List every published npm version, scored or not

GET

/api/v1/packages/{name}/versions

const url = 'https://api.pkgplease.com/api/v1/packages/example/versions?prereleases=true';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.pkgplease.com/api/v1/packages/example/versions?prereleases=true' \
  --header 'Authorization: Bearer <token>'

Merges scored versions (as returned by GET /api/v1/packages/{name}) with every version present in npm's abbreviated "install-v1" manifest (Accept: application/vnd.npm.install-v1+json), never the full packument. Each entry is flagged scored: true (full score fields included) or scored: false (name/version/versionPublishedAt only — no trust/threat/signals). npm-only for now. As a side effect, every version in the manifest is background-persisted into package_versions (does not block the response). Prerelease versions (a semver - identifier, e.g. 18.3.0-canary-e832edbf3-20240229) are excluded by default — pass prereleases=true to include them; this filter applies identically to scored and unscored entries and does not affect the background persistence.

Authorizations

orgToken

Parameters

Path Parameters

name

required

string

URL-decoded package name

Query Parameters

prereleases

string

Allowed values: true

When set to "true", includes prerelease versions in the response. Omitted or any other value excludes them (the default).

Responses

200

Array of merged scored/unscored version entries

application/json

Array<object>

object

Example^generated

[
  {}
]