> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Get a package or repository changelog > Read release notes for a package or repository, ordered newest first. Retrieve recent releases to catch up on changes, or a version range to review everything between two releases. Use this endpoint to understand what changed before updating a dependency. You can request just the release timeline or include the full release-note text. ## Selector catalogue Use the following selectors with the `fields` query parameter to choose which fields the response includes. See [Choose what the response includes](https://docs.githits.com/api/requests-and-responses#choose-what-the-response-includes) for details. | Selector | Data | Default | | --- | --- | --- | | `entries` | Complete timeline metadata: version, normalized_version, published_at and html_url when available. | Yes | | `entries.body` | Third-party Markdown bodies; implies the complete entries metadata group. | Yes | | `entries.*` | Explicit union of entries and entries.body. | No | ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json get /v1/changelog openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation | List package documentation, then read a page | | Navigate source code | List files, read a file or search text within a target | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Ask a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`; development uses `https://api-dev.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Percent-encode a package name or opaque read target as one path segment, including any embedded slash. For query values, encode a literal plus sign as `%2B`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Ask, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Discover existing documentation pages and read their content with exact source locators and availability information. name: Documentation - description: >- Enumerate files, read exact content and grep within a package or repository. Responses retain served identity, indexing state and completeness information. name: Code - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: >- Preview operations for target resolution, source comparison and cited questions. Routes use /v1/experimental and may later move to permanent v1 locations under a documented migration policy. name: Experimental paths: /v1/changelog: get: tags: - Packages summary: Get a package or repository changelog description: > Read release notes for a package or repository, ordered newest first. Retrieve recent releases to catch up on changes, or a version range to review everything between two releases. Use this endpoint to understand what changed before updating a dependency. You can request just the release timeline or include the full release-note text. ## Selector catalogue Use the following selectors with the `fields` query parameter to choose which fields the response includes. See [Choose what the response includes](https://docs.githits.com/api/requests-and-responses#choose-what-the-response-includes) for details. | Selector | Data | Default | | --- | --- | --- | | `entries` | Complete timeline metadata: version, normalized_version, published_at and html_url when available. | Yes | | `entries.body` | Third-party Markdown bodies; implies the complete entries metadata group. | Yes | | `entries.*` | Explicit union of entries and entries.body. | No | operationId: get_changelog parameters: - description: >- Canonical lowercase registry, required together with name and mutually exclusive with repo_url. Same registry set as package inspection. example: npm in: query name: registry required: false schema: enum: - npm - pypi - hex - crates - vcpkg - zig - nuget - maven - packagist - rubygems - go - swift type: string - description: >- Registry package name, preserved exactly and limited to 255 UTF-8 bytes without control characters. Required with registry, forbidden with repo_url. example: express in: query name: name required: false schema: type: string - description: >- Full HTTP(S) repository URL; mutually exclusive with registry/name. The source owns supported repository hosts and canonicalization. example: https://github.com/expressjs/express in: query name: repo_url required: false schema: type: string - description: >- Optional repository file branch/tag lookup context; trimmed, blank is absent. Not a version bound or resolved commit assertion. example: main in: query name: git_ref required: false schema: type: string - description: >- Normalized lower range bound, exclusive for released versions; enables complete-range mode and forbids limit. With from_version=1.0.0&to_version=1.2.0, releases are newer than 1.0.0 through 1.2.0 inclusive. Blank is absent; Go numeric versions gain lowercase v and existing lowercase v is accepted (uppercase V is rejected), Swift allows v/V, other modes reject numeric v/V-prefixed tags. Special unreleased entries follow source-specific handling. example: 1.0.0 in: query name: from_version required: false schema: type: string - description: >- Optional normalized upper bound, inclusive for released versions; special unreleased entries follow source-specific handling. Omitted or latest resolves the latest package version; repository mode remains uncapped. Alone this keeps latest-count mode. example: 2.0.0 in: query name: to_version required: false schema: type: string - description: >- Latest-mode positive integer count, default 10, minimum 1, maximum 50. Forbidden with nonblank from_version. Range results have no count cap or pagination. example: 10 in: query name: limit required: false schema: default: 10 maximum: 50 minimum: 1 type: integer - description: >- Response groups to include: `entries`, `entries.body`, or the `entries.*` bundle. Defaults to `entries,entries.body`. Explicit selection replaces defaults; `entries.body` includes entry metadata. Select `entries` alone for a timeline without release-note bodies. This reduces transfer size, but the changelog is still retrieved. Use the case-sensitive selectors in the catalogue. Order and duplicate selectors do not affect the result. ASCII whitespace around selectors is ignored. The decoded value is limited to 2048 UTF-8 bytes. Empty or unknown selectors and repeated `fields` query parameters return `400 VALIDATION_ERROR`. A group does not include nested groups unless the catalogue says so; only listed wildcard bundles are supported. example: entries in: query name: fields required: false schema: default: entries,entries.body type: string - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional session attribution: trimmed printable ASCII, at most 128 bytes. Invalid optional values are dropped; no session is created. in: header name: X-GitHits-Session-ID required: false schema: type: string responses: '200': content: application/json: examples: default: summary: 'Package latest: default groups and available Markdown' value: entries: - body: |- ## Changes Bug fixes. html_url: >- https://github.com/expressjs/express/releases/tag/5.2.1 normalized_version: 5.2.1 published_at: '2026-01-15T12:00:00Z' version: 5.2.1 mode: latest package: limit: 10 name: express registry: npm to_version: 5.2.1 source: releases empty: summary: Available source with no matching entries value: entries: [] mode: latest package: limit: 5 repo_url: https://github.com/example/repository source: releases repository_range: summary: >- Repository complete range without an upper bound or linked package value: entries: - body: '' version: 2.0.0 - version: 1.1.0 mode: range package: from_version: 1.0.0 repo_url: https://github.com/example/repository requested_git_ref: main source: changelog_file timeline: summary: >- fields=entries: registry timeline without a matched changelog source value: entries: - normalized_version: 1.0.0 version: 1.0.0 mode: latest package: limit: 10 name: example registry: npm to_version: 1.0.0 schema: $ref: '#/components/schemas/ChangelogResponse' description: Available changelog entries, newest first headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '400': content: application/problem+json: example: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Validation error (VALIDATION_ERROR). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Authentication required (AUTHENTICATION_REQUIRED). headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer authentication challenge. schema: type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- Forbidden (FORBIDDEN, ACCOUNT_INACTIVE, FEATURE_FLAG_REQUIRED, TERMS_ACCEPTANCE_REQUIRED). TERMS_ACCEPTANCE_REQUIRED may include source-provided HTTPS terms_url and acceptance_url. headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '404': content: application/problem+json: example: code: CHANGELOG_SOURCE_NOT_FOUND detail: >- No changelog source or registry timeline is available for this target. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 404 title: Changelog source not found type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- Changelog source not found (CHANGELOG_SOURCE_NOT_FOUND, NO_CHANGELOG_ENTRIES, PACKAGE_NOT_FOUND, NO_RELEASED_VERSIONS, VERSION_NOT_FOUND). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: GET, HEAD.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '422': content: application/problem+json: example: code: UNSUPPORTED_PACKAGE_VARIANTS detail: The package release has unsupported artifact variants. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 422 title: Unsupported package variants type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Unsupported package variants (UNSUPPORTED_PACKAGE_VARIANTS). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Rate limited (RATE_LIMITED). headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: >- Optional bounded delay in seconds or HTTP date; obey before retrying. schema: type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '500': description: >- Request identity could not be created. Empty body without X-Request-ID; no problem object is available. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Upstream error (UPSTREAM_ERROR). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Upstream timeout (TIMEOUT). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string security: - bearer_auth: [] x-codeSamples: - label: Package latest lang: HTTP source: |- GET /v1/changelog?registry=npm&name=express HTTP/1.1 Host: api.githits.dev Authorization: Bearer - label: Package timeline lang: HTTP source: |- GET /v1/changelog?registry=npm&name=express&fields=entries HTTP/1.1 Host: api.githits.dev Authorization: Bearer - label: Repository latest lang: HTTP source: >- GET /v1/changelog?repo_url=https%3A%2F%2Fgithub.com%2Fexpressjs%2Fexpress&limit=5 HTTP/1.1 Host: api.githits.dev Authorization: Bearer - label: Complete Go range lang: HTTP source: >- GET /v1/changelog?registry=go&name=golang.org%2Fx%2Ftext&from_version=0.20.0&to_version=0.22.0&fields=entries.* HTTP/1.1 Host: api.githits.dev Authorization: Bearer components: schemas: ChangelogResponse: description: One complete latest or range changelog result; no pagination. properties: entries: description: >- All entries returned by the source, newest first. Empty means an available source matched no entries; range results are never truncated by the gateway. items: $ref: '#/components/schemas/ChangelogEntry' type: array mode: $ref: '#/components/schemas/ChangelogMode' description: Effective mode, determined by the presence of `from_version`. package: $ref: '#/components/schemas/ChangelogPackage' description: >- Required resolved addressing and effective query bounds from the source. requested_git_ref: description: >- Requested git ref after trimming; request context, not a verified resolved commit or source provenance. type: string source: description: >- Top-level source (usually releases, `changelog_file` or hexdocs), omitted for registry-only timelines. Does not describe each entry's body availability or attest a resolved git ref. type: string required: - mode - package - entries type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: An optional acceptance URL supplied by the upstream allow-list. type: string code: description: The stable uppercase API error code. type: string detail: description: A stable, client-safe explanation of the failure. type: string instance: description: The active request trace ID. type: string status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: An optional terms URL supplied by the upstream allow-list. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object ChangelogEntry: description: Atomic timeline metadata with optionally selected content. properties: body: description: >- Third-party Markdown, not instructions; omitted when unselected or unavailable. An available empty string is preserved. type: string html_url: description: >- Third-party release or changelog-section URL; omitted when unavailable. type: string normalized_version: description: >- Source-normalized version used for ordering; omitted when unavailable. type: string published_at: description: Source publication timestamp (ISO8601); omitted when unavailable. type: string version: description: >- Source version or release tag; omitted when unavailable and never synthesized. type: string type: object ChangelogMode: description: The mutually exclusive changelog modes. enum: - latest - range type: string ChangelogPackage: description: Source-reported package or repository identity and effective bounds. properties: from_version: description: Effective normalized lower bound; required only in range mode. type: string limit: description: >- Effective latest-mode count cap (default 10, maximum 50); absent in full-range mode. format: int32 minimum: 0 type: integer name: description: >- Resolved package name; required with package addressing and optional for repository addressing. type: string registry: description: >- Canonical resolved package registry; required with package addressing and optional for a repository with no linked registry package. type: string repo_url: description: >- Canonical repository URL reported by the source; required with repository addressing. type: string to_version: description: >- Effective source-reported upper bound. Package mode resolves omission or latest to the latest version; repository mode may have no upper bound. type: string type: object securitySchemes: bearer_auth: scheme: bearer type: http ````