hub authentication API](/reference/api/hub/latest/operations/AuthCreateAccessToken/):
```console
$ ACCESS_TOKEN=$(curl --silent --show-error --fail --request POST \
content/manuals/ai/sandboxes-api/cookbook/connect-to-cloud-with-a-bearer-token.md
+18 -5
View File
@@ -85,15 +85,28 @@ Remove the stored credentials when your application no longer needs them. Your a
## Use a personal access token {#3-use-a-personal-access-token}
Create a [Docker personal access token](https://docs.docker.com/security/access-tokens/) for the Docker account your application will use. Provide your Docker username and PAT through your application's secret manager or environment, then pass them to the SDK's PAT authentication option.
Create a
[Docker personal access token](https://docs.docker.com/security/access-tokens/)
for the Docker account your application will use. Provide your Docker
username and PAT through your application's secret manager or
environment, then pass them to the SDK's PAT authentication option.
The SDK exchanges the PAT for a short-lived access token and repeats the exchange when needed. Supply the PAT as a PAT credential, not as an access token or an Authorization header. A revoked or expired PAT requires a replacement credential.
The SDK exchanges the PAT for a short-lived access token and repeats
the exchange when needed. Supply the PAT as a PAT credential, not as
an access token or an Authorization header. A revoked or expired PAT
requires a replacement credential.
Managed OAuth and PAT authentication use the default Docker service address. Use a caller-supplied access token or provider when you need to override that address.
Managed OAuth and PAT authentication use the default Docker service
address. Use a caller-supplied access token or provider when you need
to override that address.
Your PAT needs the `sandbox:use` permission. Select it when you create the token, at `https://app.docker.com/accounts/[username]/settings/personal-access-tokens`.
Your PAT needs the `sandbox:use` scope. When you create the token,
select **Allow Cloud Sandboxes access**. The same token can also have
a repository permission. Create the token at
`https://app.docker.com/accounts/[username]/settings/personal-access-tokens`.
Keep the PAT on the machine running your application. Do not put it in a sandbox's environment, source code, or logs.
Keep the PAT on the machine running your application. Do not put it in
a sandbox's environment, source code, or logs.
{{< tabs >}}
{{< tab name="TypeScript" >}}
content/manuals/faqs/accounts.md
+1 -1
View File
@@ -114,7 +114,7 @@ Check the following:
[organization access token](/manuals/security/access-tokens/organization-access-tokens.md).
2. You pasted the full token, with no spaces or line breaks. Docker
shows a token only once. If you no longer have it,
[create a new personal access token](/manuals/security/access-tokens/personal-access-tokens.md#create-a-personal-access-token).
[create a new personal access token](/manuals/security/access-tokens/personal-access-tokens.md#create).
3. On the **Personal access tokens** page, find the token and use its
status:
- **Expired:** Create a new token. You can't change the expiration
content/manuals/security/access-tokens/_index.md
+17 -9
View File
@@ -3,14 +3,17 @@ title: Access tokens
linkTitle: Access tokens
description: >-
Choose a personal or organization access token to authenticate to
Docker Hub.
Docker Hub and Cloud Sandboxes.
keywords: >-
access tokens, personal access tokens, organization access tokens,
PAT, OAT, Docker Hub, Docker security
PAT, OAT, Docker Hub, Docker security, Cloud Sandboxes,
repository permissions, sandbox:use
weight: 10
grid:
- title: Personal access tokens
description: Authenticate the Docker CLI and tools with a token tied to your account.
description: >-
Authenticate the Docker CLI and tools with a token tied to your
account.
icon: lock-closed
link: /security/access-tokens/personal-access-tokens/
- title: Organization access tokens
@@ -32,7 +35,16 @@ password.
## Choose a token type
## PATs
Pick a PAT for work that runs as you, or an OAT for organization-owned
automation.
## Personal access tokens (PATs) {#pats}
A PAT has
[one repository permission](/manuals/security/access-tokens/reference.md#personal-access-token-permissions)
for every repository the account can access. A PAT can also grant
[Cloud Sandboxes access](/manuals/security/access-tokens/reference.md#cloud-sandboxes-access),
which is a separate setting on the token.
Use a PAT for Docker Desktop, for environments governed by
[Image Access Management](/manuals/desktop/enterprise/hardened-desktop/image-access-management.md),
@@ -41,11 +53,7 @@ to the CLI when two-factor authentication (2FA) is turned on or single
sign-on (SSO) is enforced, because the CLI doesn't accept your password
in those cases.
A PAT uses
[one permission level](/manuals/security/access-tokens/reference.md#personal-access-token-permissions)
for every repository the account can access.
