npm

npm Team API

The Team API from npm — 3 operation(s) for team.

Documentation GitHub OpenAPI

Operations 5

PUT /-/org/{orgName}/team Create a new team #

DELETE /-/org/{orgName}/{teamName} Delete a team #

GET /-/org/{orgName}/{teamName}/user Get all users in a team #

PUT /-/org/{orgName}/{teamName}/user Add a user to a team #

DELETE /-/org/{orgName}/{teamName}/user Remove a user from a team #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/npm:npm-team-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Npm Team API
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  x-logo:
    url: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAACyCAYAAAC0oD1PAAAAAXNSR0IArs4c6QAAAJZlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgExAAIAAAARAAAAWodpAAQAAAABAAAAbAAAAAAAAABIAAAAAQAAAEgAAAABQWRvYmUgSW1hZ2VSZWFkeQAAAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAfSgAwAEAAAAAQAAALIAAAAA7l/aDAAAAAlwSFlzAAALEwAACxMBAJqcGAAAAi1pVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDYuMC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIgogICAgICAgICAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDx4bXA6Q3JlYXRvclRvb2w+QWRvYmUgSW1hZ2VSZWFkeTwveG1wOkNyZWF0b3JUb29sPgogICAgICAgICA8dGlmZjpZUmVzb2x1dGlvbj43MjwvdGlmZjpZUmVzb2x1dGlvbj4KICAgICAgICAgPHRpZmY6T3JpZW50YXRpb24+MTwvdGlmZjpPcmllbnRhdGlvbj4KICAgICAgICAgPHRpZmY6WFJlc29sdXRpb24+NzI8L3RpZmY6WFJlc29sdXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgpg60/ZAAALcklEQVR4Ae3aQYscxxkG4KqZkWwdrENAEIOJraDYSjAk4JCjLZ1MkkuOueToW/5CSH6Hz/kJIfgUy7rkllscC9ZrxTn4YJBPQavdmal0B4ORWtCrpmqravYZMGjbXfV9/XzT/c5oFYIXAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgUEEgVqhZveQnN99K1Zu45A2sYwy7FI7+u96+/aujoyc5OO7dfPODa3H94Una59jOHgsExgdKimEbt7ufvvvl0acLtpgs+fiNH/1sFVf/GPaObtwJjwMLBN774sFBZt9qgYUlBAgQIECAQGMCAr2xgWiHAAECBAgsERDoS9SsIUCAAAECjQkI9MYGoh0CBAgQILBEQKAvUbOGAAECBAg0JiDQGxuIdggQIECAwBIBgb5EzRoCBAgQINCYgEBvbCDaIUCAAAECSwQE+hI1awgQIECAQGMCAr2xgWiHAAECBAgsERDoS9SsIUCAAAECjQkI9MYGoh0CBAgQILBEQKAvUbOGAAECBAg0JiDQGxuIdggQIECAwBIBgb5EzRoCBAgQINCYgEBvbCDaIUCAAAECSwQE+hI1awgQIECAQGMCAr2xgWiHAAECBAgsERDoS9SsIUCAAAECjQkI9MYGoh0CBAgQILBEQKAvUbOGAAECBAg0JiDQGxuIdggQIECAwBKBzZJF1tQXGD+JrWMs2sg2pZCKVrD5swLjRDeF57ob5rp/trCfiwuMcy15x44zHWdb8jU+c0p+Cxy7H587XssEBPoyt6qrxhtquHkf7UN6WLKR4eFza/jvuturpPJ3e48P+8H65CyFf4VY9Kn26vAeelWof2d/AX9KZ2H/6RDpT4rVSvH6eM+Wul/H587wgeHhLoZH5a4hbIZPPT8ZbgTZtAAZ2gK02kuuxlV4nPZ/vXP84Hcle7l/862PrsT4/mnRbCl5BX3tPX772YZwvD/+/i/uhnvDH8u8Pvnh7T+9FOMfH+9Fehnhp3f99oPaaYq739z5/POjp/9vvp/+9sbt919exY/OCt2v43PnSdr/4d3jB3/O1/XTO92/detG2q0/Gz48fM+782mb8/w0fujyIkCgIYGvw41SX7IausrL18rVGIvOdR37/w3ZbrUqanTo7zqBfugTdn3dCdwIX49f6rwOTGD4m66ic92lor+iv5BprPf7okYXchEViwj0ivhKEyBAgACBXAICPZekfQgQIECAQEUBgV4RX2kCBAgQIJBLQKDnkrQPAQIECBCoKCDQK+IrTYAAAQIEcgkI9FyS9iFAgAABAhUFBHpFfKUJECBAgEAuAYGeS9I+BAgQIECgooBAr4ivNAECBAgQyCUg0HNJ2ocAAQIECFQUEOgV8ZUmQIAAAQK5BAR6Lkn7ECBAgACBigICvSK+0gQIECBAIJeAQM8laR8CBAgQIFBRQKBXxFeaAAECBAjkEhDouSTtQ4AAAQIEKgoI9Ir4ShMgQIAAgVwCAj2XpH0IECBAgEBFAYFeEV9pAgQIECCQS0Cg55K0DwECBAgQqCgg0CviK02AAAECBHIJCPRckvYhQIAAAQIVBQR6RXylCRAgQIBALgGBnkvSPgQIECBAoKKAQK+IrzQBAgQIEMglINBzSdqHAAECBAhUFBDoFfGVJkCAAAECuQQEei5J+xAgQIAAgYoCAr0ivtIECBAgQCCXgEDPJWkfAgQIECBQUUCgV8RXmgABAgQI5BIQ6Lkk7UOAAAECBCoKCPSK+EoTIECAAIFcAgI9l6R9CBAgQIBARQGBXhFfaQIECBAgkEtAoOeStA8BAgQIEKgoINAr4itNgAABAgRyCQj0XJL2IUCAAAECFQUEekV8pQkQIECAQC4BgZ5L0j4ECBAgQKCigECviK80AQIECBDIJSDQc0nahwABAgQIVBQQ6BXxlSZAgAABArkEBHouSfsQIECAAIGKAgK9Ir7SBJ4VSCGku+He9tnjWX9Oqez+WZu1GQEC5xXYnPdE5xEgUFZgCPMQU3jl/us//vUu7nfFqsVwe5fGal4ECBySgEA/pGm6lq4FxpCNIfxgsw5/2Yx/KvTaD1l+GgR6IV7bEqgmINCr0StMYCowxuyZb89TGEcIEJgV8Dv0WSInECBAgACB9gUEevsz0iEBAgQIEJgVEOizRE4gQIAAAQLtCwj09mekQwIECBAgMCsg0GeJnECAAAECBNoXEOjtz0iHBAgQIEBgVkCgzxI5gQABAgQItC8g0NufkQ4JECBAgMCsgECfJXICAQIECBBoX0Cgtz8jHRIgQIAAgVkBgT5L5AQCBAgQINC+gEBvf0Y6JECAAAECswICfZbICQQIECBAoH0Bgd7+jHRIgAABAgRmBQT6LJETCBAgQIBA+wICvf0Z6ZAAAQIECMwKCPRZIicQIECAAIH2BQR6+zPSIQECBAgQmBUQ6LNETiBAgAABAu0LCPT2Z6RDAgQIECAwK7CZPeMAT4idX9NF9Z9CiGOtEvXGPVNKJbbufLplvC8KpeBc//9evKjryFnn2zf5hbzXxyKlCpXa9znWxZ47z6l1UIcuZaAPQdX166L6H27gNNYqUW/cM8ZYYuuuZzs23z1KmbmO78Vu3zBD7xcy1rFIqUKl9n3ODVvsufOcWgd16FIGetyv3ul5ivsrw027jY9KX8Nutf39lXj1ejzL/9l8vIb1aXzyyy+OTktfRy/7r4fvJbuUjtM2/Xa1Wu966Xva51ka3jvH0+PLjry0ffxgu37l5+Pq/O/EZT29+Kqz9Hgd//Pi686/4mSz/fu1cOWdEvfr2MV4z25ONg/P39GLn7l77bVv1v/+6m7arzb9zvrFrzvXCma5JO1TXeDezTc/uBbXH56kffVeljSwGQL9LIR/3jn+7O0l660hQOByC/hHcZd7/q6+MYHhE3b8ONy5lH9z1tgotEOgOwGB3t3INEyAAAECBKYCAn1q4ggBAgQIEOhOQKB3NzINEyBAgACBqYBAn5o4QoAAAQIEuhMQ6N2NTMMECBAgQGAqINCnJo4QIECAAIHuBAR6dyPTMAECBAgQmAoI9KmJIwQIECBAoDsBgd7dyDRMgAABAgSmAgJ9auIIAQIECBDoTkCgdzcyDRMgQIAAgamAQJ+aOEKAAAECBLoTEOjdjUzDBAgQIEBgKiDQpyaOECBAgACB7gQEencj0zABAgQIEJgKCPSpiSMECBAgQKA7AYHe3cg0TIAAAQIEpgICfWriCAECBAgQ6E5AoHc3Mg0TIECAAIGpgECfmjhCgAABAgS6ExDo3Y1MwwQIECBAYCog0KcmjhAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECByYwP8ABJX2MCfo+K4AAAAASUVORK5CYII=

      '
    altText: npm logo
  x-refined-note:
  - x-source differs across the merged source definitions and was not carried
  description: 'Operations tagged Team across 2 of this provider''s published API definitions: npm-registry-reference-openapi.json, npm-registry-reference-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://registry.npmjs.org
tags:
- name: Team
paths:
  /-/org/{orgName}/team:
    parameters:
    - $ref: '#/components/parameters/OrgName'
    - $ref: '#/components/parameters/RequiredBearerToken'
    put:
      tags:
      - Team
      summary: Create a new team
      description: 'Create a new team for an org.


        Granular Access Tokens with `bypass_2fa: true` are not permitted to

        call this endpoint and receive `403 Forbidden`. This operation must

        be performed via an interactive 2FA challenge.'
      operationId: putScopeTeam
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: The name of the team to create
                description:
                  type: string
                  description: The description of the team to create
              example:
                name: wombats
                description: All developers
      security:
      - npmSessionToken: []
      - npmAccessToken: []
      - granularAccessToken: []
      responses:
        '201':
          description: Team was created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  name:
                    type: string
                    description: The name of the team that was created
                example:
                  name: wombats
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden2FABypassGAT'
    servers:
    - url: https://registry.npmjs.org
  /-/org/{orgName}/{teamName}:
    parameters:
    - $ref: '#/components/parameters/OrgName'
    - $ref: '#/components/parameters/TeamName'
    - $ref: '#/components/parameters/RequiredBearerToken'
    delete:
      tags:
      - Team
      summary: Delete a team
      description: 'Delete a team from a given org.


        Granular Access Tokens with `bypass_2fa: true` are not permitted to

        call this endpoint and receive `403 Forbidden`. This operation must

        be performed via an interactive 2FA challenge.'
      operationId: deleteTeam
      security:
      - npmSessionToken: []
      - npmAccessToken: []
      - granularAccessToken: []
      responses:
        '204':
          $ref: '#/components/responses/EmptySuccess'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden2FABypassGAT'
    servers:
    - url: https://registry.npmjs.org
  /-/org/{orgName}/{teamName}/user:
    parameters:
    - $ref: '#/components/parameters/OrgName'
    - $ref: '#/components/parameters/TeamName'
    - $ref: '#/components/parameters/RequiredBearerToken'
    get:
      tags:
      - Team
      summary: Get all users in a team
      operationId: getTeamMembership
      security:
      - npmSessionToken: []
      responses:
        '200':
          $ref: '#/components/responses/TeamUsers'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
    put:
      tags:
      - Team
      summary: Add a user to a team
      description: 'Add a user to a team in an org. The user must already be a member of the org.


        Granular Access Tokens with `bypass_2fa: true` are not permitted to

        call this endpoint and receive `403 Forbidden`. This operation must

        be performed via an interactive 2FA challenge.'
      operationId: createTeamMembership
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                user:
                  type: string
                  description: The username of the user to add to the team
              example:
                user: npm-cli-bot
      security:
      - npmSessionToken: []
      - npmAccessToken: []
      - granularAccessToken: []
      responses:
        '201':
          $ref: '#/components/responses/EmptySuccess'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden2FABypassGAT'
    delete:
      tags:
      - Team
      summary: Remove a user from a team
      description: 'Remove a user from a team.


        Granular Access Tokens with `bypass_2fa: true` are not permitted to

        call this endpoint and receive `403 Forbidden`. This operation must

        be performed via an interactive 2FA challenge.'
      operationId: deleteTeamMembership
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                user:
                  type: string
                  description: The username of the user to remove from the team
              example:
                user: npm-cli-bot
      security:
      - npmSessionToken: []
      - npmAccessToken: []
      - granularAccessToken: []
      responses:
        '204':
          $ref: '#/components/responses/EmptySuccess'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden2FABypassGAT'
    servers:
    - url: https://registry.npmjs.org
components:
  parameters:
    OrgName:
      name: orgName
      in: path
      required: true
      schema:
        type: string
      description: Name of an org
    RequiredBearerToken:
      name: Authorization
      in: header
      required: true
      schema:
        type: string
        pattern: ^Bearer .+
      description: 'Bearer token for authentication. Must be an npm access token.


        **Format:** `Bearer <token>`


        **Accepted token types:**

        - npm access token (traditional user token created via `npm login`)

        '
    TeamName:
      name: teamName
      in: path
      required: true
      schema:
        type: string
      description: Name of a team
  responses:
    Forbidden2FABypassGAT:
      description: 'Forbidden: bypass-2FA GAT not permitted for account or governance writes'
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                description: Error message
          example:
            error: 'Granular access tokens that bypass two-factor authentication may not perform this action. For more info, visit: https://gh.io/npm-gat-bypass2fa-deprecation'
    TeamUsers:
      description: The users in a team
      content:
        application/json:
          schema:
            type: array
            items:
              type: string
              description: A username of a user in the team
            example:
            - npm
            - npm-cli-bot
    responses-Unauthorized:
      description: Unauthorized
      headers:
        www-authenticate:
          description: Authentication challenge (e.g., "OTP" when OTP is required)
          schema:
            type: string
        npm-notice:
          description: Additional notice information
          schema:
            type: string
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
                description: Error message
          example:
            error: Missing "Bearer" header.
    EmptySuccess:
      description: Success
      content:
        '*/*':
          schema:
            not: {}
  securitySchemes:
    oidcIdToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'OIDC id_token from a supported Identity Provider (IdP) such as GitHub Actions, GitLab CI, or CircleCI.

        The `aud` (audience) claim must be set to `npm:registry.npmjs.org`.


        **Supported Identity Providers:**

        - GitHub Actions

        - GitLab CI

        - CircleCI

        '
    npmSessionToken:
      type: http
      scheme: bearer
      description: 'Traditional npm session token created via `npm login`.

        These tokens are tied to a user account and inherit the user''s permissions.

        '
    npmAccessToken:
      type: http
      scheme: bearer
      description: 'Granular Access Token (GAT) with fine-grained permissions.

        These tokens can be scoped to specific packages and operations.


        GATs created with `bypass_2fa: true` cannot perform account,

        token, or org/team/package governance write operations — those

        requests are rejected with `403 Forbidden`. See the Authentication

        section above for the full list.

        '
    granularAccessToken:
      type: http
      scheme: bearer
      description: 'Granular Access Token (GAT) with fine-grained permissions.

        These tokens can be scoped to specific packages and operations.

        (Alias for npmAccessToken)


        GATs created with `bypass_2fa: true` cannot perform account,

        token, or org/team/package governance write operations — those

        requests are rejected with `403 Forbidden`.

        '
    oidcExchangeToken:
      type: http
      scheme: bearer
      description: 'Short-lived npm registry token obtained by exchanging an OIDC id_token

        via the `/oidc/token/exchange` endpoint. These tokens are package-scoped

        and have limited lifetime (typically 1 hour).

        '
x-refined-from:
- npm-registry-reference-openapi.json
- npm-registry-reference-openapi.yml