npm Versions API
Every version of a package, newest first, with the publication time, deprecation and tarball facts a release tracker needs.
GET /v1/npm/package/versions1 credit Failed requests are free
About this endpoint
GET /v1/npm/package/versions?name=express returns data.versions, one row per version with version, publishedAt, deprecated, hasProvenance, integrity, unpackedSize and fileCount. data.versionCount is the total the package reports, which is larger than the current page when data.page.hasMore is true.
The route keeps its own ordering by publication time, newest first, rather than the order of keys in the registry document. Page with limit (1 to 200, default 100) and page.nextCursor; the cursor is opaque and only continues the same package. A package whose every version was unpublished returns found with data.versionCount: 0 and the unpublished record, so a tombstone is visible instead of looking like a missing package.
npm Versions API FAQ
What does each version row contain?
version, publishedAt, deprecated, hasProvenance, integrity, unpackedSize and fileCount. The row is the summary; use GET /v1/npm/package/version for the full version document of one entry.
How do I fetch the next page?
Start with limit and no cursor, then pass data.page.nextCursor as cursor while data.page.hasMore is true. The cursor holds the position and the package, so do not mix it with another name. Each page is a separate request.
What happens for a package with no versions left?
The response is found with data.versions: [], data.versionCount: 0 and data.unpublished set. That is a tombstone, not a missing package. A name npm has never had returns lookupStatus not_found instead.
Is the list in registry key order?
No. The route sorts versions by publication time, newest first, so a release feed reads in the order people expect. Version strings are not used for the order because npm does not publish a reliable sort key in the document.
What does the request cost?
Pricing is documented on the operation in the API registry (shown on this page). Confirm on every response with meta.creditsCharged: that field is the billing source of truth. Each paginated page is a separate billed request.
Other npm endpoints
- PackageGET /v1/npm/package
- Package detailsGET /v1/npm/package/details
- VersionGET /v1/npm/package/version
- DownloadsGET /v1/npm/package/downloads
- Downloads by versionGET /v1/npm/package/downloads/versions
- Downloads by nameGET /v1/npm/packages/downloads
- AdvisoriesGET /v1/npm/package/advisories
- ProvenanceGET /v1/npm/package/provenance