## OATs
## Organization access tokens (OATs) {#oats}
Use an OAT for production systems that pull images during deployment,
monitoring or backup tools that check repository status or pull images,
content/manuals/security/access-tokens/personal-access-tokens.md
+39 -26
View File
@@ -2,12 +2,13 @@
title: Create and manage personal access tokens
linkTitle: Personal access tokens
description: >-
Create a personal access token, set its permissions and expiration,
and sign in to the Docker CLI.
Create a personal access token, set repository permissions and Cloud
Sandboxes access, set expiration, and sign in to the Docker CLI.
keywords: >-
personal access token, PAT, Docker Hub, docker login,
CLI authentication, token permissions, token expiration,
two-factor authentication, SSO
CLI authentication, token permissions, repository permissions,
token expiration, two-factor authentication, SSO, Cloud Sandboxes,
sandbox:use, Allow Cloud Sandboxes access, No repository access
weight: 10
aliases:
- /docker-hub/access-tokens/
@@ -18,16 +19,13 @@ aliases:
{{< summary-bar feature_name="PATs" >}}
A personal access token (PAT) lets you sign in to Docker Hub without
your password. Use a token for the Docker CLI, scripts, continuous
integration (CI) jobs, and other tools that should act as your account.
your password. You can create several tokens and revoke one without
changing your password. From Docker Home, you can view the token list,
which shows when each token was last used.
Each token has one permission level. You can create several tokens and
revoke one without changing your password. The token list shows when
each token was last used.
When two-factor authentication is turned on, or single sign-on is
enforced, password sign-in to the CLI isn't supported. Sign in with a
PAT instead.
Treat PATs like passwords and keep them secure. Store tokens in a
credential manager and never commit them to source code. Before you
create a PAT, you must verify your email address.
> [!TIP]
>
@@ -35,10 +33,14 @@ PAT instead.
> [organization access tokens (OATs)](/manuals/security/access-tokens/organization-access-tokens.md),
> which aren't tied to individual user accounts.
## Create a personal access token
## Create a personal access token {#create}
Treat PATs like passwords and keep them secure. Store tokens in a
credential manager and never commit them to source code. Before you create a PAT, you must verify your email address. To create a PAT:
When you create a PAT, you choose one repository permission and whether
the token can use Cloud Sandboxes. You can combine these to fit the
task. For example, a token can use Cloud Sandboxes with no repository
access, or it can push images and use Cloud Sandboxes.
To create a PAT:
1. Sign in to [Docker Home](https://app.docker.com/).
1. Select your avatar in the top-right corner, then select
@@ -48,18 +50,28 @@ credential manager and never commit them to source code. Before you create a PAT
1. Configure your token:
- **Access token description:** Enter a name for the token, up to
100 characters. This field is required.
- **Expiration date:** Optional. Select **30 days**, **90 days**, or
**Custom**. With **Custom**, choose a date and hour up to one year
from today. The default, **None**, creates a token that doesn't
expire.
- **Access permissions:** Select one
[permission level](/manuals/security/access-tokens/reference.md#personal-access-token-permissions).
The default is **Repo Public Read-only**.
- **Expiration date:** Optional. The default is **None**, which
creates a token that doesn't expire.
- Select **30 days**, **90 days**, or **Custom**.
- With **Custom**, choose a date and hour up to one year from
today.
- **Access permissions:** Set a repository permission and, if you
need it, Cloud Sandboxes access. Select at least
[one permission](/manuals/security/access-tokens/reference.md#personal-access-token-permissions).
- **Repository permissions:** The default is **Repo Public
Read-only**.
- Select one level.
- Select **No repository access** when the token should not
access repositories.
- **Allow Cloud Sandboxes access:** Select this to let the token
create and use Cloud Sandboxes. You can add it to any
repository permission, or use it with **No repository
access**.
1. Select **Generate**. Copy the token and save it. Docker shows the
token once and doesn't store it. You can't retrieve it after you
leave the page.
## Sign in
## Sign in with a personal access token {#sign-in}
Run `docker login` with your Docker ID. When the CLI asks for a
password, paste the PAT.
@@ -72,7 +84,7 @@ Password: [paste your PAT here]
If sign-in fails with `Incorrect authentication credentials`, see
[Why does sign-in fail with "Incorrect authentication credentials"?](/manuals/faqs/accounts.md#why-does-sign-in-fail-with-incorrect-authentication-credentials).
## Update or delete
## Update or delete a personal access token {#update-or-delete}
You can rename a token, change its permissions, deactivate it, activate
it again, or delete it. You can't edit the expiration date on an
@@ -97,7 +109,7 @@ date.
Expired and revoked tokens can only be deleted.
