Skip to content
ChekChek Docs

Change a repository's credentials

PATCH
/api/v1/extension-repositories/{repositoryId}
curl --request PATCH \
  --url http://localhost:8080/api/v1/extension-repositories/1 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "credentials": { "type": "bearer", "token": "example" } }'

Replaces the repository’s credentials, or removes them with null. The index is fetched with the new credentials first, and credentials that don’t work are refused. Only an admin can change a repository on the allow list.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
repositoryId
required
integer format: int64

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
credentials
required
One of:
One of:
object
type
required
Allowed value: bearer
token
required
string

Responses

Section titled “Responses”

200

Section titled “200”

The repository, with the index fetched with the new credentials.

Media typeapplication/json
object
id
required
integer format: int64
url
required
string format: uri
name
required

What the repository’s index calls it.

string | null
allowListed
required

On the admin’s allow list rather than added by the user.

boolean
usable
required

Whether its extensions can be installed and run. A user’s own repository isn’t while the admin allows only the allow list.

boolean
hasCredentials
required

Whether credentials are stored for it. They’re never returned.

boolean
extensionCount
required
integer
fetchedAt
required

When the index was last fetched successfully.

string | null format: date-time
fetchError
required

Why the last fetch failed, if it did.

string | null
createdAt
required
string format: date-time

Example generated

{
  "id": 1,
  "url": "https://example.com",
  "name": "example",
  "allowListed": true,
  "usable": true,
  "hasCredentials": true,
  "extensionCount": 1,
  "fetchedAt": "2026-04-15T12:00:00Z",
  "fetchError": "example",
  "createdAt": "2026-04-15T12:00:00Z"
}

400

Section titled “400”

The request was malformed.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

401

Section titled “401”

The request has no valid session token.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

403

Section titled “403”

The signed-in user may not do this. demo_account when the user is a shared demo account, named in CHEK_DEMO_USERS, which can’t change its password, sessions, sign-in providers, extensions or annotations.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

404

Section titled “404”

The resource does not exist.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

422

Section titled “422”

The repository answered 401 or 403, or is a host known to refuse another way: a private GitHub repository’s 404, or Cloudflare Access’s redirect to its sign-in page. The code says what to ask for, from the scheme of its WWW-Authenticate header: repository_needs_token (Bearer), repository_needs_password (Basic), or repository_needs_credentials (another scheme or none, as for a host that checks its own headers). repository_credentials_refused means credentials were sent and refused. Not 401, which would mean the client’s own session ended.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

500

Section titled “500”

The server failed; details are in its log.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

502

Section titled “502”

The repository’s index couldn’t be fetched or isn’t valid.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}