# Harbor Registry Extractor (`datamule/harbor-registry-extractor`) Actor Point at any self-hosted Harbor container registry and extract its public projects, repositories, image artifacts (with vulnerability-scan severity) and instance fingerprint via the open /api/v2.0 REST API. One actor, any Harbor — no per-host scraper. - **URL**: https://apify.com/datamule/harbor-registry-extractor.md - **Developed by:** [Datamule](https://apify.com/datamule) (community) - **Categories:** Developer tools, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.35 / 1,000 records This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Harbor Registry Extractor A GENERIC **"point at any Harbor container registry"** Apify actor — the supply-chain / SBOM sibling of the netdata / grafana / gatus / uptime-kuma self-hosted-infra runners, over the container-registry population. **Harbor** (`goharbor/harbor`, a CNCF *graduated* project) is THE on-prem DockerHub / Quay alternative — it runs on Kubernetes clusters across enterprise, research and government. Public projects are anonymous-browsable by design and `/systeminfo` + `/health` are unauthenticated on every install — so ONE actor spans every reachable instance, no per-host scraper and no host enumeration. ### Input | Field | Mode | Meaning | |-------|------|---------| | `sources` (**required**) | all | One or more Harbor base URLs — `https://registry.cern.ch`, `https://demo.goharbor.io`, or any self-hosted install. The `/api/v2.0/...` path is appended for you. | | `mode` | — | `projects` (default), `repositories`, `artifacts`, or `discovery`. | | `project` | repositories, artifacts | The Harbor project name to drill into (e.g. `acc`). **Required** for those two modes. | | `repository` | artifacts | A single repo name relative to the project. Empty = walk every repo in the project. | | `q` | projects, repositories | Harbor-native fuzzy filter (`?q=`), e.g. `name=~acc`. | | `name` | projects | Exact project-name filter (`?name=`). | | `page` / `pageSize` | all | Harbor-native paging (1-based page; page size 1–100). | | `maxRecords` | all | Global cap across every source (one row = one billable event). | | `bearer` | all | Optional bearer token / robot account for a private instance (`Authorization: Bearer ***`). Never logged. | | `extraHeaders` | all | Optional extra request headers (JSON). | ### Modes * **projects** (default) — paginated `/api/v2.0/projects` → one flat row per public project: `projectId`, `name`, `ownerName`, `repoCount`, `public`, `autoScan`, `severity`, `creationTime`, `updateTime`, plus a lossless `_raw`. An instance that gates the project list (private-only) but leaves `/systeminfo` open falls back to a single **discovery** fingerprint row instead of nothing. * **repositories** — `/projects/{project}/repositories` → one row per repo: `name`, `artifactCount`, `pullCount`, `creationTime`, `updateTime`. * **artifacts** — `/projects/{project}/repositories/{repo}/artifacts` → one row per image: `digest`, `tags[]`, `size`, `pushTime`, `pullTime`, `architecture`/`os`, and the vulnerability-scan rollup (`scanSeverity`, `scanTotal`, `scanFixable`). Give a `repository` to walk one repo, or omit it to walk every repo in the project (bounded by `maxRecords`). * **discovery** — `/systeminfo` + `/health` (+ `/api/version`) → one fingerprint row per instance: `_harborVersion`, `apiVersion`, `authMode`, `selfRegistration`, `oidcProviderName`, `health`, `componentCount`, `unhealthyComponents`. A cheap way to fingerprint many instances at once. ### Behaviour * **The parse is the moat.** Harbor's project / repo / artifact shapes drift across v2.0 → v2.11 and installs populate different optional fields — `harbor_version` is documented but is **not** returned anonymously on many installs (CERN and the vendor demo both omit it); `auto_sbom_generation` appears on newer installs only. So every field is read by **key presence** (`dict.get`) and Harbor's nested `metadata` string-bools (`"public": "true"`) are coerced to real booleans. A row missing an optional field yields `null`, never a crash. Every original object is preserved verbatim in `_raw`. * Many instances leave `/systeminfo` + `/health` open but gate the project list to logged-in users. In **projects** mode such a source still yields a **discovery** fallback row rather than being dropped. * A source that is auth-gated on everything, unreachable / DNS-failed, timing out, or returns a non-Harbor body is a clean **skip-with-warning**, and the batch continues. A run where **every** source was skipped **fails fast** (exit 91) so nothing broken ships. A single valid instance with 0 public projects yields 0 records and a clean exit 0. * Private instances are supported via an optional `bearer` token / robot account — never required for anonymous instances, never logged. ### Output One flat, fully-nullable row per record (project / repository / artifact / instance), plus a lossless `_raw` with the original object. Example (projects