1. If you selected **Edit**, change the **Access token description** or
**Scopes**, then select **Save token**.
**Access permissions**, then select **Save token**.
## Auto-generated tokens
@@ -136,5 +148,6 @@ Best practices for fair use include:
- [Choose a PAT or OAT](/manuals/security/access-tokens/_index.md)
- [Look up PAT permissions](/manuals/security/access-tokens/reference.md#personal-access-token-permissions)
- [Authenticate to Cloud Sandboxes](/manuals/ai/sandboxes-api/authentication.md)
- [Create an OAT](/manuals/security/access-tokens/organization-access-tokens.md)
- [Turn on two-factor authentication](/manuals/security/authentication/2fa/_index.md)
content/manuals/security/access-tokens/reference.md
+37 -16
View File
@@ -2,11 +2,14 @@
title: Access token reference
linkTitle: Reference
description: >-
Personal access token permissions, organization access token scopes,
and the Docker Hub API endpoints an organization access token can call.
Personal access token permissions, Cloud Sandboxes access,
organization access token scopes, and the Docker Hub API endpoints
an organization access token can call.
keywords: >-
access token reference, personal access token permissions,
organization access token scopes, Docker Hub API, OAT, PAT
repository permissions, organization access token scopes,
Docker Hub API, OAT, PAT, Cloud Sandboxes, sandbox:use,
Allow Cloud Sandboxes access, No repository access
weight: 30
---
@@ -15,10 +18,17 @@ or a set of scopes when you create the token.
## Personal access token permissions
Each personal access token (PAT) has one permission level that you select when you
[create the token](/manuals/security/access-tokens/personal-access-tokens.md#create-a-personal-access-token).
The token applies to every repository your account can access. You
can't limit a token to a single repository.
A personal access token (PAT) has two separate access settings:
repository permissions and Cloud Sandboxes access. You set both when
you
[create the token](/manuals/security/access-tokens/personal-access-tokens.md#create).
Select at least one permission.
### Repository permissions
The repository permission applies to every repository your account can
access. You can't limit a token to a single repository. Select **No
repository access** when the token should not access repositories.
- **Repo Public Read-only:** View, search, and pull images from public
repositories. This is the default.
@@ -28,13 +38,24 @@ can't limit a token to a single repository.
images to any repository your account manages.
- **Repo Read, Write, Delete:** Everything in **Repo Read & Write**,
plus delete images and manage your repositories.
- **Cloud Sandboxes:** Authenticate to the
[Docker Cloud Sandboxes API](/manuals/ai/sandboxes-api/authentication.md).
Cloud Sandboxes is a paid feature.
Choose the lowest permission that covers what the token needs to do.
For example, a CI job that only pulls a private base image needs
**Repo Read-only**. You can change PAT permissions at any time if the PAT is active or inactive, but not expired.
Choose the lowest repository permission that covers what the token
needs to do. For example, a CI job that only pulls a private base
image needs **Repo Read-only**. You can change PAT permissions at any
time if the PAT is active or inactive, but not expired.
### Cloud Sandboxes access
Cloud Sandboxes access is separate from the repository permission.
- **Allow Cloud Sandboxes access:** Select this in Docker Home to let
the token create and use Docker Cloud Sandboxes. You can add it to
any repository permission in the list, or use it with **No
repository access**.
- `sandbox:use`: The scope a PAT needs to authenticate to Cloud
Sandboxes. Selecting **Allow Cloud Sandboxes access** adds this
scope to the token. See
[Cloud Sandboxes authentication](/manuals/ai/sandboxes-api/authentication.md).
## Organization access token scopes
@@ -45,8 +66,8 @@ or
[edit](/manuals/security/access-tokens/organization-access-tokens.md#update-deactivate-or-delete)
the token. In Docker
Home, each scope shows its name and a short description while the value
in the table is what the token carries. You can change OAT scopes at any time if the OAT is active or inactive,
but not expired.
in the table is what the token carries. You can change OAT scopes at any
time if the OAT is active or inactive, but not expired.
Within a related set of operations, selecting a more capable scope
also grants the less capable ones. For example:
@@ -184,6 +205,6 @@ the replacement endpoint instead:
## Next steps
- [Create a PAT](/manuals/security/access-tokens/personal-access-tokens.md#create-a-personal-access-token)
- [Create a PAT](/manuals/security/access-tokens/personal-access-tokens.md#create)
- [Create an OAT](/manuals/security/access-tokens/organization-access-tokens.md#create-an-organization-access-token)
- [Choose a PAT or OAT](/manuals/security/access-tokens/_index.md)
content/reference/api/hub/changelog.md
+18 -1
View File
@@ -2,7 +2,9 @@
description: Docker Hub API changelog
title: Docker Hub API changelog
linkTitle: Changelog
keywords: docker hub, hub, whats new, release notes, api, changelog
keywords: >-
docker hub, hub, whats new, release notes, api, changelog,
personal access token, sandbox:use, Cloud Sandboxes
weight: 2
toc_min: 1
toc_max: 2
@@ -15,6 +17,21 @@ issues for Docker Service APIs.
