Management API

Everything the panel does, it does through this API. It is separate from the registry: the registry speaks OCI Distribution at /v2, this speaks JSON at /api.

text

https://lazer.sh/api

Authentication

Present a user key as a bearer token. The key needs management scopes — registry scopes alone will not authorise these endpoints.

bash

curl https://lazer.sh/api/projects \
  -H "Authorization: Bearer $LAZER_KEY"

Browser sessions authenticate with an httpOnly cookie instead and are subject to a same-origin check. That path is for the panel; use a key for anything scripted.

Scopes

Scope	Grants
`projects:read`	List and read projects and repositories
`projects:write`	Create, update and delete projects, repositories and retention rules
`keys:read`	List keys and their scopes
`keys:write`	Mint and revoke keys

Endpoints

Method and path	Does
`GET /api/me`	The authenticated principal, its plan, and the projects it can reach
`GET /api/projects`	List projects
`POST /api/projects`	Create a project
`GET /api/projects/:project`	Project detail including storage allocation and usage
`PATCH /api/projects/:project`	Change the allocation
`DELETE /api/projects/:project`	Delete a project and everything in it
`GET /api/projects/:project/repositories`	List repositories with sizes and tag counts
`GET /api/projects/:project/repositories/:repo`	Repository detail, tagged and total size
`DELETE /api/projects/:project/repositories/:repo`	Delete a repository
`GET /api/projects/:project/repositories/:repo/tags`	List tags with digests and timestamps
`DELETE /api/projects/:project/repositories/:repo/manifests/:digest`	Unlink a manifest
`GET /api/keys`	List keys
`POST /api/keys`	Mint a key. The secret is in the response and never again
`DELETE /api/keys/:id`	Revoke a key
`GET /api/projects/:project/members`	List members and roles
`POST /api/projects/:project/invitations`	Invite someone to a project

Errors

Errors are JSON with a stable code, and the HTTP status carries the category:

json

{ "code": "plan_project_limit", "message": "plan does not allow another project" }

401 unauthenticated, 403 authenticated but not entitled, 404 absent or not visible to you, 409 conflict, 422 validation, 429 rate limited.

Note that 404 covers both "does not exist" and "exists but is not yours". This is deliberate: a private registry should not let an unauthorised caller confirm that a project name is taken.

Generated clients

The API is defined as a typed contract, so an OpenAPI document and generated clients track the implementation rather than being written by hand. Ask at [email protected] if you want the schema for a language we do not publish yet.