GitLab Packages: Composer API

openapi: 3.2.0
info:
  title: 'GitLab REST Packages: Composer API'
  description: GitLab REST API used to interact with a GitLab installation.
  termsOfService: https://handbook.gitlab.com/handbook/legal/api-terms/
  version: '19.6'
  license:
    name: CC BY-SA 4.0
    url: https://gitlab.com/gitlab-org/gitlab/-/blob/master/LICENSE
    x-gitlab-description: The license applies to the OpenAPI specification document itself. For terms governing use of the GitLab API, see the termsOfService field.
servers:
- url: https://{hostname}
  description: GitLab REST API
  variables:
    hostname:
      default: gitlab.com
      description: Your GitLab instance hostname
security:
- http: []
- oauth2: []
- apiKey: []
tags:
- name: 'Packages: Composer'
  description: 'Use this API to interact with the Composer package manager client.


    > [!warning]

    > This API is used by the Composer package manager client

    > and is generally not meant for manual consumption.


    These endpoints do not adhere to the standard API authentication methods.

    See the Composer package registry documentation

    for details on which headers and token types are supported. Undocumented authentication methods might be removed in the future.'
  x-displayName: 'Packages: Composer'
  externalDocs:
    url: https://docs.gitlab.com/api/packages/composer/
paths:
  /api/v4/group/{id}/-/packages/composer/packages:
    get:
      operationId: getApiV4GroupIdDashPackagesComposerPackages
      summary: Retrieve repository URL templates
      description: Retrieves the repository URL templates for requesting individual packages for a group.
      tags:
      - 'Packages: Composer'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
  /api/v4/group/{id}/-/packages/composer/p/{sha}:
    get:
      operationId: getApiV4GroupIdDashPackagesComposerPSha
      summary: List all packages for a group
      description: Lists all repository packages for a specified group. Composer V2 is recommended over V1.
      tags:
      - 'Packages: Composer'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: sha
        required: true
        description: Shasum of current json.
        schema:
          type: string
        in: path
        example: 673594f85a55fe3c0eb45df7bd2fa9d95a1601ab
  /api/v4/group/{id}/-/packages/composer/p2/{package_name}:
    get:
      operationId: getApiV4GroupIdDashPackagesComposerP2PackageName
      summary: Composer v2 packages p2 endpoint for a group's package versions metadata
      description: This feature was introduced in GitLab 13.1
      tags:
      - 'Packages: Composer'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: The Composer package name
        schema:
          type: string
        in: path
        example: my-composer-package
  /api/v4/group/{id}/-/packages/composer/{package_name}:
    get:
      operationId: getApiV4GroupIdDashPackagesComposerPackageName
      summary: Composer packages endpoint for a group's package versions metadata
      description: This feature was introduced in GitLab 12.1
      tags:
      - 'Packages: Composer'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: The Composer package name
        schema:
          type: string
        in: path
        example: my-composer-package
  /api/v4/projects/{id}/packages/composer:
    post:
      operationId: postApiV4ProjectsIdPackagesComposer
      summary: Create a package
      description: Creates a Composer package from a specified Git tag or branch for a project.
      tags:
      - 'Packages: Composer'
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/postApiV4ProjectsIdPackagesComposerRequest'
  /api/v4/projects/{id}/packages/composer/archives/{package_name}:
    get:
      operationId: getApiV4ProjectsIdPackagesComposerArchivesPackageName
      summary: Composer package endpoint to download a package archive
      description: This feature was introduced in GitLab 13.1
      tags:
      - 'Packages: Composer'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: sha
        required: true
        description: Shasum of current json.
        schema:
          type:
          - string
          - 'null'
        in: query
        example: 673594f85a55fe3c0eb45df7bd2fa9d95a1601ab
      - name: package_name
        required: true
        description: The Composer package name
        schema:
          type: string
        in: path
        example: my-composer-package
components:
  schemas:
    postApiV4ProjectsIdPackagesComposerRequest:
      type: object
      properties:
        branch:
          type:
          - string
          - 'null'
          description: Name of the branch to target for the package. Exactly one of `tag`, `branch` must be provided.
          example: release
        tag:
          type:
          - string
          - 'null'
          description: Name of the tag to target for the package. Exactly one of `tag`, `branch` must be provided.
          example: v1.0.0
  securitySchemes:
    http:
      type: http
      scheme: bearer
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://gitlab.com/oauth/authorize
          tokenUrl: https://gitlab.com/oauth/token
          refreshUrl: https://gitlab.com/oauth/token
          scopes:
            api: Grants complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry.
            read_api: Grants read access to the API, including all groups and projects, the container registry, and the package registry.
            read_user: Grants read-only access to your profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users.
            create_runner: Grants create access to the runners.
            manage_runner: Grants access to manage the runners.
            k8s_proxy: Grants permission to perform Kubernetes API calls using the agent for Kubernetes.
            self_rotate: Grants permission for token to rotate itself.
            mcp: Grants read-write access to remote Model Context Protocol (MCP) server for tools execution.
            mcp_orbit: Grants access to the Orbit Knowledge Graph MCP server for graph queries and schema retrieval.
    apiKey:
      type: apiKey
      name: PRIVATE-TOKEN
      in: header