---
## 2026-10-15
### Updates
- Add `sandbox:use` to personal access token scopes on
[Create personal access token](/reference/api/hub/latest/operations/postV2AccessTokens/).
A request can send `sandbox:use` alone, or `sandbox:use` with one
repository scope (`repo:admin`, `repo:write`, `repo:read`, or
`repo:public_read`).
- In Docker Home, **Allow Cloud Sandboxes access** is separate from
**Repository permissions**. The checkbox grants `sandbox:use`.
**No repository access** leaves the token without a repository scope.
---
## 2026-09-01
### Updates
content/reference/api/hub/latest.yaml
+3 -1
View File
@@ -108,6 +108,8 @@ tags:
For example: If you define `repo:write`, the API assumes the scope of both `repo:read` *and* `repo:public_read` as well.
If you were to define both `repo:write` *and* `repo:read`, then `repo:read` is assumed by `repo:write` and ignored.
`sandbox:use` is a separate grouping for Cloud Sandboxes. A repository scope does not include it, and it does not include a repository scope. A request can include `sandbox:use` on its own or with one repository scope.
***Treat your personal access token like your password and keep it secret. You cannot retrieve your token after it is generated.***
summary: Personal Access Tokens
kind: nav
@@ -3614,7 +3616,7 @@ components:
scopes:
type: array
description: |
Valid scopes: "repo:admin", "repo:write", "repo:read", "repo:public_read"
Valid scopes: "repo:admin", "repo:write", "repo:read", "repo:public_read", "sandbox:use". Include one repository scope, "sandbox:use", or both.
example:
- repo:read
items:
data/api-reference.json
Generated
+57 -57
View File
@@ -4,7 +4,7 @@
"connection": "hosted",
"description": "Docker Hub is a service provided by Docker for finding and sharing container images with your team.\n\nIt is the world's largest library and community for container images.\n\nIn addition to the [Docker Hub UI](https://docs.docker.com/docker-hub/) and [Docker Hub CLI tool](https://github.com/docker/hub-tool#readme) (currently experimental), Docker provides an API that allows you to interact with Docker Hub.\n\nBrowse through the Docker Hub API documentation to explore the supported endpoints.\n",
"diagnostics": [],
"digest": "46c09f04fd8e7b3fe464c9b406a1bf8a0a6a164c87083f57ebbab64ccb7c8d3f",
"digest": "b4db8f3d9b51ba9fb291b52842e83dfffe0992bf3432325bc5866a1fa4192e58",
"exampleCount": 315,
"experimental": false,
"guides": [
@@ -20,7 +20,7 @@
"deprecated": null,
"description": "Returns a paginated list of personal access tokens.",
"id": "getV2AccessTokens",
"line": 325,
"line": 327,
"method": "GET",
"parameters": [
{
@@ -244,7 +244,7 @@
"deprecated": null,
"description": "Creates and returns a personal access token.",
"id": "postV2AccessTokens",
"line": 300,
"line": 302,
"method": "POST",
"parameters": [],
"path": "/v2/access-tokens",
@@ -460,7 +460,7 @@
"deprecated": null,
"description": "Returns a personal access token by UUID.",
"id": "getV2AccessTokensByUuid",
"line": 391,
"line": 393,
"method": "GET",
"parameters": [
{
@@ -708,7 +708,7 @@
"deprecated": null,
"description": "Deletes a personal access token permanently. This cannot be undone.\n",
"id": "deleteV2AccessTokensByUuid",
"line": 430,
"line": 432,
"method": "DELETE",
"parameters": [
{
@@ -857,7 +857,7 @@
"deprecated": null,
"description": "Updates a personal access token partially. You can either update the token's label or enable/disable it.\n",
"id": "patchV2AccessTokensByUuid",
"line": 365,
"line": 367,
"method": "PATCH",
"parameters": [
{
@@ -1082,7 +1082,7 @@
"deprecated": null,
"description": "List audit log events for a given namespace.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "AuditLogs_ListAuditLogs",
"line": 754,
"line": 756,
"method": "GET",
"parameters": [
{
@@ -1541,7 +1541,7 @@
"deprecated": null,
"description": "List audit log actions for a namespace to be used as a filter for querying audit log events.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "AuditLogs_ListAuditActions",
"line": 447,
"line": 449,
"method": "GET",
"parameters": [
{
@@ -2609,7 +2609,7 @@
"deprecated": null,
"description": "Creates and returns a short-lived access token in JWT format for use as a bearer when calling Docker APIs.\n\nIf successful, the access token returned should be used in the HTTP Authorization header like \n`Authorization: Bearer {access_token}`.\n\n_**If your organization has SSO enforced, you must use a personal access token (PAT) instead of a password.**_\n",
"id": "AuthCreateAccessToken",
"line": 251,
"line": 253,
