Social Fetch
Start for freeStart free
All platforms18 npm endpoints

npm API. Packages, downloads and provenance as JSON.

Get a package, one version, its full version list, download counts, advisories, provenance attestations, dependents, search results, users and orgs. Name the package and read typed JSON.

Get 100 free credits
No credit card requiredRead the API docs
  • Packages + owners
  • Downloads + advisories
  • 1 credit per package name
  • Failed requests aren't charged
99.8% uptime#3 Product of the Day3,200+ developers

Teams running monitoring, research, and enrichment pipelines

Why Social Fetch

npm data as JSON. You build the product.

Live npm data in one response shape, with platform changes handled for you.

npm, plus every other platform

One key and one response envelope for npm and 56 more platforms.

Pricing you can reason about

One request, one credit. Know how far your balance will go before you run your next batch.

Live data on every request

Fetch public data when you ask for it.

Nothing to maintain

We handle platform changes and breakages.

Built for production jobs

Run concurrent workloads with explicit statuses and request IDs.

Regular jobs. Better rates.

Running lookups every month? Get lower per-credit rates with a monthly plan. For occasional projects, choose pay as you go.

Never expires

What npm data can you get?

18 endpoints, one API key. Every response comes back as live JSON in the same envelope.

Browse all 18 npm endpoints

Packages

Downloads

Security

Community

Owners

Registry

Use cases

What teams build with npm data

Monitoring, enrichment, research and content workflows on npm data, on the same API as every other platform.

What you can build

Track packages

Follow versions, downloads and new advisories.

Audit dependencies

Check advisories, provenance and dependents for the packages you use.

Browse all workflows →

How it works

Your first request in three steps.

Use TypeScript or your automation tool of choice.

Sources

+ 51 more platforms

One request

Social Fetch API

GET/v1/tiktok/profiles/charlidamelio

x-api-key: sk_live_••••••••

1 request · 1 credit

Same JSON shape

response.json200 OK
{
  "data": {
    "lookupStatus": "found",
    "profile": {
      "platform": "tiktok",
      "handle": "charlidamelio",
      "displayName": "charli d’amelio",
      "verified": true
    },
    "metrics": {
      "followers": 160263648
    }
  }
}

  1. Step 1

    Create your free account

    Get an API key with 100 requests included.

  2. Step 2

    Choose an endpoint

    Pass a username, URL, keyword, or post ID.

  3. Step 3

    Get clean JSON

    Use the response immediately or send it into your pipeline.

Works with your stack

Code, automate, or connect your AI.

Explore integrations

Pricing

Social data, priced simply.

Start with 100 free credits. Monthly plans give you predictable volume and lower per-request rates.

Starter

$29.00

18,000credits

$1.61 per 1k · $0.00161 per request

  • Top up from $1.61 / 1k if you run out
  • Up to 25 monitors
Subscribe to Starter
Most popular

Growth

$79.00

50,000credits

$1.58 per 1k · $0.00158 per request

  • Top up from $1.58 / 1k if you run out
  • 5 team seats
  • Up to 100 monitors
Subscribe to Growth

Scale

$225.00

150,000credits

$1.50 per 1k · $0.00150 per request

  • Top up from $1.50 / 1k if you run out
  • 25 team seats
  • Up to 250 monitors
Subscribe to Scale
  • Cancel anytime
  • 30-day money-back guarantee
  • Price locked while you stay

Need 1M+ credits, invoicing, or volume rates? Talk to us

Trust signals

DevHunt

Product Hunt

Uneed

Customers

Teams building on Social Fetch.

“Our TikTok and Instagram scrapers broke constantly. Social Fetch took us off that rotation — we ship product again.”

Daniel Reeve · Founder, Social Crow

  • “Transcripts at volume from one endpoint. No broken scrapers for our small team to maintain.”

    Marcus Lin · Founder, Voice Gecko

  • “Live profile data on every request. We never flag accounts from a stale cache.”

    Hannah Webb · Founder, Scam Finder

  • “Heavy concurrent load, no rate limits to negotiate. The rare API I haven't wrapped in retries.”

    Owen Pritchard · Founder, IP Flare

npm API: common questions

Is there an npm API for package metadata and downloads?

Yes. Social Fetch has eighteen npm routes under /v1/npm for packages, full package documents, versions, single versions, downloads, per-version downloads, downloads for several names, advisories, provenance, dependents, search, users, orgs, package names, changes and recent updates. Authenticate with your Social Fetch API key in x-api-key.

How do I name a package?

Use the name as npm stores it: express, lodash.merge or @types/node. Scoped names need exactly one slash. Names are case-sensitive, so Express is a different package from express. A package that does not exist returns HTTP 200 with data.lookupStatus set to not_found.

What is the difference between the package and package details routes?

GET /v1/npm/package is the small answer: data.package for the latest version, data.distTags, data.latestVersion, data.downloads for last week and data.complete with data.missing when part of the answer could not be filled. GET /v1/npm/package/details returns the full registry document in data.package, including timestamps, stars, README, every version row, the dependents count and weekly downloads.

How do downloads work?

