> **For coding agents and LLMs:** This is one page from the Social Fetch docs (markdown export). For curated orientation and workflow guidance, start with [`/llms.txt`](https://www.socialfetch.dev/llms.txt); for agent onboarding and crawl rules, use [`/agents.txt`](https://www.socialfetch.dev/agents.txt); for the full endpoint list with links to pages like this one, use [`/llms-endpoints.txt`](https://www.socialfetch.dev/llms-endpoints.txt); for one platform's parameters and curls, use [`/llms-{platform}.txt`](https://www.socialfetch.dev/llms-tiktok.txt); use [`/llms.json`](https://www.socialfetch.dev/llms.json) when you need structured JSON for tool registration.

## This page

- **On-site (HTML):** <https://www.socialfetch.dev/docs/api/v1/npm/package/provenance/get>
- **Markdown (.mdx) URL:** <https://www.socialfetch.dev/docs/api/v1/npm/package/provenance/get.mdx>

## API base URL and authentication

- **API origin (from OpenAPI `servers`):** `https://api.socialfetch.dev`
- **Authentication:** send `x-api-key: sfk_...` on `/v1/**` and `/v2/**` routes unless the operation is explicitly anonymous (check OpenAPI `security`, the [API reference hub](https://www.socialfetch.dev/docs/api.mdx), [`/llms.txt`](https://www.socialfetch.dev/llms.txt), or [`/llms.json`](https://www.socialfetch.dev/llms.json) for each route).
- **OpenAPI JSON:** <https://www.socialfetch.dev/openapi.json>

## Recommended docs entrypoints (this site)

- [Documentation overview](https://www.socialfetch.dev/docs.mdx) — top-level orientation (markdown).
- [Quickstart](https://www.socialfetch.dev/docs/quickstart.mdx) — authenticate with `x-api-key`, validate auth with `whoami`, and understand the JSON envelope.
- [SDK](https://www.socialfetch.dev/docs/sdk.mdx) — official TypeScript SDK guide, including `SocialFetchClient`, `Result`, and `unwrap()`.
- [Capability matrix](https://www.socialfetch.dev/docs/capability-matrix.mdx) — every operation with identifiers, pagination, outcomes, media download, credits, and its SDK method. Generated from OpenAPI, so use it for route selection instead of scanning individual pages.
- [Recipes](https://www.socialfetch.dev/docs/recipes.mdx) — copyable workflows (brand monitoring, transcripts, Ad Library, creator scoring, Reddit research) with credit callouts and SDK examples.
- [Integrations](https://www.socialfetch.dev/docs/integrations.mdx) — MCP for AI clients, n8n verified node, Apify Store Actors, Make custom app, SDK, and REST API connection paths.
- [MCP product page](https://www.socialfetch.dev/mcp) — hosted MCP overview, OAuth, Skills install.
- [MCP integration](https://www.socialfetch.dev/docs/integrations/mcp.mdx) — hosted `/mcp` server, OAuth, Cursor/VS Code/Claude install snippets, 910 endpoint tools, plus docs_search/docs_read for implementation help.
- [n8n integration](https://www.socialfetch.dev/docs/integrations/n8n.mdx) — install `n8n-nodes-socialfetch`, credentials, and workflow examples.
- [Apify integration](https://www.socialfetch.dev/docs/integrations/apify.mdx) — Store Actors under @social-fetch, PPE billing, dataset export, and quick start.
- [Make integration](https://www.socialfetch.dev/docs/integrations/make.mdx) — custom app modules for Make scenarios, API key credentials, and module catalog.
- [`/llms-endpoints.txt`](https://www.socialfetch.dev/llms-endpoints.txt) — every documented operation with a direct link to that route's agent-readable markdown page (prefer this over parsing OpenAPI).
- [`/llms-{platform}.txt`](https://www.socialfetch.dev/llms-tiktok.txt) — per-platform endpoint files generated from OpenAPI (parameters, credits, curls).
- [`/agents.txt`](https://www.socialfetch.dev/agents.txt) — agent crawl/onboarding file with capabilities, auth rules, and allowlist.
- [`/llms.json`](https://www.socialfetch.dev/llms.json) — structured machine-readable operation inventory with parameter names, pagination, outcomes, credits, and SDK mapping.
- [API reference hub](https://www.socialfetch.dev/docs/api.mdx) — human-friendly index of operations with links into generated pages.
- [Errors](https://www.socialfetch.dev/docs/errors.mdx) — shared error envelope and HTTP status guidance.
- [Credits](https://www.socialfetch.dev/docs/credits.mdx) — metering, `402`, and planning batch jobs.
- Outcome semantics such as `found`, `not_found`, and `private` are documented in [Errors](https://www.socialfetch.dev/docs/errors.mdx) and on operation pages when present in the OpenAPI contract.

