npm · Schema

npm Hook Event Payload

The webhook event payload delivered by npm hooks when registry changes occur. Each payload is signed with HMAC SHA-256 using the shared secret configured on the hook subscription.

PackagesJavaScriptNode.jsPackage ManagementRegistrySecurity

Properties

Name Type Description
event string The type of registry event that occurred.
name string The name of the package associated with the event.
type string The type of entity that triggered the hook subscription.
version string The version of the package associated with the event, if applicable.
hookOwner object The npm user who owns the hook subscription.
payload object Event-specific payload data containing details about what changed.
change object Details about the specific change that occurred.
time string The ISO 8601 timestamp of when the event occurred.
View JSON Schema on GitHub

JSON Schema

npm-hook-event-schema.json Raw ↑
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://npmjs.com/schemas/npm/hook-event.json",
  "title": "npm Hook Event Payload",
  "description": "The webhook event payload delivered by npm hooks when registry changes occur. Each payload is signed with HMAC SHA-256 using the shared secret configured on the hook subscription.",
  "type": "object",
  "required": ["event", "name", "type", "time"],
  "properties": {
    "event": {
      "type": "string",
      "description": "The type of registry event that occurred.",
      "enum": [
        "package:change",
        "package:publish",
        "package:unpublish",
        "package:owner",
        "package:dist-tag",
        "package:deprecate",
        "package:star"
      ]
    },
    "name": {
      "type": "string",
      "description": "The name of the package associated with the event."
    },
    "type": {
      "type": "string",
      "description": "The type of entity that triggered the hook subscription.",
      "enum": ["package", "scope", "owner"]
    },
    "version": {
      "type": "string",
      "description": "The version of the package associated with the event, if applicable."
    },
    "hookOwner": {
      "type": "object",
      "description": "The npm user who owns the hook subscription.",
      "properties": {
        "username": {
          "type": "string",
          "description": "The npm username of the hook owner."
        }
      }
    },
    "payload": {
      "type": "object",
      "description": "Event-specific payload data containing details about what changed."
    },
    "change": {
      "type": "object",
      "description": "Details about the specific change that occurred.",
      "properties": {
        "version": {
          "type": "string",
          "description": "The affected version, if applicable."
        },
        "dist-tag": {
          "type": "string",
          "description": "The affected dist-tag, if applicable."
        },
        "maintainer": {
          "type": "string",
          "description": "The affected maintainer username, if applicable."
        }
      }
    },
    "time": {
      "type": "string",
      "format": "date-time",
      "description": "The ISO 8601 timestamp of when the event occurred."
    }
  }
}

Work with this as data

Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for schemas

4 MCP tools reach this
  • find_json_schemasBrowse and filter every JSON Schema in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/npm-hook-event"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.