Allocate a registry package name

POST/api/owners/{handle}/packages

createPackage

Creates `{handle}/{name}` as a pullable/pushable registry name. Authorized as `workspace:package:create` on the owning workspace and nothing else — a repo collaborator with no workspace membership cannot take a name. The optional `repo` link widens access to holders of `repo:registry:*` on that repo and must live in the same workspace.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/owners/HANDLE/packages' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name":"server"}'

fetch

fetch("https://neosource.dev/api/owners/HANDLE/packages", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"server"}),
});

Path parameters

handlerequired: Handle of the owner — either a user account or an organization.
string

Request bodyrequired

application/json

CreatePackageRequest

object

Allocate a package name in the owner's workspace. Authorized as `workspace:package:create` on the OWNING workspace and nothing else — a repo collaborator with no workspace membership must not be able to take a name (ADR 0097 §4).

namerequired: string
example"server"
repo: string | null
Optional repo to link, named by its slug in the SAME workspace. The link widens access to holders of `repo:registry:*` on that repo; it is never the authorization anchor, and it is rejected outright when the repo lives in another workspace.
example"neosource"
visibility: one of
null
RepoVisibilityInput
string
"public""internal""private"

additional propertiesnot allowed

Responses

201Package created

application/json

PackageResponse

object

One registry package. `visibility` is the package's OWN visibility, never the linked repo's: anonymous pull is gated on this field alone (ADR 0097 §4), and a private repo may hold a public package or the reverse.

created_atrequired: integerint64
namerequired: string
The `{package}` path component. Obeys the OCI `path-component` grammar, which is narrower than a repo slug.
ownerrequired: string
Owner handle the package is served under — the `{owner}` in `/v2/{owner}/{package}`.
package_idrequired: string
repo_id: string | null
The optional repo link. `null` for an unlinked package.
updated_atrequired: integerint64
visibilityrequired: RepoVisibilityInput
string
"public""internal""private"
workspace_idrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget