One shape for every registry you depend on
The Package Registries API returns npm and PyPI package data as clean JSON.
7 active endpoints, on 1 and 2 credit tiers.
- POST/packages/v1/package
- POST/packages/v1/versions
- POST/packages/v1/version
- POST/packages/v1/dependencies
- POST/packages/v1/downloads
- POST/packages/v1/search
- POST/packages/v1/maintainer
What Package Registries endpoints does ReefAPI ship?
7 live read endpoints. Read-only data API: no writes, no account actions, no dashboard access on the target site.
Package Registries API
3 of 7 endpoints, ready to run
The package: current version, description, licence, homepage, repository, keywords, maintainers, dependencies, dist-tags, the version count and the release timeline.
{ "ok": true, "meta": { "api": "packages", "endpoint": "package", "mode": "live", "latency_ms": 542.1, "record_count": 1, "cache_hit": false }, "data": { "package": { "registry": "npm", "name": "lodash", "version": "4.18.1", "description": "Lodash modular utilities.", "license": "MIT", "homepage": "https://lodash.com/", "repository": "https://github.com/lodash/lodash.git", "keywords": [ "modules", "stdlib", "util" ], "maintainers": [ { "name": "mathias" }, { "name": "jdalton" }, { "name": "bnjmnt4n" } ], "dependencies": {}, "dev_dependencies": {}, "dist_tags": { "latest": "4.18.1" }, "version_count": 117, "time": {}, "links": { "npm": "https://www.npmjs.com/package/lodash", "registry": "https://registry.npmjs.org/lodash" } } } }
How the Package Registries API works
Package Registries is a normal ReefAPI surface — the same four rules that hold for every other engine on the key.
No OAuth app, no request signing, no per-site account. One key covers all 184 engines.
Every route is a POST with a JSON body. Parameters are validated against the published schema before anything is charged.
Credits, not seats. Failed and blocked calls are never charged, and cache hits cost nothing.
One envelope everywhere. meta carries latency_ms, record_count and the endpoint that answered.
Answering 'is this still maintained' without opening five tabs
The judgement is made from three facts: when the last release was, how many people install it, and who is allowed to publish it.
{"registry": "npm", "name": "lodash"}The release timeline and the maintainer list come back in the same response as the licence and the repository.
{"registry": "npm", "name": "lodash"}Volume with the window it covers stated, so a number can be compared against another package's number honestly.
The same request shape works across registries, so a polyglot repository does not need a different client per ecosystem.
curl -X POST https://api.reefapi.com/packages/v1/package \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"registry":"npm","name":"react"}'{
"ok": true,
"data": { … },
"meta": {
"api": "packages",
"endpoint": "package",
"mode": "live",
"latency_ms": …,
"record_count": …
},
"error": null
}The same question, answered differently by npm and PyPI
One engine covers two registries, and they genuinely differ — not in our shaping, but in what each ecosystem publishes. registry is required on every action for that reason. Values below are measured from live calls on react, express and requests.
| What you want | npm returns | PyPI returns |
|---|---|---|
| the current version | the dist-tag resolution — measured react 19.2.8 | the project version |
| release channels | dist_tags with seven channels measured on react: latest, next, canary, experimental, beta, rc, backport | no equivalent — PyPI has no tag concept |
| dependencies | four separate maps: dependencies, dev_dependencies, peer_dependencies, optional_dependencies | requires_dist[] raw strings plus a parsed map |
| dependency values | semver RANGES, not pinned versions — measured express: qs "^6.14.0", cookie "^0.7.1" | PEP 508 specifiers, environment markers included |
| downloads | a count for the period you ask for, with start and end | three fixed windows at once — measured requests: last_day 42,760,091 · last_week 396,572,056 · last_month 1,804,395,908 |
| download source | the registry's own counts | pypistats.org, named in an attribution field you should carry with the number |
| per-version extras | dist and engines | requires_dist and classifiers |
version_count on the package action tells you how deep the history goes — measured 2,920 for react — and versions pages through it. Note that published_at came back null on every measured npm version row, because the abbreviated registry document that keeps a 2,920-version response fetchable omits the release-date map. The same is why the package action's time object came back empty.
What is normalised across registries and what is not
Measured across registries on well-known packages.
Registry plus name, everywhere. The value is not that any single registry is hard to call — it is that a repository with npm, Python and other dependencies needs one client and one response shape instead of one per ecosystem.
Versions carry their publication dates, so 'last released four years ago' is a fact you already have rather than a second call. Together with the version count it is the cheapest maintenance signal there is.
Who can publish is who can compromise you. The maintainer list, the dist-tags and the publisher on each search result are returned as first-class fields rather than buried, because a change in that list is a change in your threat model.
A download figure comes with the period and the exact start and end dates it covers. Comparing a monthly figure against a weekly one is an easy mistake and the dates are what prevent it.
Fields that one registry provides and another does not come back absent rather than invented — download statistics in particular are not available everywhere, and dependency shapes differ by ecosystem. The response is normalised in structure, not padded to a lowest common denominator.
What people build with Package Registries
The jobs this data is most often used for.
endpoints
credits per call
Dependency dashboards call package and versions to track a library's releases and license.
Supply-chain tools use dependencies to map a package's full dependency tree.
Developer products use downloads and search to rank and compare packages by popularity.