"method": "POST",
"parameters": [],
"path": "/v2/auth/token",
@@ -2837,7 +2837,7 @@
"deprecated": null,
"description": "Create multiple invites by emails or DockerIDs. Only a team owner can create invites.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "postV2InvitesBulk",
"line": 2249,
"line": 2251,
"method": "POST",
"parameters": [
{
@@ -3173,7 +3173,7 @@
"deprecated": null,
"description": "Mark the invite as cancelled so it doesn't show up on the list of pending invites\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "deleteV2InvitesById",
"line": 2196,
"line": 2198,
"method": "DELETE",
"parameters": [
{
@@ -3352,7 +3352,7 @@
"deprecated": null,
"description": "Resend a pending invite to the user, any org owner can resend an invite\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "patchV2InvitesByIdResend",
"line": 2225,
"line": 2227,
"method": "PATCH",
"parameters": [
{
@@ -3533,7 +3533,7 @@
"deprecated": null,
"description": "Returns a list of repositories within the specified namespace (organization or user).\n\nPublic repositories are accessible to everyone, while private repositories require appropriate authentication and permissions.\n\n\n\n**OAT listing behavior**: an OAT with the `scope-repository-list` scope sees all repositories including private ones. An OAT without that scope only sees public repositories. This filtering is silent: the response is a normal `200` with no indication that private repositories were withheld.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "listNamespaceRepositories",
"line": 1323,
"line": 1325,
"method": "GET",
"parameters": [
{
@@ -4065,7 +4065,7 @@
"deprecated": null,
"description": "Creates a new repository within the specified namespace. The repository will be created\nwith the provided metadata including name, description, and privacy settings.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "CreateRepository",
"line": 1478,
"line": 1480,
"method": "POST",
"parameters": [
{
@@ -4444,7 +4444,7 @@
"deprecated": null,
"description": "Returns a repository within the specified namespace (organization or user).\n\nPublic repositories are accessible to everyone, while private repositories require appropriate authentication and permissions.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "GetRepository",
"line": 1554,
"line": 1556,
"method": "GET",
"parameters": [
{
@@ -4753,7 +4753,7 @@
"deprecated": null,
"description": "Check a repository within the specified namespace (organization or user).\n\nPublic repositories are accessible to everyone, while private repositories require appropriate authentication and permissions.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "CheckRepository",
"line": 1612,
"line": 1614,
"method": "HEAD",
"parameters": [
{
@@ -4972,7 +4972,7 @@
"deprecated": null,
"description": "Updates the immutable tags configuration for this repository.\n\n**Only users with administrative privileges for the repository can modify these settings.**\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "UpdateRepositoryImmutableTags",
"line": 1211,
"line": 1213,
"method": "PATCH",
"parameters": [
{
@@ -5273,7 +5273,7 @@
"deprecated": null,
"description": "Validates the immutable tags regex passed in the request body and returns a list of tags matching it in this repository.\n\n**Only users with administrative privileges for the repository can call this endpoint.**\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "VerifyRepositoryImmutableTags",
"line": 1241,
"line": 1243,
"method": "POST",
"parameters": [
{
@@ -5544,7 +5544,7 @@
"deprecated": null,
"description": "Returns the list of tags for the specified repository.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "ListRepositoryTags",
"line": 1117,
"line": 1119,
"method": "GET",
"parameters": [
{
@@ -5792,7 +5792,7 @@
"deprecated": null,
"description": "Checks whether the repository has any tags.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "headV2NamespacesByNamespaceRepositoriesByRepositoryTags",
"line": 1148,
"line": 1150,
"method": "HEAD",
"parameters": [
{
@@ -5951,7 +5951,7 @@
"deprecated": null,
"description": "Returns details for a specific tag in the specified repository.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "GetRepositoryTag",
"line": 1171,
"line": 1173,
"method": "GET",
"parameters": [
{
@@ -6162,7 +6162,7 @@
"deprecated": null,
"description": "Checks whether the specified tag exists in the repository.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "headV2NamespacesByNamespaceRepositoriesByRepositoryTagsByTag",
