ReferenceHTTP APIWorkspace settings

Register or replace the GitHub Packages bot token (owner or admin)

PUT
/v1/workspaces/{id}/github-packages/token

Stores a bot account's classic personal access token whose only scope is read:packages; GitHub Packages accepts no GitHub App token. Before storing, the API calls GitHub's GET /user with it: a token GitHub refuses is 400 BAD_REQUEST (reason_code token_invalid), and one with any other scope, or a fine-grained token, which has no classic scopes, is 400 (reason_code token_scopes). The login and expiry GitHub reports are kept beside it. The token is kept encrypted and never returned, logged or echoed; only the egress proxy's requests to GitHub Packages carry it. Setting it again replaces it. Writes a set_github_packages_token receipt with its last four characters. API keys are refused.

Auth: cookie session only; no scope. Idempotency-Key: ignored.

Authorization

cookieSession
cookie__Host-werft_session<token>

For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.

Path Parameters

id*string

The workspace's id.

Match^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
Formatuuid

Header Parameters

X-Requested-With?"werft-web"

Required with a cookie session: the literal werft-web.

Value in"werft-web"

Request Body

application/json
  1. body
token*string
Match^[\x21-\x7e]+$
Length8 <= length <= 255

Response Body

Stored; the receipt and the settings.

application/json
  1. response
token*
allowlist*array<>
Itemsitems <= 200
revision*integer
Range0 <= value <= 9007199254740991
receipt_id*string
Match^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
Formatuuid
Example Request
curl -X PUT 'https://example.com/v1/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/github-packages/token' \  -H 'Content-Type: application/json' \  -d '{  "token": "ghp_EXAMPLE"}'
Example Response
{  "receipt_id": "c4a1e9d2-7b3f-4e8a-a6c5-1d2e3f4a5b6c",  "token": {    "configured": true,    "last4": "MPLE",    "login": "acme-packages-bot",    "expires_at": "2027-01-30T00:00:00.000Z",    "updated_at": "2026-11-01T09:00:00.000Z",    "updated_by": {      "user_id": "3e7f1a90-5c2d-4b8e-8f61-2a9d0c4b7e35",      "display_name": "Mina"    }  },  "allowlist": [],  "revision": 0}