GitLab Packages: PyPi API

openapi: 3.2.0
info:
  title: 'GitLab REST Packages: PyPi API'
  description: GitLab REST API used to interact with a GitLab installation.
  termsOfService: https://handbook.gitlab.com/handbook/legal/api-terms/
  version: '19.6'
  license:
    name: CC BY-SA 4.0
    url: https://gitlab.com/gitlab-org/gitlab/-/blob/master/LICENSE
    x-gitlab-description: The license applies to the OpenAPI specification document itself. For terms governing use of the GitLab API, see the termsOfService field.
servers:
- url: https://{hostname}
  description: GitLab REST API
  variables:
    hostname:
      default: gitlab.com
      description: Your GitLab instance hostname
security:
- http: []
- oauth2: []
- apiKey: []
tags:
- name: 'Packages: PyPi'
  description: 'Use this API to interact with the PyPI package manager client.


    > [!warning]

    > This API is used by the PyPI package manager client

    > and is generally not meant for manual consumption.


    These endpoints do not adhere to the standard API authentication methods.

    See the PyPI package registry documentation

    for details on which headers and token types are supported. Undocumented authentication methods might be removed in the future.


    > [!note]

    > Twine 3.4.2 or greater

    > is recommended when FIPS mode is enabled.'
  x-displayName: 'Packages: PyPi'
  externalDocs:
    url: https://docs.gitlab.com/api/packages/pypi/
paths:
  /api/v4/groups/{id}/-/packages/pypi/files/{sha256}/{file_identifier}:
    get:
      operationId: getApiV4GroupsIdDashPackagesPypiFilesSha256FileIdentifier
      summary: Download a package file from a group
      description: This feature was introduced in GitLab 13.12
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: integer
          - type: string
        in: path
      - name: file_identifier
        required: true
        description: The PyPi package file identifier
        schema:
          type: string
        in: path
        example: my.pypi.package-0.0.1.tar.gz
      - name: sha256
        required: true
        description: The PyPi package sha256 check sum
        schema:
          type: string
        in: path
        example: 5y57017232013c8ac80647f4ca153k3726f6cba62d055cd747844ed95b3c65ff
  /api/v4/groups/{id}/-/packages/pypi/simple:
    get:
      operationId: getApiV4GroupsIdDashPackagesPypiSimple
      summary: List all packages for a group
      description: Lists all packages for a specified group in an HTML file.
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: integer
          - type: string
        in: path
  /api/v4/groups/{id}/-/packages/pypi/simple/{package_name}:
    get:
      operationId: getApiV4GroupsIdDashPackagesPypiSimplePackageName
      summary: The PyPi Simple Group Package Endpoint
      description: This feature was introduced in GitLab 12.10
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the group.
        schema:
          oneOf:
          - type: integer
          - type: string
        in: path
      - name: package_name
        required: true
        description: The PyPi package name
        schema:
          type: string
        in: path
        example: my.pypi.package
  /api/v4/projects/{id}/packages/pypi/files/{sha256}/{file_identifier}:
    get:
      operationId: getApiV4ProjectsIdPackagesPypiFilesSha256FileIdentifier
      summary: The PyPi package download endpoint
      description: This feature was introduced in GitLab 12.10
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: file_identifier
        required: true
        description: The PyPi package file identifier
        schema:
          type: string
        in: path
        example: my.pypi.package-0.0.1.tar.gz
      - name: sha256
        required: true
        description: The PyPi package sha256 check sum
        schema:
          type: string
        in: path
        example: 5y57017232013c8ac80647f4ca153k3726f6cba62d055cd747844ed95b3c65ff
  /api/v4/projects/{id}/packages/pypi/forward/{package_name}/{upstream_path}:
    get:
      operationId: getApiV4ProjectsIdPackagesPypiForwardPackageNameUpstreamPath
      summary: Download a forwarded (proxied) PyPI package file
      description: Enforces the Dependency Firewall then redirects to the upstream artifact.
      tags:
      - 'Packages: PyPi'
      responses:
        '302':
          description: Found
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: The normalized PyPI package name
        schema:
          type: string
        in: path
        example: my.pypi.package
      - name: upstream_path
        required: true
        description: The upstream artifact host and path, as emitted by the Simple index rewrite
        schema:
          type: string
        in: path
  /api/v4/projects/{id}/packages/pypi/simple:
    get:
