List registry packages owned by the given handle

GET/api/owners/{handle}/packages

listOwnerPackages

Packages are workspace-owned (ADR 0097), so this is the only surface an *unlinked* package appears on — one with no repo link has no repo page. Each package is filtered through the same authorization the pull path uses, so this list can never show a name its caller would be refused at `/v2/`.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/owners/HANDLE/packages'

fetch

fetch("https://neosource.dev/api/owners/HANDLE/packages", {
  method: "GET",
});

Path parameters

handlerequired: Handle of the owner — either a user account or an organization.
string

Responses

200Package list

application/json

PackageListResponse

object

packagesrequired

array

items

PackageResponse

object

One registry package. `visibility` is the package's OWN visibility, never the linked repo's: anonymous pull is gated on this field alone (ADR 0097 §4), and a private repo may hold a public package or the reverse.

created_atrequired: integerint64
namerequired: string
The `{package}` path component. Obeys the OCI `path-component` grammar, which is narrower than a repo slug.
ownerrequired: string
Owner handle the package is served under — the `{owner}` in `/v2/{owner}/{package}`.
package_idrequired: string
repo_id: string | null
The optional repo link. `null` for an unlinked package.
updated_atrequired: integerint64
visibilityrequired: RepoVisibilityInput
workspace_idrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
404Not Found — one of: not_found
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`RepoVisibilityInput`

string

"public""internal""private"