"line": 1189,
"line": 1191,
"method": "HEAD",
"parameters": [
{
@@ -6331,7 +6331,7 @@
"deprecated": null,
"description": "List access tokens for an organization.\n",
"id": "getV2OrgsByNameAccessTokens",
"line": 1000,
"line": 1002,
"method": "GET",
"parameters": [
{
@@ -6577,7 +6577,7 @@
"deprecated": null,
"description": "Create an access token for an organization.\n",
"id": "postV2OrgsByNameAccessTokens",
"line": 970,
"line": 972,
"method": "POST",
"parameters": [],
"path": "/v2/orgs/{name}/access-tokens",
@@ -6862,7 +6862,7 @@
"deprecated": null,
"description": "Returns organization settings by name.\n",
"id": "getV2OrgsByNameSettings",
"line": 899,
"line": 901,
"method": "GET",
"parameters": [
{
@@ -7069,7 +7069,7 @@
"deprecated": null,
"description": "Updates an organization's settings. Some settings are only used when the organization is on a business subscription.\n\n***Only users with administrative privileges for the organization (owner role) can modify these settings.***\n\nThe following settings are only used on a business subscription:\n- `restricted_images`\n",
"id": "putV2OrgsByNameSettings",
"line": 921,
"line": 923,
"method": "PUT",
"parameters": [
{
@@ -7402,7 +7402,7 @@
"deprecated": null,
"description": "Get details of a specific access token for an organization.\n",
"id": "getV2OrgsByOrgNameAccessTokensByAccessTokenId",
"line": 1045,
"line": 1047,
"method": "GET",
"parameters": [
{
@@ -7632,7 +7632,7 @@
"deprecated": null,
"description": "Delete a specific access token for an organization. This action cannot be undone.\n",
"id": "deleteV2OrgsByOrgNameAccessTokensByAccessTokenId",
"line": 1095,
"line": 1097,
"method": "DELETE",
"parameters": [
{
@@ -7823,7 +7823,7 @@
"deprecated": null,
"description": "Update a specific access token for an organization.\n",
"id": "patchV2OrgsByOrgNameAccessTokensByAccessTokenId",
"line": 1067,
"line": 1069,
"method": "PATCH",
"parameters": [
{
@@ -8102,7 +8102,7 @@
"deprecated": null,
"description": "Get groups of an organization.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "getV2OrgsByOrgNameGroups",
"line": 1834,
"line": 1836,
"method": "GET",
"parameters": [
{
@@ -8472,7 +8472,7 @@
"deprecated": null,
"description": "Create a new group within an organization.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "postV2OrgsByOrgNameGroups",
"line": 1900,
"line": 1902,
"method": "POST",
"parameters": [
{
@@ -8763,7 +8763,7 @@
"deprecated": null,
"description": "Get a group of an organization.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "getV2OrgsByOrgNameGroupsByGroupName",
"line": 1943,
"line": 1945,
"method": "GET",
"parameters": [
{
@@ -8983,7 +8983,7 @@
"deprecated": null,
"description": "Update the details for an organization group.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "putV2OrgsByOrgNameGroupsByGroupName",
"line": 1967,
"line": 1969,
"method": "PUT",
"parameters": [
{
@@ -9285,7 +9285,7 @@
"deprecated": null,
"description": "Delete an organization group.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "deleteV2OrgsByOrgNameGroupsByGroupName",
"line": 2048,
"line": 2050,
"method": "DELETE",
"parameters": [
{
@@ -9476,7 +9476,7 @@
"deprecated": null,
"description": "Update some details for an organization group.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "patchV2OrgsByOrgNameGroupsByGroupName",
"line": 2005,
"line": 2007,
"method": "PATCH",
"parameters": [
{
@@ -9781,7 +9781,7 @@
"deprecated": null,
"description": "List the members (users) that are in a group.\nIf user is owner of the org or has otherwise elevated permissions, they can search by email and the result will also contain emails.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "getV2OrgsByOrgNameGroupsByGroupNameMembers",
"line": 2070,
"line": 2072,
"method": "GET",
"parameters": [
{
@@ -10159,7 +10159,7 @@
"deprecated": null,
"description": "Add a member to a group.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "postV2OrgsByOrgNameGroupsByGroupNameMembers",
"line": 2134,
"line": 2136,
"method": "POST",
"parameters": [
{
@@ -10455,7 +10455,7 @@
"deprecated": null,
"description": "Remove a user from a group.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "deleteV2OrgsByOrgNameGroupsByGroupNameMembersByUsername",
"line": 2167,
"line": 2169,
"method": "DELETE",
"parameters": [
{
@@ -10657,7 +10657,7 @@
"deprecated": null,
"description": "Return all pending invites for a given org, only team owners can call this endpoint\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "getV2OrgsByOrgNameInvites",
