Packages and registries

The npm and cargo registries your packages are published to and installed from, and the reads behind the Packages pages.

`GET /api/v1/packages`

Every claimed name in the projects the caller belongs to.

Status	Means	Body
200	Done	EstatePackagesResponse

`GET /api/v1/projects/{slug}/modules`

The modules the project publishes, with the projects that use them.

Parameter	In	Type	About
`slug`	path	string

Status	Means	Body
200	Done	ProjectModulesResponse
403	Your role does not allow this
404	No such project

`GET /api/v1/projects/{slug}/modules/{name}/notes`

Every recorded release's notes for one module, newest first. A module with no notes answers an empty list; a name the project never recorded is a 404.

Parameter	In	Type	About
`slug`	path	string
`name`	path	string

Status	Means	Body
200	Done	array of ModuleNotes
403	Your role does not allow this
404	No such project or module

`GET /api/v1/projects/{slug}/packages`

One project's Packages page: its images, its npm names, its crates, and the three urls the "How to publish" text prints.

Parameter	In	Type	About
`slug`	path	string

Status	Means	Body
200	Done	ProjectPackagesResponse
403	Your role does not allow this
404	No such project

`GET /api/v1/projects/{slug}/packages/{registry}`

One registry's names in one project.

Parameter	In	Type	About
`slug`	path	string
`registry`	path	string

Status	Means	Body
200	Done	array of PackageSummary
403	Your role does not allow this
404	No such project or registry

`GET /api/v1/projects/{slug}/packages/{registry}/{name}`

One name and every version published under it.

Parameter	In	Type
`slug`	path	string
`registry`	path	string
`name`	path	string

Status	Means	Body
200	Done	PackageDetailResponse
403	Your role does not allow this
404	No such project, registry or package

`GET /cargo/1/{name}`

The index entry of a crate with a one letter name: one line for each version.

Parameter	In	Type	About
`name`	path	string	A one character crate name

Status	Means	Body
200	The index file, one JSON object per line
304	The client already holds this file
401	No live ops token in the bare Authorization header
403	Not allowed to read this project's packages
404	No such crate

`GET /cargo/2/{name}`

The index entry of a crate with a two letter name: one line for each version.

Parameter	In	Type	About
`name`	path	string	A two character crate name

Status	Means	Body
200	The index file, one JSON object per line
304	The client already holds this file
401	No live ops token in the bare Authorization header
403	Not allowed to read this project's packages
404	No such crate

`GET /cargo/3/{first}/{name}`

The index entry of a crate with a three letter name: one line for each version.

Parameter	In	Type	About
`first`	path	string	The first character of the name
`name`	path	string	A three character crate name

Status	Means	Body
200	The index file, one JSON object per line
304	The client already holds this file
401	No live ops token in the bare Authorization header
403	Not allowed to read this project's packages
404	No such crate

`PUT /cargo/api/v1/crates/new`

Publish one version of a crate. cargo publish --registry ops sends it.

Status	Means	Body
200	Published
400	The length prefixed body or its metadata is malformed
401	No live ops token in the bare Authorization header
403	Unclaimed, or not allowed to publish
409	That version is already published
413	Larger than the body limit

`GET /cargo/api/v1/crates/{name}/{version}/download`

Download one crate version.

Parameter	In	Type	About
`name`	path	string	The crate name
`version`	path	string	The version, as published

Status	Means	Body
200	The .crate archive
401	No live ops token in the bare Authorization header
403	Not allowed to read this project's packages
404	No such crate or version

`PUT /cargo/api/v1/crates/{name}/{version}/unyank`

Undo a yank.

Parameter	In	Type	About
`name`	path	string	The crate name
`version`	path	string	The version, as published

Status	Means	Body
200	Unyanked
401	No live ops token in the bare Authorization header
403	Not allowed to publish in this project
404	No such version

`DELETE /cargo/api/v1/crates/{name}/{version}/yank`

Yank one crate version, so new lockfiles stop choosing it. Lockfiles that already name it keep working.

Parameter	In	Type	About
`name`	path	string	The crate name
`version`	path	string	The version, as published

Status	Means	Body
200	Yanked
401	No live ops token in the bare Authorization header
403	Not allowed to publish in this project
404	No such version

`GET /cargo/config.json`

Where cargo downloads crates from and publishes to. Cargo reads it first.

Status	Means	Body
200	The sparse registry's discovery document

`GET /cargo/{prefix}/{infix}/{name}`

The index entry of a crate with a name of four letters or more: one line for each version.

Parameter	In	Type	About
`prefix`	path	string	The first two characters of the name
`infix`	path	string	The next two characters of the name
`name`	path	string	A crate name of four characters or more

Status	Means	Body
200	The index file, one JSON object per line
304	The client already holds this file
401	No live ops token in the bare Authorization header
403	Not allowed to read this project's packages
404	No such crate

`GET /npm/{pkg}`

The npm package document: every version of the package and where to download it. npm and pnpm read it on install.