What Package Registries data costs
The cheapest call here is 1 credit, so $15/mo (Pro) buys 10,000 of them — $1.50 per 1,000 credits. Credits roll over and never expire, and failed or blocked calls are not charged.
Full pricing →- 1,000 free credits on signup, no card
- One key, all 184 APIs, one credit pool
- Failed and blocked calls are never charged
- Credits roll over and never expire
Call it in two lines
Sign up, get 1,000 credits and one key that works on every engine. Then this is the whole protocol.
curl -X POST https://api.reefapi.com/packages/v1/package \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"registry":"npm","name":"react"}'import requests
r = requests.post(
"https://api.reefapi.com/packages/v1/package",
headers={"x-api-key": REEF_KEY},
json={
"registry": "npm",
"name": "react"
},
)
print(r.json()["data"])Have a question? We got answers.
The questions people actually ask before wiring up Package Registries.
Get a free key →Is the `latest` dist-tag the newest version?▾
No — it is the version npm install gives you, which is deliberately not the newest thing published. A measured react lookup returned latest 19.2.8 while the same dist_tags object carried canary at 19.3.0-canary-a1124489-20260826 and experimental at 0.0.0-experimental-a1124489-20260826, both newer builds. Seven channels came back on that one package: latest, next, canary, experimental, beta, rc and backport. If you are building an out-of-date check, compare against latest, not against the top of the versions list.
Are the dependency values actual versions I can install?▾
No, they are semver ranges exactly as the author wrote them. A measured express lookup returned qs "^6.14.0", cookie "^0.7.1" and body-parser "^2.2.1" — carets, not pins. Nothing here resolves a dependency tree or reads a lockfile, so what you get is the declared intent, not what a given install would produce. That is the right input for licence and policy checks on declared dependencies, and the wrong input for reconstructing a specific build.
A package returned an empty dependencies object. Is that a fetch failure?▾
Usually not. Measured, react returned dependencies {} and dev_dependencies {} because it genuinely ships with no runtime dependencies — while express, fetched the same way, returned 28 runtime and 16 dev dependencies. An empty map is a real answer about the package. Cross-check with the dependencies action, which returns the four maps for a specific version, before you conclude anything went wrong.
Why do download numbers come back in a different shape per registry?▾
Because the two ecosystems publish different things. For PyPI you get last_day, last_week and last_month together in one response — measured on requests as 42.8 million, 396.6 million and 1.8 billion — sourced from pypistats.org and carrying an attribution string you are expected to keep with the figure. For npm you ask for a period and get a single count with its start and end dates. Do not build one chart that mixes the two without normalizing the window first.
Why is published_at null on version rows?▾
Because the registry document being read is the abbreviated one, which omits release dates. A measured versions call on react returned 2,920 total versions with published_at null on every row, and meta reported fetch_mode "abbreviated" so the reason is visible rather than hidden. The same omission is why the package action's time object came back as {}. Version strings, ordering and the latest flag are all present and reliable; dates are the thing to get elsewhere if you need them.
How do I page through a package with thousands of versions?▾
versions takes page and page_size, and meta returns page, page_size, total, has_more and next_page. Measured on react, total came back as 2,920 — a package with that much history is not something to pull in one call, and pre-release channels dominate the top of the list. If you only want stable releases, filter the version strings yourself: anything carrying canary, experimental, beta or rc in the string is a pre-release by npm convention.
Do I need registry credentials?▾
No. Both npm and PyPI publish this metadata openly, and neither needs an account, a token, or a rate-limit deal — you use your ReefAPI key and nothing else. That is the whole point of routing it through here: one key and one response envelope across two registries that otherwise have different hosts, different auth stories and different JSON shapes.
Can I search for packages rather than look one up?▾
Yes — search takes the registry plus a query and returns name, version, description, license, a relevance score and links or maintainers per hit, with paging in meta. The score is the registry's own relevance ranking, not a quality or popularity metric, so do not present it as one. If you want popularity, take the names from search and follow up with downloads.
What is the Package Registries API?▾
Package Registries API is a ReefAPI endpoint group for package registries It returns live JSON through POST requests under /packages/v1.
Is the Package Registries API free to try?▾
Yes. ReefAPI starts with 1,000 free credits, no card required. Package Registries calls use the same shared credit balance as every other ReefAPI engine.
Do I need a Package Registries login or account?▾
No login to Package Registries is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the Package Registries data?▾
The page example is captured from a live package call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the Package Registries API use?▾
Package Registries actions currently cost 1-2 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
Can I call Package Registries from an AI assistant or MCP client?▾
Yes. Connect ReefAPI once through MCP and your assistant can call packages actions with the same key, credit pool and JSON envelope used by normal REST requests.
18 Developer Tools APIs on the same key
One key, one credit pool, one response envelope. If you are pulling Package Registries, you are one call away from the rest of the category — no second contract, no second integration.
Need something this API does not do?
Name the endpoint, the field, or a source we do not carry yet. We ship new APIs every week and you would be first to get the key. Real people read every message and reply the same day.
Try it on your own data before you pay anything
The call above is the real endpoint, not a recording. A free key gives you 1,000 credits, the other 183 APIs, and the same envelope everywhere.
Endpoints, parameters and credit costs on this page are read from the live catalog and cannot drift from what the API accepts. Field notes were captured on 2026-08-30.