## Markdown docs convention

- Every docs page has a markdown twin: append **`.mdx`** to the docs pathname (for example `/docs/quickstart` → `/docs/quickstart.mdx`).
- Agents that send `Accept: text/markdown` on `/docs/**` HTML URLs may receive markdown directly (same URL, `Vary: Accept`).
- Published blog posts use the same convention: `/blog/{slug}` → `/blog/{slug}.mdx`, or `Accept: text/markdown` on the HTML URL (`Vary: Accept`).

---
# Get npm package provenance (https://www.socialfetch.dev/docs/api/v1/npm/package/provenance/get)

## Summary

Get the publish and SLSA provenance attestations attached to an npm version, decoded from their sigstore bundles.

**Tags:** `npm`

## HTTP

- **Method:** GET
- **Path:** `/v1/npm/package/provenance`
- **operationId:** `npm.package.provenance.get`
- **Base URL:** `https://api.socialfetch.dev`

## Capability summary

- **SDK mapping:** `client.npm.getProvenance({ name: "express", version: "5.3.0" })`
- **Pagination:** none
- **Business outcome field:** `data.lookupStatus` with values `found`, `not_found`

## Credits

- **Base:** 1 credit per successful lookup.
- **Maximum on success (200):** 1 credit.
- **Failed requests (`lookup_failed`, `503`):** not charged.
- **Authoritative field:** `meta.creditsCharged`.

## Authentication

- **`x-api-key`**: API key (`sfk_...`)

## Parameters

### `name` (query)

- **Required:** yes
- **Constraints:** type `string`; maxLength: 214
- **Description:** npm package name, e.g. `express`, `lodash.merge`, `@types/node` or `--file--1`. Names are case-sensitive (`Express` is a different package) and keep legacy punctuation such as a leading `-`.

### `version` (query)

- **Required:** no
- **Constraints:** type `string`; maxLength: 128
- **Description:** Exact version or dist-tag. A dist-tag is resolved to the version it points to. Default: `latest`.

### `include` (query)

- **Required:** no
- **Constraints:** type `string`; enum: raw
- **Description:** `raw` also returns each sigstore bundle. Signatures are decoded, not verified.

## Responses (status codes)

- **200**: npm provenance.
- **400**: Invalid request
- **401**: Missing or invalid API key
- **402**: Insufficient credits
- **413**: The document is larger than the maximum size we can return; no charge.
- **500**: Unexpected or billing error
- **502**: Lookup could not be completed.
- **503**: Service temporarily unavailable; safe to retry with backoff.

## Response body (200)

npm provenance.