Parameter	In	Type	About
`pkg`	path	string	The scoped name, one percent encoded segment

Status	Means	Body
200	The packument
401	No live ops token in the Bearer header
403	Not allowed to read this project's packages
404	No such package

`PUT /npm/{pkg}`

Publish one version of an npm package. npm publish and pnpm publish send it.

Parameter	In	Type	About
`pkg`	path	string	The scoped name, one percent encoded segment

Status	Means	Body
201	Published
401	No live ops token in the Bearer header
403	Out of scope, unclaimed, or not allowed to publish
409	That version is already published
413	Larger than the body limit
422	The publish body is not one version with one tarball

`GET /npm/{pkg}/-/{file}`

Download the tarball of one npm package version.

Parameter	In	Type	About
`pkg`	path	string	The scoped name, one percent encoded segment
`file`	path	string	The filename the packument advertised

Status	Means	Body
200	The archive bytes
401	No live ops token in the Bearer header
403	Not allowed to read this project's packages
404	No such package or version

`GET /v2/token`

A short lived token for the image registry, in exchange for an ops token sent as the password. docker login and docker push ask for it.

Parameter	In	Type	About
`service`	query	string
`scope` (optional)	query	string

Status	Means	Body
200	Done	RegistryTokenResponse
400	Unknown registry service
401	The basic credential is not a live ops token
503	No issuer key is configured

Types

EstatePackagesResponse

It carries no images, because an image belongs to a service and a service belongs to one project.

Field	Type	About
`cargo`	array of PackageSummary
`npm`	array of PackageSummary

ProjectModulesResponse

Field	Type	About
`modules`	array of ModuleSummary
`version` (optional)	string or null	The tag version the list was recorded at; `null` until a `modules/` tree has published, which is also what a project that publishes no modules answers.

ModuleNotes

One release's patch notes, Markdown as the CHANGELOG.md section holds it.

Field	Type	About
`notes`	string
`version`	string

ProjectPackagesResponse

One project's Packages page: the two claimed name lists, the images derived from its builds, and the three urls the "How to publish" text prints.

Field	Type	About
`cargo`	array of PackageSummary
`cargo_index_url`	string
`images`	array of ImageRepoSummary
`npm`	array of PackageSummary
`npm_registry_url`	string	The absolute npm and cargo base urls the "How to publish" text prints.
`registry_host`	string	The registry host, "" when OPS_REGISTRY is unset.

PackageSummary

Field	Type	About
`bytes`	integer
`latest` (optional)	string or null	The newest version by published_at; `null` when the name is claimed and empty.
`name`	string
`project`	string
`published_at` (optional)	string or null
`publisher` (optional)	string or null
`registry`	string	"npm" or "cargo".
`versions`	integer
`yanked`	integer

One name and everything published under it. blob_key, shasum and the stored manifest stay out: the first is an object key nothing outside ops may address, and the other two are wire fields the packument rebuilds.

Field	Type	About
`dist_tags`	map of string	npm only; empty for a crate.
`name`	string
`project`	string
`registry`	string
`shared_with`	array of string	Empty on almost every claim, and the page prints "null" for it.
`versions`	array of PackageVersionSummary

RegistryTokenResponse

What a docker client reads. access_token duplicates token: older clients read one field, newer ones the other, and Distribution's own realm sends both.

Field	Type	About
`access_token`	string
`expires_in`	integer
`issued_at`	string
`token`	string

ModuleSummary

One module: the folder's name, the two published names it groups, its place in the framework's graph and who uses it.

Field	Type	About
`consumers`	array of ModuleConsumer
`crate_name` (optional)	string or null	`syncronet-<name>` on the cargo registry, when the module has a crate.
`description`	string
`layer_name` (optional)	string or null	The npm name, when the module has a layer.
`name`	string
`requires`	array of string	The other modules its crate depends on.

ImageRepoSummary

Field	Type	About
`commit`	string
`digest`	string	The newest digest ops pushed, "sha256:…".
`environments`	array of string	Environments currently running this digest, in environment order.
`pushed_at` (optional)	string or null
`repository`	string	"{project}/{service}", the repository name in the registry.
`service`	string
`size_bytes` (optional)	integer or null

PackageVersionSummary

Field	Type	About
`digest`	string	The archive's SHA-256, lowercase hex, no "sha256:" prefix.
`integrity` (optional)	string or null	npm only.
`published_at`	string
`publisher`	string
`size_bytes`	integer
`version`	string
`yanked`	boolean

ModuleConsumer

A project whose newest default branch build resolved one of the module's halves.

Field	Type	About
`package`	string	The published name it resolved, `syncronet-auth` or `@syncronet/nuxt-auth`.
`project`	string
`version`	string