> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Registry permissions

> Grant container pull, push, and administration separately.

Registry resources are account- and region-scoped. Repository CRNs use
`crn:registry:sa-saopaulo-1:my-account:repository/team/api`.
Pull-through rule CRNs use the `pull-through-cache-rule` resource type.

## Container client permissions

Obtaining a login credential requires `registry:GetAuthorizationToken`. Pulling
also requires `registry:ListImages`, `registry:BatchGetImage`, and
`registry:GetDownloadUrlForLayer` on the repository. A login credential alone
does not grant image access.

Pushing adds `registry:InitiateLayerUpload`, `registry:UploadLayerPart`,
`registry:CompleteLayerUpload`, and `registry:PutImage`. Importing an upstream
image on a cache miss additionally requires `registry:BatchImportUpstreamImage`.
Resource policies can grant repository access to other principals; explicit
denies still apply. Keep administration permissions separate from build and
runtime identities.

## Control-plane actions

| Action | API calls |
| - | - |
| `registry:BatchDeleteImage` | `POST /v1/repositories/{repository_id}/images/batch-delete` |
| `registry:BatchGetImage` | `GET /v1/repositories/{repository_id}/images/{image_reference}` |
| `registry:CreatePullThroughCacheRule` | `POST /v1/pull-through-cache-rules` |
| `registry:CreateRepository` | `POST /v1/repositories` |
| `registry:DeleteLifecyclePolicy` | `DELETE /v1/repositories/{repository_id}/lifecycle-policy` |
| `registry:DeletePullThroughCacheRule` | `DELETE /v1/pull-through-cache-rules/{prefix}` |
| `registry:DeleteRepository` | `DELETE /v1/repositories/{repository_id}` |
| `registry:DeleteRepositoryPolicy` | `DELETE /v1/repositories/{repository_id}/policy` |
| `registry:DescribeImages` | `GET /v1/repositories/{repository_id}/images` |
| `registry:DescribePullThroughCacheRules` | `GET /v1/pull-through-cache-rules`<br />`GET /v1/pull-through-cache-rules/{prefix}` |
| `registry:DescribeRepositories` | `GET /v1/repositories`<br />`GET /v1/repositories/{repository_id}` |
| `registry:GetAuthorizationToken` | `POST /v1/authorization-token` |
| `registry:GetEncryptionConfiguration` | `GET /v1/encryption-configuration/retained-data`<br />`GET /v1/encryption-configuration` |
| `registry:GetLifecyclePolicy` | `GET /v1/repositories/{repository_id}/lifecycle-policy` |
| `registry:GetRepositoryPolicy` | `GET /v1/repositories/{repository_id}/policy` |
| `registry:ListImages` | `GET /v1/repositories/{repository_id}/tags` |
| `registry:PutEncryptionConfiguration` | `DELETE /v1/encryption-configuration`<br />`PUT /v1/encryption-configuration` |
| `registry:PutLifecyclePolicy` | `PUT /v1/repositories/{repository_id}/lifecycle-policy` |
| `registry:SetRepositoryPolicy` | `PUT /v1/repositories/{repository_id}/policy` |
| `registry:StartLifecyclePolicyPreview` | `POST /v1/repositories/{repository_id}/lifecycle-policy/preview` |
| `registry:UpdatePullThroughCacheRule` | `PATCH /v1/pull-through-cache-rules/{prefix}` |
| `registry:UpdateRepository` | `PATCH /v1/repositories/{repository_id}` |

## Example: pull one repository

This identity policy grants a login credential and access to one repository:

```json theme={null}
{
  "version": "2024-01-01",
  "statements": [
    {"effect":"allow","actions":["registry:GetAuthorizationToken"],"resources":["*"]},
    {"effect":"allow","actions":["registry:ListImages","registry:BatchGetImage","registry:GetDownloadUrlForLayer"],"resources":["crn:registry:sa-saopaulo-1:my-account:repository/team/api"]}
  ]
}
```

Add repository creation, mutation, deletion, resource-policy management, or
lifecycle administration only when that identity needs them. Changing account
registry encryption uses its own `registry:PutEncryptionConfiguration` action.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.