Inspect a package release
Get an overview of a package and one of its published releases, including its description, license, and deprecation status. You can also include download counts, GitHub repository details, security advisories, and release notes.
Use this endpoint to evaluate a dependency or check a version you already use. For a release history, use GET /v1/changelog; for a full advisory list, use GET /v1/packages/{registry}/{name}/vulnerabilities.
Selector catalogue
Use the following selectors with the fields query parameter to choose which fields the response includes. See Choose what the response includes for details.
| Selector | Data | Default |
|---|---|---|
package | Package description, homepage, repository URL, version count and latest-release publication timestamp. | Yes |
selected_version | Selected release publication timestamp, license, deprecation state and deprecation reason. | Yes |
package.downloads | Download counts for the last month and all time, plus the refresh timestamp. | No |
package.github_repository | Linked GitHub repository owner, name, stars, forks, subscribers, open-issue count, archive state, language, license, topics and timestamps. | No |
security | Selected-release affected flag and advisory count, plus the package-wide advisory count. | No |
security.recent_vulnerabilities | Up to five newest advisories affecting the selected release; selecting this group also includes security counts. | No |
selected_version.changelog | Exact selected-release changelog metadata and entry details. | No |
selected_version.changelog.body | Exact selected-release changelog body; selecting this group also implies changelog metadata. | No |
package.* | Bundle of package metadata, package.downloads and package.github_repository. | No |
security.* | Bundle of security counts and security.recent_vulnerabilities previews. | No |
selected_version.* | Bundle of selected-version metadata, selected_version.changelog and selected_version.changelog.body. | No |
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.
Optional session attribution: trimmed printable ASCII, at most 128 bytes. Invalid optional values are dropped; no session is created.
Path Parameters
Registry that publishes the package, such as npm or pypi. Use a lowercase identifier from the supported values.
npm, pypi, hex, crates, vcpkg, zig, nuget, maven, packagist, rubygems, go, swift Name of the package in its registry. Encode a scoped name as one path segment, for example %40scope%2Fpackage. Accepts 1–255 UTF-8 bytes without control characters; spelling and whitespace are preserved.
Query Parameters
Release to inspect: an exact published version or a constraint supported by the registry. Omit for the registry’s current release. Leading and trailing whitespace is removed; blank means omitted. Numeric Go versions gain lowercase v; other prefixed versions pass through to resolution. The normalized value allows up to 100 UTF-8 bytes without control characters. Encode a literal + as %2B, for example v2.0.0%2Bincompatible.
Response groups to include, separated by commas. Defaults to package,selected_version; an explicit selection replaces these defaults. Package identity and selected-release identity are always returned. Selecting recent vulnerabilities also includes security counts; selecting a changelog body also includes its release metadata. Unselected groups are omitted. Selected nullable fields are null when unavailable.
Use the case-sensitive selectors in the catalogue. Order and duplicate selectors do not affect the result. ASCII whitespace around selectors is ignored. The decoded value is limited to 2048 UTF-8 bytes. Empty or unknown selectors and repeated fields query parameters return 400 VALIDATION_ERROR. A group does not include nested groups unless the catalogue says so; only listed wildcard bundles are supported.
Response
Resolved package and release facts with selected optional groups.
One inspected release with selected package-wide and release-specific facts.