mode, `registry.cern.ch`): ```json { "_type": "project", "_source": "https://registry.cern.ch", "_mode": "projects", "_software": "harbor", "projectId": 1009, "name": "acc", "ownerName": "kbenothm", "repoCount": 987, "public": true, "autoScan": true, "severity": "critical", "creationTime": "2021-05-18T14:04:05.724Z", "updateTime": "2021-05-18T14:04:05.724Z" } ```` ### Pricing Pay-per-event: one `record` charge per emitted row. ### Example input ```json { "sources": ["https://registry.cern.ch"], "mode": "projects", "maxRecords": 100 } ``` # Actor input Schema ## `sources` (type: `array`): One or more Harbor container-registry base URLs. Harbor exposes an /api/v2.0 REST API; public projects are anonymous-browsable by design and /systeminfo + /health are unauthenticated on every install, so ONE actor works against any instance: https://registry.cern.ch (CERN's public registry), https://demo.goharbor.io (the vendor demo), or any self-hosted install on your Kubernetes clusters. Paste the server root as given (the /api/v2.0/... path is appended for you). When several are listed, each is queried in turn and a source that is unreachable, behind an anti-bot wall, or fully auth-gated is skipped with a warning. ## `mode` (type: `string`): What to extract. projects (default): the public-project census from /api/v2.0/projects — one row per project (owner, repo count, public flag, auto-scan, severity, timestamps). repositories: the repos inside one Project — one row per repo (artifact count, pull count, timestamps). artifacts: the images inside a Project (and optionally one Repository) — one row per artifact (digest, tags, size, push time, vulnerability scan severity + counts). discovery: one fingerprint row per instance from /systeminfo + /health (Harbor version, auth mode, self-registration, component health). ## `project` (type: `string`): REQUIRED for repositories and artifacts modes: the Harbor project name to drill into (e.g. "acc" on registry.cern.ch). Ignored in projects and discovery modes. ## `repository` (type: `string`): ARTIFACTS MODE only. A single repository name RELATIVE to the project (the part after "project/"), e.g. "gcr.io/knative-releases/.../webhook". Leave empty to walk EVERY repository in the project (bounded by Max records). ## `q` (type: `string`): Optional Harbor-native fuzzy filter passed as ?q= — e.g. "name=~acc" to match project/repo names containing "acc". Leave empty to list everything. See Harbor's API docs for the q syntax. ## `name` (type: `string`): PROJECTS MODE only. Restrict to projects whose name exactly matches (passed as ?name=). Leave empty for no name filter. ## `page` (type: `integer`): The Harbor page number to start from (1-based). Pagination then continues via Harbor's Link: rel=next header until the cap or the last page. Leave at 1 to start from the beginning. ## `pageSize` (type: `integer`): Rows requested per Harbor API page (1-100; Harbor caps these collections at 100). This is a fetch-batch tuning knob, not a total cap — use Max records for that. Leave empty for 100. ## `maxRecords` (type: `integer`): A GLOBAL cap on the number of rows to emit across ALL sources (each row is one project/repo/artifact/instance and one billable event). Pagination — and, in artifacts mode, the per-repo fan-out — stops as soon as the cap is reached, so a small value is a cheap, deterministic sample. Leave empty to fetch every matching record — a broad artifacts run on a large registry can return very many rows. ## `bearer` (type: `string`): Optional Harbor bearer token or robot-account credential for reading a private instance (sent as Authorization: Bearer \*\*\*). NOT required for anonymous/public projects. Never logged. ## `extraHeaders` (type: `object`): Optional extra HTTP headers as a JSON object, e.g. {"X-Harbor-CSRF-Token": "..."} for a gateway-fronted instance. Not required for the public servers. Header values are never logged. ## Actor input object example ```json { "sources": [ "https://registry.cern.ch" ], "mode": "projects", "page": 1, "pageSize": 100, "maxRecords": 100 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "sources": [ "https://registry.cern.ch" ], "maxRecords": 100 }; // Run the Actor and wait for it to finish const run = await client.actor("datamule/harbor-registry-extractor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "sources": ["https://registry.cern.ch"], "maxRecords": 100, } # Run the Actor and wait for it to finish run = client.actor("datamule/harbor-registry-extractor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "sources": [ "https://registry.cern.ch" ], "maxRecords": 100 }' | apify call datamule/harbor-registry-extractor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=datamule/harbor-registry-extractor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Harbor Registry Extractor", "description": "Point at any self-hosted Harbor container registry and extract its public projects, repositories, image artifacts (with vulnerability-scan severity) and instance