Get one npm package version
Get one npm version document, by exact version or dist-tag, with its files, dependencies, scripts and registry metadata.
Headers
Get your API keyAPI key (`sfk_...`)
npm package name, e.g. `express`, `lodash.merge`, `@types/node` or `--file--1`. Names are case-sensitive (`Express` is a different package) and keep legacy punctuation such as a leading `-`.
max 214 chars
Exact version or dist-tag, e.g. `5.3.0`, `5.0.0-alpha.1`, `latest` or `latest-4`. Semver ranges (`^4`, `4.x`) are refused.
max 128 chars
Endpoint-specific response payload.
Whether the item exists. Every outcome is HTTP 200; branch on this field.
one of: found, not_found
The version document when found; otherwise null.
Package name, as the registry stores it.
Package scope including `@`, or null for an unscoped name.
Version.
Description.
Keywords.
Licence: an SPDX expression/string or the published object.
Project homepage.
Issue tracker URL.
Source repository.
Repository type, e.g. `git`.
Repository URL as published.
Monorepo directory the package was published from.
Author.
Author name.
Author URL.
Contributors.
Contributor name.
Contributor URL.
GitHub handle the publisher listed.
Maintainers at the time this version was published. The details route uses the package's current maintainer list instead.
Maintainer username.
Publisher of this version.
Publishing username.
The CI identity, when the version was published by one.
Trusted publisher kind, e.g. `github`.
The publisher's OIDC configuration id.
Who approved a trusted publication.
Approving username.
Funding channels.
Funding kind, e.g. `opencollective`.
Funding URL.
Deprecation message; null when the version is not deprecated.
Whether `preinstall`, `install` or `postinstall` is defined, inferred from `scripts` when the field is absent. Null when neither the field nor those scripts are present: an implicit node-gyp rebuild from binding.gyp cannot be seen.
Command-name to file map, or null when the package has no binaries.
The package's entrypoints.
`main` entrypoint.
`module` entrypoint.
`types` or `typings` entrypoint.
`type` field (`module` or `commonjs`).
The `exports` map, as published.
`files` patterns.
The `sideEffects` flag, when published as a boolean.
Engine constraints.
Supported operating systems.
Supported CPU architectures.
Workspace patterns.
Package scripts.
Runtime dependencies.
Development dependencies.
Peer dependencies.
Peer dependency metadata.
Optional dependencies.
Bundled dependencies, as an array or the legacy boolean.
The published artifact and its registry metadata.
Tarball URL.
SHA-1 of the tarball.
Subresource-integrity hash of the tarball.
Files in the tarball.
≥ 0
Unpacked bytes.
≥ 0
Registry signatures. The legacy PGP block is not exposed.
Signing key id.
Signature.
Whether this version was published with provenance.
Whether the version carries an attestation.
Predicate type of the provenance attestation.
Git commit the version was built from.
The publisher's toolchain, from the version document.
Node version used to publish.
npm CLI version used to publish.
How the package ships TypeScript types: bundled with it, or through a DefinitelyTyped `@types` package.
one of: bundled, definitelyTyped, null
Metadata describing the request and billing outcome.
Unique request identifier for tracing this API call.
min 1 chars
Credits charged for this request.
≥ 0
Public API version that served the response.
one of: v1
Code example
curl "https://api.socialfetch.dev/v1/npm/package/version?name=express&version=5.3.0" \
-H "x-api-key: YOUR_API_KEY"Responses
npm version.