GitLab Packages: NPM API

openapi: 3.2.0
info:
  title: 'GitLab REST Packages: NPM API'
  description: GitLab REST API used to interact with a GitLab installation.
  termsOfService: https://handbook.gitlab.com/handbook/legal/api-terms/
  version: '19.6'
  license:
    name: CC BY-SA 4.0
    url: https://gitlab.com/gitlab-org/gitlab/-/blob/master/LICENSE
    x-gitlab-description: The license applies to the OpenAPI specification document itself. For terms governing use of the GitLab API, see the termsOfService field.
servers:
- url: https://{hostname}
  description: GitLab REST API
  variables:
    hostname:
      default: gitlab.com
      description: Your GitLab instance hostname
security:
- http: []
- oauth2: []
- apiKey: []
tags:
- name: 'Packages: NPM'
  description: 'Use this API to interact with the npm package manager client.


    > [!warning]

    > This API is used by the npm package manager client

    > and is not meant for manual consumption.


    These endpoints do not adhere to the standard API authentication methods.

    See the npm package registry documentation

    for details on which headers and token types are supported. Undocumented authentication methods might be removed in the future.'
  x-displayName: 'Packages: NPM'
  externalDocs:
    url: https://docs.gitlab.com/api/packages/npm/
paths:
  /api/v4/projects/{id}/packages/npm/-/package/{package_name}/dist-tags:
    get:
      operationId: getApiV4ProjectsIdPackagesNpmDashPackagePackageNameDistTags
      summary: Get all tags for a given NPM package
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesNpmPackageTag'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
  /api/v4/projects/{id}/packages/npm/-/package/{package_name}/dist-tags/{tag}:
    put:
      operationId: putApiV4ProjectsIdPackagesNpmDashPackagePackageNameDistTagsTag
      summary: Create or Update the given tag for the given NPM package and version
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
      - name: tag
        required: true
        description: Package dist-tag
        schema:
          type: string
        in: path
    delete:
      operationId: deleteApiV4ProjectsIdPackagesNpmDashPackagePackageNameDistTagsTag
      summary: Deletes the given tag
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
      - name: tag
        required: true
        description: Package dist-tag
        schema:
          type: string
        in: path
  /api/v4/projects/{id}/packages/npm/-/npm/v1/security/advisories/bulk:
    post:
      operationId: postApiV4ProjectsIdPackagesNpmDashNpmV1SecurityAdvisoriesBulk
      summary: NPM registry bulk advisory endpoint
      description: This feature was introduced in GitLab 15.6
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
        '307':
          description: Temporary Redirect
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
  /api/v4/projects/{id}/packages/npm/-/npm/v1/security/audits/quick:
    post:
      operationId: postApiV4ProjectsIdPackagesNpmDashNpmV1SecurityAuditsQuick
      summary: NPM registry quick audit endpoint
      description: This feature was introduced in GitLab 15.6
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
        '307':
          description: Temporary Redirect
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
  /api/v4/projects/{id}/packages/npm/{package_name}/-/{file_name}:
    get:
      operationId: getApiV4ProjectsIdPackagesNpmPackageNameDashFileName
      summary: Download the NPM tarball
      description: This feature was introduced in GitLab 11.8
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: OK
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Name of the package.
        schema:
          type: string
        in: path
      - name: file_name
        required: true
        description: Package file name
        schema:
          type: string
        in: path
  /api/v4/projects/{id}/packages/npm/{package_name}:
    put:
      operationId: putApiV4ProjectsIdPackagesNpmPackageName
      summary: Create or deprecate an NPM package
      description: Creates or deprecates an NPM package for a specified project. Deprecate support was added in GitLab 16.0.
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Name of the package.
        schema:
          type: string
        in: path
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/putApiV4ProjectsIdPackagesNpmPackageNameRequest'
    get:
      operationId: getApiV4ProjectsIdPackagesNpmPackageName
      summary: NPM registry metadata endpoint
      description: This feature was introduced in GitLab 11.8
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesNpmPackage'
        '302':
          description: Found (redirect)
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
        example: mypackage
  /api/v4/packages/npm/-/package/{package_name}/dist-tags:
    get:
      operationId: getApiV4PackagesNpmDashPackagePackageNameDistTags
      summary: Get all tags for a given NPM package
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesNpmPackageTag'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
  /api/v4/packages/npm/-/package/{package_name}/dist-tags/{tag}:
    put:
      operationId: putApiV4PackagesNpmDashPackagePackageNameDistTagsTag
      summary: Create or Update the given tag for the given NPM package and version
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
      - name: tag
        required: true
        description: Package dist-tag
        schema:
          type: string
        in: path
    delete:
      operationId: deleteApiV4PackagesNpmDashPackagePackageNameDistTagsTag
      summary: Deletes the given tag
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
      - name: tag
        required: true
        description: Package dist-tag
        schema:
          type: string
        in: path
  /api/v4/packages/npm/-/npm/v1/security/advisories/bulk:
    post:
      operationId: postApiV4PackagesNpmDashNpmV1SecurityAdvisoriesBulk
      summary: NPM registry bulk advisory endpoint
      description: This feature was introduced in GitLab 15.6
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
        '307':
          description: Temporary Redirect
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
  /api/v4/packages/npm/-/npm/v1/security/audits/quick:
    post:
      operationId: postApiV4PackagesNpmDashNpmV1SecurityAuditsQuick
      summary: NPM registry quick audit endpoint
      description: This feature was introduced in GitLab 15.6
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
        '307':
          description: Temporary Redirect
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
  /api/v4/packages/npm/{package_name}:
    get:
      operationId: getApiV4PackagesNpmPackageName
      summary: NPM registry metadata endpoint
      description: This feature was introduced in GitLab 11.8
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesNpmPackage'
        '302':
          description: Found (redirect)
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
        example: mypackage
  /api/v4/groups/{id}/-/packages/npm/-/package/{package_name}/dist-tags:
    get:
      operationId: getApiV4GroupsIdDashPackagesNpmDashPackagePackageNameDistTags
      summary: Get all tags for a given NPM package
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesNpmPackageTag'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
  /api/v4/groups/{id}/-/packages/npm/-/package/{package_name}/dist-tags/{tag}:
    put:
      operationId: putApiV4GroupsIdDashPackagesNpmDashPackagePackageNameDistTagsTag
      summary: Create or Update the given tag for the given NPM package and version
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
      - name: tag
        required: true
        description: Package dist-tag
        schema:
          type: string
        in: path
    delete:
      operationId: deleteApiV4GroupsIdDashPackagesNpmDashPackagePackageNameDistTagsTag
      summary: Deletes the given tag
      description: This feature was introduced in GitLab 12.7
      tags:
      - 'Packages: NPM'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
      - name: tag
        required: true
        description: Package dist-tag
        schema:
          type: string
        in: path
  /api/v4/groups/{id}/-/packages/npm/-/npm/v1/security/advisories/bulk:
    post:
      operationId: postApiV4GroupsIdDashPackagesNpmDashNpmV1SecurityAdvisoriesBulk
      summary: NPM registry bulk advisory endpoint
      description: This feature was introduced in GitLab 15.6
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
        '307':
          description: Temporary Redirect
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
  /api/v4/groups/{id}/-/packages/npm/-/npm/v1/security/audits/quick:
    post:
      operationId: postApiV4GroupsIdDashPackagesNpmDashNpmV1SecurityAuditsQuick
      summary: NPM registry quick audit endpoint
      description: This feature was introduced in GitLab 15.6
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
        '307':
          description: Temporary Redirect
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
  /api/v4/groups/{id}/-/packages/npm/{package_name}:
    get:
      operationId: getApiV4GroupsIdDashPackagesNpmPackageName
      summary: NPM registry metadata endpoint
      description: This feature was introduced in GitLab 11.8
      tags:
      - 'Packages: NPM'
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesNpmPackage'
        '302':
          description: Found (redirect)
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: Package name
        schema:
          type: string
        in: path
        example: mypackage
components:
  schemas:
    APIEntitiesNpmPackage:
      type: object
      properties:
        name:
          type: string
          example: my_package
        versions:
          type: object
          example:
            1.0.0:
              name: my_package
              version: 1.0.0
              dist:
                shasum: '12345'
                tarball: https://...
        dist-tags:
          type: object
          example:
            latest: 1.0.1
    APIEntitiesNpmPackageTag:
      type: object
      properties:
        dist_tags:
          type: object
          example:
            latest: 1.0.1
    putApiV4ProjectsIdPackagesNpmPackageNameRequest:
      type: object
      properties:
        file:
          type:
          - string
          - 'null'
          format: binary
          description: The package file to be published (generated by Multipart middleware)
      required:
      - file
  securitySchemes:
    http:
      type: http
      scheme: bearer
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://gitlab.com/oauth/authorize
          tokenUrl: https://gitlab.com/oauth/token
          refreshUrl: https://gitlab.com/oauth/token
          scopes:
            api: Grants complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry.
            read_api: Grants read access to the API, including all groups and projects, the container registry, and the package registry.
            read_user: Grants read-only access to your profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users.
            create_runner: Grants create access to the runners.
            manage_runner: Grants access to manage the runners.
            k8s_proxy: Grants permission to perform Kubernetes API calls using the agent for Kubernetes.
            self_rotate: Grants permission for token to rotate itself.
            mcp: Grants read-write access to remote Model Context Protocol (MCP) server for tools execution.
            mcp_orbit: Grants access to the Orbit Knowledge Graph MCP server for graph queries and schema retrieval.
    apiKey:
      type: apiKey
      name: PRIVATE-TOKEN
      in: header