fingerprint via the open /api/v2.0 REST API. One actor, any Harbor — no per-host scraper.", "version": "0.1", "x-build-id": "Q6PS2goKb2v4ksflU" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/datamule~harbor-registry-extractor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-datamule-harbor-registry-extractor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/datamule~harbor-registry-extractor/runs": { "post": { "operationId": "runs-sync-datamule-harbor-registry-extractor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/datamule~harbor-registry-extractor/run-sync": { "post": { "operationId": "run-sync-datamule-harbor-registry-extractor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "sources" ], "properties": { "sources": { "title": "Harbor instance URL(s)", "type": "array", "description": "One or more Harbor container-registry base URLs. Harbor exposes an /api/v2.0 REST API; public projects are anonymous-browsable by design and /systeminfo + /health are unauthenticated on every install, so ONE actor works against any instance: https://registry.cern.ch (CERN's public registry), https://demo.goharbor.io (the vendor demo), or any self-hosted install on your Kubernetes clusters. Paste the server root as given (the /api/v2.0/... path is appended for you). When several are listed, each is queried in turn and a source that is unreachable, behind an anti-bot wall, or fully auth-gated is skipped with a warning.", "items": { "type": "string" } }, "mode": { "title": "Mode", "enum": [ "projects", "repositories", "artifacts", "discovery" ], "type": "string", "description": "What to extract. projects (default): the public-project census from /api/v2.0/projects — one row per project (owner, repo count, public flag, auto-scan, severity, timestamps). repositories: the repos inside one Project — one row per repo (artifact count, pull count, timestamps). artifacts: the images inside a Project (and optionally one Repository) — one row per artifact (digest, tags, size, push time, vulnerability scan severity + counts). discovery: one fingerprint row per instance from /systeminfo + /health (Harbor version, auth mode, self-registration, component health).", "default": "projects" }, "project": { "title": "Project (repositories / artifacts mode)", "type": "string", "description": "REQUIRED for repositories and artifacts modes: the Harbor project name to drill into (e.g. \"acc\" on registry.cern.ch). Ignored in projects and discovery modes." }, "repository": { "title": "Repository (artifacts mode, optional)", "type": "string", "description": "ARTIFACTS MODE only. A single repository name RELATIVE to the project (the part after \"project/\"), e.g. \"gcr.io/knative-releases/.../webhook\". Leave empty to walk EVERY repository in the project (bounded by Max records)." }, "q": { "title": "Query filter (projects / repositories mode)", "type": "string", "description": "Optional Harbor-native fuzzy filter passed as ?q= — e.g. \"name=~acc\" to match project/repo names containing \"acc\". Leave empty to list everything. See Harbor's API docs for the q syntax." }, "name": { "title": "Exact project name (projects mode)", "type": "string", "description": "PROJECTS MODE only. Restrict to projects whose name exactly matches (passed as ?name=). Leave empty for no name filter." }, "page": { "title": "Start page", "minimum": 1, "type": "integer", "description": "The Harbor page number to start from (1-based). Pagination then continues via Harbor's Link: rel=next header until the cap or the last page. Leave at 1 to start from the beginning.", "default": 1 }, "pageSize": { "title": "Page size", "minimum": 1, "maximum": 100, "type": "integer", "description": "Rows requested per Harbor API page (1-100; Harbor caps these collections at 100). This is a fetch-batch tuning knob, not a total cap — use Max records for that. Leave empty for 100.", "default": 100 }, "maxRecords": { "title": "Max records (global cap)", "minimum": 1, "type": "integer", "description": "A GLOBAL cap on the number of rows to emit across ALL sources (each row is one project/repo/artifact/instance and one billable event). Pagination — and, in artifacts mode, the per-repo fan-out — stops as soon as the cap is reached, so a small value is a cheap, deterministic sample. Leave empty to fetch every matching record — a broad artifacts run on a large registry can return very many rows." }, "bearer": { "title": "Bearer token / robot account", "type": "string", "description": "Optional Harbor bearer token or robot-account credential for reading a private instance (sent as Authorization: Bearer ***). NOT required for anonymous/public projects. Never logged." }, "extraHeaders": { "title": "Extra request headers", "type": "object", "description": "Optional extra HTTP headers as a JSON object, e.g. {\"X-Harbor-CSRF-Token\": \"...\"} for a gateway-fronted instance. Not required for the public servers. Header values are never logged." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```