### Field outline

- **data** (required) — type `object`. Endpoint-specific response payload.
  - **lookupStatus** (required) — type `string`; enum: found, not_found. Whether the item exists. Every outcome is HTTP 200; branch on this field.
  - **name** (required) — type `string`. Package name.
  - **version** (required) — type `string`. Version the answer is about. A dist-tag is replaced by the version it points to.
  - **attestations** (required) — type `array`. Attestations attached to the version. Empty when npm has none; signatures are decoded, not verified.
    - _items:_
      - **kind** (required) — type `string`; enum: publish, slsa-provenance, unknown. `publish` for npm's publish attestation, `slsa-provenance` for SLSA, `unknown` for a future predicate type.
      - **predicateType** (required) — type `string`. The predicate type from the bundle.
      - **subject** (required) — type `object`; nullable. What the attestation is about.
      - **source** (required) — type `object`; nullable. Source and workflow facts decoded from SLSA provenance.
      - **builder** (required) — type `string`; nullable. Builder identity.
      - **runUrl** (required) — type `string`; nullable. CI run URL.
      - **transparencyLog** (required) — type `object`; nullable. The public transparency-log entry that recorded the attestation; null when there is none.
      - **raw** (optional) — type `object`. The sigstore bundle, only with `include=raw`.
- **meta** (required) — type `object`. Metadata describing the request and billing outcome.
  - **requestId** (required) — type `string`; minLength: 1. Unique request identifier for tracing this API call.
  - **creditsCharged** (required) — type `integer`; minimum: 0. Credits charged for this request.
  - **version** (required) — type `string`; enum: v1. Public API version that served the response.

### Example JSON (found)

```json
{
  "data": {
    "lookupStatus": "found",
    "name": "express",
    "version": "5.3.0",
    "attestations": [
      {
        "kind": "publish",
        "predicateType": "https://github.com/npm/attestation/tree/main/specs/publish/v0.1",
        "subject": {
          "purl": "pkg:npm/express@5.3.0",
          "sha512": "a82ab2d714a86ae831383e085476f5656764bc21765b7684da890aa2e5a3f15c09fb3b6c912897a019c2489a9f293f9c54f261b89a9ef582db638db9f99874d2"
        },
        "source": null,
        "builder": null,
        "runUrl": null,
        "transparencyLog": {
          "logIndex": 3164680145,
          "integratedAt": "2026-10-09T12:57:25.000Z"
        }
      }
    ]
  },
  "meta": {
    "requestId": "req_7da7517a-e059-4740-8a19-17e7b7dd46b1",
    "creditsCharged": 1,
    "version": "v1"
  }
}
```

### Machine-readable error codes

When an error JSON body is returned, it may include one of these `error.code` values (derived from the OpenAPI schemas for this operation; additional codes may exist at runtime):

- `bad_request`

## Error handling & retries

Interpret HTTP status codes using the descriptions below. Do not assume a JSON body unless the OpenAPI schema defines one for that status.

- **400**: Invalid request **Retry:** Fix the request; retrying the same invalid payload will not help.
- **401**: Missing or invalid API key **Retry:** Fix the API key first; retrying without changes will not help.
- **402**: Insufficient credits **Retry:** Do not retry without resolving billing/credits (retrying the same request will not help).
- **413**: The document is larger than the maximum size we can return; no charge.
- **500**: Unexpected or billing error
- **502**: Lookup could not be completed. **Retry:** May be transient; a few retries with backoff are reasonable.
- **503**: Service temporarily unavailable; safe to retry with backoff. **Retry:** Usually safe to retry with exponential backoff and jitter.

### Suggested client defaults

- Send the API key using the `x-api-key` header on every request.
- On `503` (and sometimes `502`), retry with backoff; cap retries and surface a clear error to the user.
- On `402`, surface an actionable billing message rather than blind retries.

## Examples

### TypeScript SDK

```typescript
import { SocialFetchClient } from "@socialfetch/sdk";

const client = new SocialFetchClient({
  apiKey: process.env.SOCIALFETCH_API_KEY!,
});

const result = await client.npm.getProvenance({
  name: "express",
});

if (!result.ok) {
  console.error(result.error);
} else {
  console.log(result.value.data);
}
```

### Node.js

```javascript
const response = await fetch(
  "https://api.socialfetch.dev/v1/npm/package/provenance?name=express",
  {
    headers: {
      "x-api-key": "YOUR_API_KEY"
    }
  }
);

const data = await response.json();
console.log(data);
```

### cURL

```bash
curl "https://api.socialfetch.dev/v1/npm/package/provenance?name=express" \
  -H "x-api-key: YOUR_API_KEY"
```

### Python

```python
import requests

response = requests.get(
    "https://api.socialfetch.dev/v1/npm/package/provenance?name=express",
    headers={"x-api-key": "YOUR_API_KEY"},
)
data = response.json()
print(data)
```