Skip to main content
POST
Create a pull-through cache rule
Requires the IAM action registry:CreatePullThroughCacheRule. See REGISTRY permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Body

application/json
prefix
string
required

One or two lowercase repository-name components. It becomes the leading path of every repository the rule creates, so it has to be a name a client can pull.

Example:

"hub"

upstream_registry
string
required

A hostname with an optional port. https:// is accepted and stripped; anything else is refused, because the connection can carry a credential.

Example:

"docker.io"

upstream_prefix
string

Optional path prepended upstream.

Example:

"library"

upstream_username
string

Optional. Worth setting even against a public registry: an authenticated Docker Hub pull draws on a far larger rate-limit budget than an anonymous one.

upstream_secret
string<password>

The password or token. Write-only — sealed at rest and never returned. Required with upstream_username, and refused without it: a half-specified credential produces an anonymous pull that silently draws on the small budget.

Response

Rule created. Nothing has been fetched.

pull_through_cache_rule
object
required