# npm

**Canonical:** https://apis.io/providers/npm/  
**Website:** https://www.npmjs.com/  
**APIs profiled:** 10

npm is the world's largest software registry, hosting over two million JavaScript packages for the Node.js ecosystem. Their developer platform provides APIs for searching and retrieving package metadata, managing access tokens, subscribing to registry event webhooks, and publishing packages with supply chain provenance verification.

## Kin Score — 51.3 / 100 (developing)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+0.0 from 51.3).

| Facet | Score |
|---|---|
| Discoverability | 64.8 |
| Contract Quality | 77.9 |
| Governance | 13.6 |
| Contract Governance | 13.6 |
| Operational Transparency | 39.5 |
| Developer Ergonomics | 42.9 |
| Commercial Clarity | 50.0 |
| Access Clarity | 50.0 |

## Agent readiness — 37.2 (agent-ready)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | verified |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | derived |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Freemium (free trial) · Self-serve signup — onboarding: self-serve, pricing: freemium, trial: yes (confidence: high).

## APIs (10)

- **npm Registry API** — The npm Registry API provides programmatic access to the npm package registry, the largest software registry in the world hosting over two million JavaScript packages. Developer...
- **npm Hooks API** — The npm Hooks API allows developers to subscribe to notifications about changes in the npm registry. Hooks send HTTP POST payloads to a configured URI whenever a package is chan...
- **npm CLI** — The npm CLI is the official command-line interface for the npm package manager, providing developers with tools to install, publish, and manage JavaScript packages and their dep...
- **npm Provenance** — npm Provenance provides supply chain security for JavaScript packages by establishing a verifiable link between a published package and its source code repository and build envi...
- **npm Downloads API** — Package tarball downloads.
- **npm OIDC API** — OpenID Connect token exchange for trusted publishing. Exchange OIDC identity tokens from supported CI/CD providers for short-lived npm registry access tokens.
- **npm Packages API** — Package metadata retrieval, including full packuments and version-specific documents.
- **npm Search API** — Full-text search across the npm registry with weighted scoring.
- **npm Tokens API** — Manage npm access tokens for authentication. Create, list, and delete tokens with customizable permissions and restrictions.
- **npm Trusted Publishers API** — Configure trusted publisher settings for packages to enable OIDC token exchange from CI/CD providers without long-lived npm tokens.

## Agentic access (1)

- **Npm Agentic Access** — 17 operations · 8 acting

## Security (3)

- **Npm Authentication** — http · 2 schemes
- **Npm Domain Security** — TLSv1.3 · HSTS · DNSSEC · DMARC
- **Npm Vulnerability Disclosure** — security.txt · contact published

## Plans (1)

- **Npm Plans Pricing**

## Tags

Packages, JavaScript, Node.js, Package Management, Registry, Security

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/npm/). Scores are computed from the provider's own public artifacts under a published rubric.