Skip to content

Resource visibility#

Resource visibility controls the default visibility (Public or Private) of repositories, plugins, and policies on a private BSR instance, and whether organizations or individual resource owners can override that default. The feature is available on private BSR instances (Pro, Enterprise, and on-prem); it doesn’t apply to the public buf.build.

Defaults can be set at two levels: instance-wide (by an instance administrator) and per-organization (by the organization’s Owner or Admin). At each level, a Strict toggle controls whether the level below can override the default.

How visibility, defaults, and Strict interact#

The BSR resolves an individual resource’s visibility this way:

  1. Instance default + Strict ON → the instance default applies and only an instance admin can change a resource’s visibility. Organization-level defaults and per-resource overrides are ignored.
  2. Instance default + Strict OFF → the organization that owns the resource can set its own default below.
  3. Organization default + Strict ON → the organization default applies and only the organization’s Owner or Admin (or an instance admin) can change a resource’s visibility.
  4. Organization default + Strict OFF → the resource’s owner (the user with Admin on the resource) can set the resource’s visibility directly.

Defaults apply only to newly created resources. Existing resources keep their current visibility when defaults or Strict toggles change.

Visibility changes at every level are recorded in audit logs.

When to use resource visibility#

Resource visibility is useful when the registry has to enforce the organization’s privacy posture instead of relying on each team to choose the right setting manually:

  • Keep repositories private by default so newly published schemas don’t become instance-visible before review.
  • Let trusted organizations choose their own defaults while keeping stricter defaults for the rest of the instance.
  • Restrict internal plugins and policies to the teams that own them while leaving shared APIs discoverable across the company.

Configure instance-wide defaults#

Access required: instance administrator.

  1. Sign in to the BSR.
  2. Navigate to Admin > Settings > Resource visibility, or open https://your-bsr-instance.example.com/admin/resource-visibility.
  3. For each resource type, set the default visibility from the dropdown. Public makes resources visible to all users on the instance; Private restricts them to members of the resource’s organization.
  4. Toggle Strict to control whether organization owners and admins can override this default. With Strict on, only instance admins can change a resource’s visibility. With Strict off, organizations apply their own defaults (see below) and the instance default seeds newly created resources.
  5. Click Update.

Configure organization-level defaults#

Access required: organization Owner or Admin. Available only when the instance default for the resource type has Strict off.

  1. Sign in to the BSR.
  2. Open the organization’s settings page at https://your-bsr-instance.example.com/your-organization/settings/general.
  3. Scroll to Resource visibility.
  4. For each resource type, set the default visibility from the dropdown. Public makes resources visible to all users on the instance; Private restricts them to organization members.
  5. Toggle Strict to control whether resource owners can override this default. With Strict on, only organization admins (or an instance admin) can change a resource’s visibility. With Strict off, resource owners can change visibility on individual resources.
  6. Click Update.

Change an individual resource’s visibility#

When the applicable Strict toggle is off, the resource’s owner can set its visibility directly from the resource’s settings page. For repositories, see Update the visibility of a repository.