/v2/* with S3-backed blobs. This is the image registry for deployed agents, not the Enterprise artifact catalog.
Auth: OCI bearer, agent pull token, or build-push token.
Import from an external host uses
POST /api/import/registry (in the generated spec). That host must be in REGISTRY_IMPORT_ALLOWED_HOSTS. See Operate and Agent hosting.