# Link a package to a repository

> Link a package to a repository of its workspace (repository: its name or owner/name): it then has that repository's visibility and, unless inherit_access is off, its roles, and the repository's workflows may publish it.

<div class="g1t-endpoint"><span class="g1t-method" data-method="put">PUT</span><code>/workspaces/{workspace}/packages/{package_type}/{package_name}/repository</code></div>

Takes the Admin role on the package and on the repository. Returns the package.

The package takes the repository's visibility. You need the Admin role on the package and on the repository.

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`package`](/reference/mcp/#package) with `action` `link`, and the same inputs
- **Scope:** An access token needs [`packages:write`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace` | string | Yes | The workspace's slug, e.g. "flagon-io". |
| `package_type` | string | Yes | The registry: container (also docker), npm, cargo, maven, nuget, rubygems or composer. One of `container`, `npm`, `cargo`, `maven`, `nuget`, `rubygems`, `composer`. |
| `package_name` | string | Yes | The package's name without the workspace: web for g1t.sh/acme/web, web/worker for an image with more parts, group:artifact for Maven. |

## Body parameters

Send a JSON object. Names are `snake_case`, as in responses; the `camelCase` spelling is accepted too.

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `repository` | string | Yes | A repository of the package's workspace: its name, or owner/name. |

## Example request

```sh
curl -X PUT https://api.g1t.sh/workspaces/acme/packages/container/tools/repository \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "repository": "acme/infra"
  }'
```

## Example response

A successful request answers `200` with:

```json
{
  "id": "pkg_01kq7b6g8j0m2p4r6t8v0x2z4b",
  "name": "tools",
  "package_type": "container",
  "workspace": "acme",
  "address": "g1t.sh/acme/tools",
  "visibility": "private",
  "repository": {
    "id": "rep_01kpw0c4e6g8j0m2p4r6t8v0x2",
    "name": "infra",
    "full_name": "acme/infra"
  },
  "description": null,
  "version_count": 2,
  "latest": "latest",
  "size_in_bytes": 7340032,
  "download_count": 88,
  "inherit_access": true,
  "created_at": "2026-09-20T12:00:00.000Z",
  "updated_at": "2026-10-08T15:20:00.000Z",
  "deleted_at": null,
  "deleted_by": null,
  "purge_at": null,
  "html_url": "https://g1t.sh/acme/-/packages/container/tools"
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 409 | `conflict` | The request conflicts with the current state. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |