Receives HTTP POST payloads from the npm registry when a watched entity changes. Each delivery includes an x-npm-signature header containing an HMAC SHA-256 signature of the payload body using the shared secret configured during hook creation.
Sent when a new version of a package is published to the registry.
Content-Type: application/json
packageUnpublished
Sent when a package version is unpublished from the registry.
Content-Type: application/json
ownerChanged
Sent when the maintainers or owner of a package changes.
Content-Type: application/json
distTagChanged
Sent when a distribution tag is added, modified, or removed on a package.
Content-Type: application/json
deprecationChanged
Sent when a package version is deprecated or undeprecated.
Content-Type: application/json
starChanged
Sent when a user stars or unstars a package.
Content-Type: application/json
About AsyncAPI
The AsyncAPI specification describes event-driven APIs the way OpenAPI describes request/response APIs. A channel is the named pipe — a webhook URL, a Kafka topic, a WebSocket route, an MQTT subject — that producers and consumers publish or subscribe to. Each channel carries one or more messages with structured payloads, and an operation declares whether a given party sends or receives on that channel.
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.