Registry API
Packages
Create packages, publish immutable versions, manage assets, approvals, render previews and reviews.
A package is named @scope/name and owned by an organization; each package version is immutable. These operations create and update packages, add versions and assets, move a version through draft, review, published and deprecated, record version approvals and diff two versions’ asset manifests.
The render operation previews one version’s files for a provider (claude, codex, copilot or gemini). The registry runs the authoritative secret scan when a version is created.
Operations
| Request | What it does |
|---|---|
| GET /packages/ | List packages |
| POST /packages/ | Create a package |
| GET /packages/{name} | Get a package |
| PUT /packages/{name} | Update a package |
| DELETE /packages/{name} | Delete a package |
| POST /packages/{name}/versions | Create a package version |
| GET /packages/{name}/versions | List package versions |
| GET /packages/{name}/versions/{version} | Get a package version |
| DELETE /packages/{name}/versions/{version} | Delete a package version |
| GET /packages/{name}/diff | Diff two versions’ asset manifests |
| PATCH /packages/{name}/versions/{version}/publish | Publish a version |
| PATCH /packages/{name}/versions/{version}/status | Change a version’s status |
| POST /packages/{name}/versions/{version}/approve | Approve or reject a version |
| GET /packages/{name}/assets/{assetId} | Get an asset |
| PUT /packages/{name}/assets/{assetId} | Replace an asset |
| POST /packages/{name}/assets | Add an asset |
| GET /packages/{name}/versions/{version}/render | Render preview for a provider |
| POST /packages/{name}/versions/{version}/reviews | Request a review |
| GET /packages/{name}/versions/{version}/reviews/latest | Latest review of a version |
Paths come from the OpenAPI document that the API exports from its route definitions (CI fails if it is stale); this site checks its list against that file. The public registry search and package reads and the health checks work anonymously; most other operations need a signed-in session or an API key.