Docs
Search docs

List registry packages owned by the given handle

GET/api/owners/{handle}/packages

listOwnerPackages

Packages are workspace-owned (ADR 0097), so this is the only surface an *unlinked* package appears on — one with no repo link has no repo page. Each package is filtered through the same authorization the pull path uses, so this list can never show a name its caller would be refused at `/v2/`.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/owners/HANDLE/packages'

fetch

fetch("https://neosource.dev/api/owners/HANDLE/packages", {
  method: "GET",
});

Path parameters

handlerequired

Handle of the owner — either a user account or an organization.

string

Responses

200Package list

application/json

PackageListResponse

object

packagesrequired

array

items

PackageResponse

object

One registry package. `visibility` is the package's OWN visibility, never the linked repo's: anonymous pull is gated on this field alone (ADR 0097 §4), and a private repo may hold a public package or the reverse.

created_atrequired

integerint64

namerequired

string

The `{package}` path component. Obeys the OCI `path-component` grammar, which is narrower than a repo slug.

ownerrequired

string

Owner handle the package is served under — the `{owner}` in `/v2/{owner}/{package}`.

package_idrequired

string

pull_refrequired

string

What `docker pull` takes, without a tag: `{registry_host}/{owner}/{name}`, where the host is the registry's ADVERTISED hostname (`neocr.io` in production, ADR 0097 §1) — the forge's own host only where no separate registry host is configured.

example"neocr.io/neosource/server"

repo_id

string | null

The optional repo link. `null` for an unlinked package, and on the read routes also when the caller cannot read the linked repo (a public package may link a private one).

updated_atrequired

integerint64

visibilityrequired
RepoVisibilityInput
workspace_idrequired

string

403Forbidden — one of: forbidden, needs_scope

application/json

one of
  • ErrorForbidden

  • NeedsScopeError

    object

    `403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.

    errorrequired

    string

    Always `needs_scope` — this body exists to carry the extra fields that kind needs.

    "needs_scope"

    scoperequired

    string

    The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

  • 400Bad Request — one of: invalid_input
  • 404Not Found — one of: not_found
  • 429Rate limited — retry after the `Retry-After` header
  • 500Internal server error
  • 503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
  • 504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

RepoVisibilityInput

string

"public""internal""private"