"line": 1793,
"line": 1795,
"method": "GET",
"parameters": [
{
@@ -10914,7 +10914,7 @@
"deprecated": null,
"description": "Returns a list of members for an organization.\n\n_The following fields are only visible to orgs with insights enabled._\n\n- `last_logged_in_at`\n- `last_seen_at`\n- `last_desktop_version`\n\nTo make visible, please see [View Insights for organization users](https://docs.docker.com/accounts/organization/insights/#view-insights-for-organization-users).\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "getV2OrgsByOrgNameMembers",
"line": 1645,
"line": 1647,
"method": "GET",
"parameters": [
{
@@ -11231,7 +11231,7 @@
"deprecated": null,
"description": "Export members of an organization as a CSV\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "getV2OrgsByOrgNameMembersExport",
"line": 1682,
"line": 1684,
"method": "GET",
"parameters": [
{
@@ -11477,7 +11477,7 @@
"deprecated": null,
"description": "Updates the role of a member in the organization.\n***Only users in the \"owners\" group of the organization can use this endpoint.***\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "putV2OrgsByOrgNameMembersByUsername",
"line": 1722,
"line": 1724,
"method": "PUT",
"parameters": [
{
@@ -11808,7 +11808,7 @@
"deprecated": null,
"description": "Removes the member from the org, ie. all groups in the org, unless they're the last owner\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "deleteV2OrgsByOrgNameMembersByUsername",
"line": 1767,
"line": 1769,
"method": "DELETE",
"parameters": [
{
@@ -12029,7 +12029,7 @@
"deprecated": null,
"description": "Assigns an organization group (team) to a repository with a specified permission level.\n\nThis operation accepts bearer tokens issued from organization access tokens (OATs). The token must have the required resource access and scopes.\n",
"id": "CreateRepositoryGroup",
"line": 1271,
"line": 1273,
"method": "POST",
"parameters": [
{
@@ -12338,7 +12338,7 @@
"deprecated": null,
"description": "Returns all resource types supported for the SCIM configuration.\n",
"id": "getV2Scim20ResourceTypes",
"line": 2293,
"line": 2295,
"method": "GET",
"parameters": [],
"path": "/v2/scim/2.0/ResourceTypes",
@@ -12573,7 +12573,7 @@
"deprecated": null,
"description": "Returns a resource type by name.\n",
"id": "getV2Scim20ResourceTypesByName",
"line": 2311,
"line": 2313,
"method": "GET",
"parameters": [
{
@@ -12828,7 +12828,7 @@
"deprecated": null,
"description": "Returns all schemas supported for the SCIM configuration.\n",
"id": "getV2Scim20Schemas",
"line": 2339,
"line": 2341,
"method": "GET",
"parameters": [],
"path": "/v2/scim/2.0/Schemas",
@@ -13061,7 +13061,7 @@
"deprecated": null,
"description": "Returns a schema by ID.\n",
"id": "getV2Scim20SchemasById",
"line": 2357,
"line": 2359,
"method": "GET",
"parameters": [
{
@@ -13315,7 +13315,7 @@
"deprecated": null,
"description": "Returns a service provider config for Docker's configuration.\n",
"id": "getV2Scim20ServiceProviderConfig",
"line": 2275,
"line": 2277,
"method": "GET",
"parameters": [],
"path": "/v2/scim/2.0/ServiceProviderConfig",
@@ -13526,7 +13526,7 @@
"deprecated": null,
"description": "Returns paginated users for an organization. Use `startIndex` and `count` query parameters to receive paginated results.\n\n**Sorting:**\n\nSorting allows you to specify the order in which resources are returned by specifying a combination of `sortBy` and `sortOrder` query parameters.\n\nThe `sortBy` parameter specifies the attribute whose value will be used to order the returned responses. The `sortOrder` parameter defines the order in which the `sortBy` parameter is applied. Allowed values are \"ascending\" and \"descending\".\n\n**Filtering:**\n\nYou can request a subset of resources by specifying the `filter` query parameter containing a filter expression. Attribute names and attribute operators used in filters are case insensitive. The filter parameter must contain at least one valid expression. Each expression must contain an attribute name followed by an attribute operator and an optional value.\n\nSupported operators are listed below.\n\n- `eq` equal\n- `ne` not equal\n- `co` contains\n- `sw` starts with\n- `and` Logical \"and\"\n- `or` Logical \"or\"\n- `not` \"Not\" function\n- `()` Precedence grouping\n",
"id": "getV2Scim20Users",
"line": 2385,
"line": 2387,
"method": "GET",
"parameters": [
{
@@ -14079,7 +14079,7 @@
"deprecated": null,
"description": "Creates a user. If the user already exists by email, they are assigned to the organization on the \"company\" team.\n",
"id": "postV2Scim20Users",
"line": 2465,
"line": 2467,
"method": "POST",
"parameters": [],
"path": "/v2/scim/2.0/Users",
@@ -14557,7 +14557,7 @@
"deprecated": null,
"description": "Returns a user by ID.\n",
"id": "getV2Scim20UsersById",
"line": 2495,
"line": 2497,
"method": "GET",
"parameters": [
{
@@ -14912,7 +14912,7 @@
"deprecated": null,
"description": "Updates a user. This route is used to change the user's name, activate, and deactivate the user.\n",
"id": "putV2Scim20UsersById",
"line": 2517,
"line": 2519,
"method": "PUT",
"parameters": [
{
@@ -15415,7 +15415,7 @@
"deprecated": null,
"description": "When a user has two-factor authentication (2FA) enabled, this is the second call to perform after `/v2/users/login` call.\n\nCreates and returns a bearer token in JWT format that you can use to authenticate with Docker Hub APIs.\n\nThe returned token is used in the HTTP Authorization header like `Authorization: Bearer {TOKEN}`.\n\nMost Docker Hub APIs require this token either to consume or to get detailed information. For example, to list images in a private repository.\n",
"id": "PostUsers2FALogin",
"line": 216,
"line": 218,
"method": "POST",
"parameters": [],
"path": "/v2/users/2fa-login",
@@ -15585,7 +15585,7 @@
"deprecated": true,
"description": "Creates and returns a bearer token in JWT format that you can use to authenticate with Docker Hub APIs.\n\nThe returned token is used in the HTTP Authorization header like `Authorization: Bearer {TOKEN}`.\n\n_**As of September 16, 2024, this route requires a personal access token (PAT) instead of a password if your organization has SSO enforced.**_\n\n\n Deprecated: Use [Create access token](#tag/authentication-api/operation/AuthCreateAccessToken) instead.\n\n",
"id": "PostUsersLogin",
"line": 178,
"line": 180,
"method": "POST",
"parameters": [],
"path": "/v2/users/login",
@@ -16333,7 +16333,7 @@
"type": "string"
},
"scopes": {
"description": "Valid scopes: \"repo:admin\", \"repo:write\", \"repo:read\", \"repo:public_read\"\n",
"description": "Valid scopes: \"repo:admin\", \"repo:write\", \"repo:read\", \"repo:public_read\", \"sandbox:use\". Include one repository scope, \"sandbox:use\", or both.\n",
"example": [
"repo:read"
],
@@ -18896,7 +18896,7 @@
"summary": "Authentication"
},
{
"description": "The Personal Access Token endpoints lets you manage personal access tokens. For more information, see [Access Tokens](https://docs.docker.com/security/access-tokens/personal-access-tokens/).\n\nYou can use a personal access token instead of a password in the [Docker CLI](https://docs.docker.com/reference/cli/docker/) or in the [Create an authentication token](#operation/PostUsersLogin) route to obtain a bearer token.\n\n### Scopes\n\nFor each scope grouping (in this case \"repo\"), you only need to define 1 scope as any lower scopes are assumed.\nFor example: If you define `repo:write`, the API assumes the scope of both `repo:read` *and* `repo:public_read` as well.\nIf you were to define both `repo:write` *and* `repo:read`, then `repo:read` is assumed by `repo:write` and ignored.\n\n***Treat your personal access token like your password and keep it secret. You cannot retrieve your token after it is generated.***\n",
"description": "The Personal Access Token endpoints lets you manage personal access tokens. For more information, see [Access Tokens](https://docs.docker.com/security/access-tokens/personal-access-tokens/).\n\nYou can use a personal access token instead of a password in the [Docker CLI](https://docs.docker.com/reference/cli/docker/) or in the [Create an authentication token](#operation/PostUsersLogin) route to obtain a bearer token.\n\n### Scopes\n\nFor each scope grouping (in this case \"repo\"), you only need to define 1 scope as any lower scopes are assumed.\nFor example: If you define `repo:write`, the API assumes the scope of both `repo:read` *and* `repo:public_read` as well.\nIf you were to define both `repo:write` *and* `repo:read`, then `repo:read` is assumed by `repo:write` and ignored.\n\n`sandbox:use` is a separate grouping for Cloud Sandboxes. A repository scope does not include it, and it does not include a repository scope. A request can include `sandbox:use` on its own or with one repository scope.\n\n***Treat your personal access token like your password and keep it secret. You cannot retrieve your token after it is generated.***\n",
"kind": "nav",
"name": "access-tokens",
"summary": "Personal Access Tokens"