GET /v1/npm/package/downloads with period=last-day, last-week, last-month or last-year returns a total; add granularity=daily for one row per day in data.days. Give from and to instead of period for an explicit range. A range spans up to 18 months; a longer range keeps its newest 18 months and sets data.clamped. Download data starts on 2015-01-10. Omit name for the whole registry total. The newest day usually reads 0 because npm has not counted it yet, and some packages have gaps in their daily counts, so a month or year total can be lower than the sum of the daily rows.

Can I fetch several packages in one request?

GET /v1/npm/packages/downloads takes up to 128 comma-separated names and returns one row per name in data.results, in request order, with data.summary counting found, notFound and unavailable names. It charges one credit per requested name, including a name that is not found, up to 128 credits per request, and each result carries its own status.

What does the provenance route return?

GET /v1/npm/package/provenance returns data.attestations for one version, with kind, predicateType, subject, source repository and workflow, builder, runUrl and transparency log index. Signatures are decoded, not verified. A version that does not exist returns data.lookupStatus not_found; an existing version with no attestation is found with an empty attestations list. Add include=raw to also get each sigstore bundle in attestations[].raw.

How far can I page through search and dependents?

Search accepts 1 to 250 results per page and honours a starting offset only up to 5,000, so the deepest result is about 5,250. Dependents are 36 per page for at most 11 pages, so at most 396 names. Both use page.nextCursor and page.hasMore, and a page past the end is an empty page with hasMore false.

Does HTTP 200 mean the package or user exists?

No. HTTP 200 means the request finished. Check data.lookupStatus: not_found means the package, version, user or org does not exist. Lists such as dependents, search and package names are found with an empty array when nothing matched.

What happens with a very large package document?

GET /v1/npm/package/details caps the decoded document at 32 MB, which covers the largest packages in the registry (next is about 30 MB decoded). A package whose document is larger is refused instead of returning a partial answer. The smaller package route is the better choice for a quick latest-version lookup.

Can I use the npm routes from agents or MCP?

Yes. Every npm route is reachable through Ask (POST /v1/ask) in plain English and through MCP with the same credit metering as REST. Use the typed routes for production jobs and the agent surfaces for exploration.

The npm API in detailHow the npm routes work, what they cost, and how they differ from the official API.

Why teams use Social Fetch for npm

Social Fetch exposes eighteen routes under /v1/npm. Package routes cover one package with its latest version, every dist-tag and last week's downloads; the full registry document with timestamps, README, version list and the extra package facts; the version list newest first; and one version document by exact version or dist-tag. Write express, lodash.merge or @types/node as it appears in npm; names are case-sensitive.

Download routes cover a package total or one row per day, last week's downloads for every version, and a batch of up to 128 names in one call. Security routes cover advisories for one version or every version, and the publish and SLSA provenance attestations behind a version, decoded into fields. Community routes cover packages that depend on a package, registry search, users, orgs, and their package lists.

Registry routes cover package names in key order, the change feed from a sequence, and the recent-updates feed. Every response uses the { data, meta } envelope: single lookups set data.lookupStatus to found or not_found, lists expose page.nextCursor and page.hasMore, and meta.creditsCharged is what the request cost.

How to call the npm API

  1. 1. Create an API key

    Sign up at Social Fetch and copy a key (sfk_…). New accounts get 100 free credits, enough to try a package, its versions and its downloads.

  2. 2. Pick the route

    Use GET /v1/npm/package?name=express for the latest version and dist-tags, or GET /v1/npm/package/downloads?name=express&period=last-week for downloads. Send x-api-key on every request.

  3. 3. Page and branch

    Check data.lookupStatus before storing a row. Keep calling with page.nextCursor while page.hasMore is true. Bill from meta.creditsCharged, and read data.complete and data.missing when a package answer was partial.

What each npm route returns

  • One package with data.package, data.distTags, data.latestVersion and data.downloads.
  • The full registry document with starCount, readme, versionCount and every version row.
  • Version history with publication time, deprecation, provenance, integrity hashes and unpacked size.
  • Download totals, daily rows and per-version counts, plus a 128-name batch.
  • Security advisories with severity, CWE ids and CVSS, and provenance attestations decoded from their bundles.
  • Search, dependents, users, orgs and the registry's name and change feeds.

How much does the npm API cost?

Most npm routes charge one credit per completed request, and the downloads batch charges one credit per requested name, up to 128 names and 128 credits per request. Each page of a list is its own request. A request that fails with 503 temporarily_unavailable is not charged. Credits never expire on pay-as-you-go packs, and meta.creditsCharged on every response is the billing source of truth.

Social Fetch vs the official npm API

npm publishes its registry and download data in several shapes for the same facts: package documents are large, version data is nested under a version key, download responses switch shape between total and daily, and a missing package comes back as an HTTP error. Social Fetch gives you one envelope and one paging model across all eighteen routes: typed not_found, decoded provenance attestations, advisories joined to the package, and the extra package facts (dependents count, weekly downloads) attached to the same package object.

Pull your first npm data.

Run a live npm request in the playground. 100 free credits, no card, JSON back in seconds.

Get 100 free credits

No credit cardSign up in 30 seconds withGoogleGitHub