Add collaborators to a package using API

[szandala]

Select Topic Area

Question

Body

Greetings,
I would like to use API to add collaborators for a package.
Something that is configured in GUI:
https://github.com/orgs/<ORG>/packages/container/<PACKAGE_NAME>/settings
I have over 800 packages for which I have to update collaborators (add new team). How to do it using cURL?

[leonardorifeli]

Hello @szandala

To add collaborators to a package on GitHub using the API and cURL, you can use the GitHub REST API to manage container packages.

1. Obtain a Personal Access Token (PAT)

You need a Personal Access Token (PAT) with the appropriate scope. The required scopes for managing packages are:

• write:packages
• read:packages
• admin:org

You can generate this token in GitHub Settings → Tokens.

2. Adding a Collaborator to a Package using cURL

The endpoint to grant a team permission to a package is:

PUT /orgs/{org}/packages/container/{package_name}/permissions/team/{team_slug}

The cURL command to add a team as a collaborator to a package would be:

curl -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer YOUR_GITHUB_TOKEN" \
  https://api.github.com/orgs/YOUR_ORG/packages/container/YOUR_PACKAGE_NAME/permissions/team/YOUR_TEAM \
  -d '{"permission": "write"}'

3. Explanation of Parameters

• YOUR_GITHUB_TOKEN: Replace with your access token.
• YOUR_ORG: Your GitHub organization name.
• YOUR_PACKAGE_NAME: The package name you want to update.
• YOUR_TEAM: The slug of the team you want to add to the package.
• {"permission": "write"}: Defines the permission level for the team (can be read, write, or admin).

4. Multiple Packages

Since you have 800 packages, you can use a Bash script to iterate over a list of packages and add permissions to each one:

#!/bin/bash

GITHUB_TOKEN="YOUR_GITHUB_TOKEN"
ORG="YOUR_ORG"
TEAM="YOUR_TEAM"

# List of packages (can be retrieved via API or manually)
PACKAGES=("package1" "package2" "package3") # Replace with your list

for PACKAGE in "${PACKAGES[@]}"; do
  echo "Updating permissions for package: $PACKAGE"
  curl -X PUT \
    -H "Accept: application/vnd.github+json" \
    -H "Authorization: Bearer $GITHUB_TOKEN" \
    "https://api.github.com/orgs/$ORG/packages/container/$PACKAGE/permissions/team/$TEAM" \
    -d '{"permission": "write"}'
  echo "Done"
done

5. How to Retrieve the List of Packages

If you need to retrieve the list of packages from your organization automatically, you can use:

curl -H "Authorization: Bearer YOUR_GITHUB_TOKEN" \
     -H "Accept: application/vnd.github+json" \
     "https://api.github.com/orgs/YOUR_ORG/packages?package_type=container" | jq -r '.[].name'

This will list all container packages in your organization.

I hope I helped!

[szandala]

Are you 100% sure this endpoint exists? I have "God mode" token. and yet I receive 404

I cannot see it in the docs: https://docs.github.com/en/rest/teams?apiVersion=2022-11-28

[szandala]

@leonardorifeli I think yor answer is wrong

[szandala]

Confirmed with support - it is not possible as of 6.03.2025.
And your answer is generated by ChatGPT :p