      operationId: getApiV4ProjectsIdPackagesPypiSimple
      summary: List all packages for a project
      description: Lists all packages for a specified project in an HTML file.
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
  /api/v4/projects/{id}/packages/pypi/simple/{package_name}:
    get:
      operationId: getApiV4ProjectsIdPackagesPypiSimplePackageName
      summary: The PyPi Simple Project Package Endpoint
      description: This feature was introduced in GitLab 12.10
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      - name: package_name
        required: true
        description: The PyPi package name
        schema:
          type: string
        in: path
        example: my.pypi.package
  /api/v4/projects/{id}/packages/pypi:
    post:
      operationId: postApiV4ProjectsIdPackagesPypi
      summary: Upload a package
      description: Uploads a PyPI package for a specified project.
      tags:
      - 'Packages: PyPi'
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '422':
          description: Unprocessable Entity
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/postApiV4ProjectsIdPackagesPypiRequest'
  /api/v4/projects/{id}/packages/pypi/authorize:
    post:
      operationId: postApiV4ProjectsIdPackagesPypiAuthorize
      summary: Authorize the PyPi package upload from workhorse
      description: This feature was introduced in GitLab 12.10
      tags:
      - 'Packages: PyPi'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
components:
  schemas:
    postApiV4ProjectsIdPackagesPypiRequest:
      type: object
      properties:
        content:
          type:
          - string
          - 'null'
          format: binary
          description: The package file to be published (generated by Multipart middleware)
        name:
          type:
          - string
          - 'null'
          description: Name of the package
          example: my.pypi.package
        requires_python:
          type:
          - string
          - 'null'
          description: PyPI version required for the package
          example: '>=3.7'
        md5_digest:
          type:
          - string
          - 'null'
          description: MD5 checksum of the package
          example: 900150983cd24fb0d6963f7d28e17f72
        sha256_digest:
          type:
          - string
          - 'null'
          description: SHA256 checksum of the package
          example: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
          pattern: (?:^[0-9A-Fa-f]{64}$)
        metadata_version:
          type:
          - string
          - 'null'
          description: Metadata version of the package
          example: '2.3'
        author_email:
          type:
          - string
          - 'null'
          description: Email address for the package author
          example: cschultz@example.com, snoopy@peanuts.com
        description:
          type:
          - string
          - 'null'
          description: Description of the package
        description_content_type:
          type:
          - string
          - 'null'
          description: Type of content for the package description
          example: text/markdown; charset=UTF-8; variant=GFM
        summary:
          type:
          - string
          - 'null'
          description: Short summary of the package
          example: A module for collecting votes from beagles.
        keywords:
          type:
          - string
          - 'null'
          description: Keywords listed for the package
          example: dog,puppy,voting,election
      required:
      - content
      - name
  securitySchemes:
    http:
      type: http
      scheme: bearer
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://gitlab.com/oauth/authorize
          tokenUrl: https://gitlab.com/oauth/token
          refreshUrl: https://gitlab.com/oauth/token
          scopes:
            api: Grants complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry.
            read_api: Grants read access to the API, including all groups and projects, the container registry, and the package registry.
            read_user: Grants read-only access to your profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users.
            create_runner: Grants create access to the runners.
            manage_runner: Grants access to manage the runners.
            k8s_proxy: Grants permission to perform Kubernetes API calls using the agent for Kubernetes.
            self_rotate: Grants permission for token to rotate itself.
            mcp: Grants read-write access to remote Model Context Protocol (MCP) server for tools execution.
            mcp_orbit: Grants access to the Orbit Knowledge Graph MCP server for graph queries and schema retrieval.
    apiKey:
      type: apiKey
      name: PRIVATE-TOKEN
      in: header