The workspace's GitHub Packages bot token and allowlist (members)
What sessions may fetch from GitHub Packages (npm and RubyGems) through the egress proxy. token says whether a bot token is registered, with its last four characters, the GitHub login it belongs to and its expiry (expires_at null when it never expires), never the value. allowlist lists each owner's package, or every package of an owner (name *), that sessions may read; an entry with repository_id or agent_id applies only to sessions of that repository or agent. Without a token, or for a package no entry names, the proxy refuses the request. revision is 0 until the allowlist is first saved. Any member signed in to the console reads it; API keys are refused.
Auth: cookie session only; no scope.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
id*stringThe workspace's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidThe token's summary and the allowlist.
application/json- response
token*allowlist*array<>items <= 200revision*integer0 <= value <= 9007199254740991curl -X GET 'https://example.com/v1/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/github-packages'{ "token": { "configured": true, "last4": "x9Qa", "login": "acme-packages-bot", "expires_at": "2027-01-30T00:00:00.000Z", "updated_at": "2026-11-01T09:00:00.000Z", "updated_by": { "user_id": "3e7f1a90-5c2d-4b8e-8f61-2a9d0c4b7e35", "display_name": "Mina" } }, "allowlist": [ { "registry": "npm", "owner": "acme", "name": "*", "repository_id": null, "agent_id": null } ], "revision": 1}