Get npm package full registry document
Get npm package registry document with every version, README, stars and timestamps.
Headers
Get your API keyAPI key (`sfk_...`)
npm package name, e.g. `express`, `lodash.merge`, `@types/node` or `--file--1`. Names are case-sensitive (`Express` is a different package) and keep legacy punctuation such as a leading `-`.
max 214 chars
Endpoint-specific response payload.
Whether the item exists. Every outcome is HTTP 200; branch on this field.
one of: found, not_found
The full package document when found; otherwise null.
Package name, as the registry stores it.
Package scope including `@`, or null for an unscoped name.
Latest version, or null on a tombstone.
Description.
Keywords.
Licence: an SPDX expression/string or the published object.
Project homepage.
Issue tracker URL.
Source repository.
Repository type, e.g. `git`.
Repository URL as published.
Monorepo directory the package was published from.
Author.
Author name.
Author URL.
Contributors.
Contributor name.
Contributor URL.
GitHub handle the publisher listed.
Maintainers at the time this version was published. The details route uses the package's current maintainer list instead.
Maintainer username.
Publisher of this version.
Publishing username.
The CI identity, when the version was published by one.
Trusted publisher kind, e.g. `github`.
The publisher's OIDC configuration id.
Who approved a trusted publication.
Approving username.
Funding channels.
Funding kind, e.g. `opencollective`.
Funding URL.
Deprecation message; null when the version is not deprecated.
Whether `preinstall`, `install` or `postinstall` is defined, inferred from `scripts` when the field is absent. Null when neither the field nor those scripts are present: an implicit node-gyp rebuild from binding.gyp cannot be seen.
Command-name to file map, or null when the package has no binaries.
The package's entrypoints.
`main` entrypoint.
`module` entrypoint.
`types` or `typings` entrypoint.
`type` field (`module` or `commonjs`).
The `exports` map, as published.
`files` patterns.
The `sideEffects` flag, when published as a boolean.
Engine constraints.
Supported operating systems.
Supported CPU architectures.
Workspace patterns.
Package scripts.
Runtime dependencies.
Development dependencies.
Peer dependencies.
Peer dependency metadata.
Optional dependencies.
Bundled dependencies, as an array or the legacy boolean.
The published artifact and its registry metadata.
Tarball URL.
SHA-1 of the tarball.
Subresource-integrity hash of the tarball.
Files in the tarball.
≥ 0
Unpacked bytes.
≥ 0
Registry signatures. The legacy PGP block is not exposed.
Signing key id.
Signature.
Whether this version was published with provenance.
Whether the version carries an attestation.
Predicate type of the provenance attestation.
Git commit the version was built from.
The publisher's toolchain, from the version document.
Node version used to publish.
npm CLI version used to publish.
How the package ships TypeScript types: bundled with it, or through a DefinitelyTyped `@types` package.
one of: bundled, definitelyTyped, null
Every dist-tag.
The version the `latest` dist-tag points at.
ISO 8601 UTC timestamp, or null when npm has none.
ISO 8601 UTC timestamp, or null when npm has none.
How many users starred the package. Names are not exposed.
≥ 0
Latest README as raw Markdown, or null when there is none.
README filename.
Number of versions.
≥ 0
What was unpublished; present on a tombstone.
ISO 8601 UTC timestamp, or null when npm has none.
Versions that were unpublished.
How many packages depend on this one.
≥ 0
Weekly downloads, when available.
Up to 52 complete weeks of downloads, oldest first.
First day, `YYYY-MM-DD`.
Last day, `YYYY-MM-DD`.
Downloads in the window.
≥ 0
The last-publication entry.
Who published last.
ISO 8601 UTC timestamp, or null when npm has none.
Whether the package is npm's security-holding placeholder. Null when the part could not be completed.
Every version, newest first.
Version.
ISO 8601 UTC timestamp, or null when npm has none.
Deprecation message, or null.
Whether the version carries a provenance attestation.
Tarball integrity hash.
Unpacked bytes.
≥ 0
Files in the tarball.
≥ 0
False when part of the answer could not be filled, so the dependents count, weekly downloads, type hint and placeholder flag are null; `missing` says which part.
Parts of the answer that could not be filled.
Metadata describing the request and billing outcome.
Unique request identifier for tracing this API call.
min 1 chars
Credits charged for this request.
≥ 0
Public API version that served the response.
one of: v1
Code example
curl "https://api.socialfetch.dev/v1/npm/package/details?name=express" \
-H "x-api-key: YOUR_API_KEY"Responses
npm package details.