# How to make a generator private



## When to use this [#when-to-use-this]

You published a generator to the hub and want to take it out of public
view — it is internal to your organization, or it is not ready. A
generator published to the registry is public until you change it.

## Prerequisites [#prerequisites]

* Write access to the generator: you own the account, you own the org
  that owns it, or you were added as a writer. Org membership on its
  own gives read access only.
* For the API path, a personal access token with the `write:catalog`
  scope, minted under `Settings → Access tokens` on the hub.

## What changes when a generator is private [#what-changes-when-a-generator-is-private]

* The generator leaves search and public listings on the hub.
* The registry stops serving the package to anyone without read
  access. `skmtc install`, `skmtc bundle` and `deno add` fail for
  those people. A bundle that was already built does not fetch from
  the registry, so it keeps running until it is rebuilt.
* People with read access — the account's org members, collaborators,
  and you — see and install it as before.
* The change reaches the registry within about a minute.

Making a private generator public again reverses all of this.

## From the hub [#from-the-hub]

1. Open the generator's **Settings** tab:
   `https://skmtc.dev/ACCOUNT/generators/GENERATOR/settings`. The tab
   shows only if you have write access.
2. In the **Danger zone**, next to **Change generator visibility**,
   select **Change visibility**. The row states the current
   visibility.
3. Read the consequences in the dialog, type the generator's full name
   (`ACCOUNT/GENERATOR`) in the confirmation field, and select
   **I understand, change generator visibility**. Submitting with the
   wrong name shows a message under the field and changes nothing.

The dialog closes and the row reads "This generator is currently
private."

## From the API [#from-the-api]

```bash
curl -X PATCH https://api.skmtc.dev/v1/generators/ACCOUNT/GENERATOR \
  -H "Authorization: Bearer $SKMTC_HUB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"visibility":"private"}'
```

Replace the following:

* `ACCOUNT`: the account that owns the generator.
* `GENERATOR`: the generator's slug.
* `SKMTC_HUB_TOKEN`: a personal access token with `write:catalog`.

The response is the updated generator. Check the two fields that
matter:

```json
{
  "slug": "GENERATOR",
  "visibility": "private",
  "viewer": { "canRead": true, "canWrite": true, "canAdmin": true }
}
```

`viewer` is your own effective access on the generator. To make it
public again, send `{"visibility":"public"}`.

### Errors [#errors]

| Status | Meaning                                                                             |
| ------ | ----------------------------------------------------------------------------------- |
| `401`  | No token, or the token is not valid.                                                |
| `403`  | The token lacks `write:catalog`, or you do not have write access to this generator. |
| `404`  | No generator with that account and slug on the hub, or you cannot read it.          |

## Verification [#verification]

Read the generator without a token:

```bash
curl -s -o /dev/null -w '%{http_code}\n' \
  https://api.skmtc.dev/v1/generators/ACCOUNT/GENERATOR
```

A private generator answers `404`; a public one answers `200`.