Skip to main content
GET
Describe an image
Requires the IAM action registry:BatchGetImage. See REGISTRY permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

repository_id
string<uuid>
required
Example:

"a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"

image_reference
string
required

A tag or a sha256: digest.

Example:

"v1.4.2"

Response

The image and its manifest.

image
object
required
manifest
object

The manifest document, parsed. NOT suitable for verifying the digest — that covers the exact bytes pushed, and a round-trip through a JSON encoder reorders keys. Fetch from /v2 to re-hash.