npm API

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

This is the API documentation for npm Packages.

This API is used by the npm package manager client and is not meant for manual consumption.

For instructions on how to upload and install npm packages from the GitLab Package Registry, see the npm package registry documentation.

These endpoints do not adhere to the standard API authentication methods. See the npm package registry documentation for details on which headers and token types are supported. Undocumented authentication methods might be removed in the future.

Download a package

Downloads the npm package. This URL is provided by the metadata endpoint.

GET projects/:id/packages/npm/:package_name/-/:file_name
AttributeTypeRequiredDescription
idstringyesThe ID or full path of the project.
package_namestringyesThe name of the package.
file_namestringyesThe name of the package file.
curl --header "Authorization: Bearer <personal_access_token>" "https://gitlab.example.com/api/v4/projects/1/packages/npm/@myscope/my-pkg/-/@my-scope/my-pkg-0.0.1.tgz"

Write the output to a file:

curl --header "Authorization: Bearer <personal_access_token>" "https://gitlab.example.com/api/v4/projects/1/packages/npm/@myscope/my-pkg/-/@my-scope/my-pkg-0.0.1.tgz" >> @myscope/my-pkg-0.0.1.tgz

This writes the downloaded file to @myscope/my-pkg-0.0.1.tgz in the current directory.

Upload a package file

Upload a package.

PUT projects/:id/packages/npm/:package_name
AttributeTypeRequiredDescription
idstringyesThe ID or full path of the project.
package_namestringyesThe name of the package.
versionsstringyesPackage version information.
curl --request PUT
     --header "Content-Type: application/json"
     --data @./path/to/metadata/file.json
     --header "Authorization: Bearer <personal_access_token>" \
     "https://gitlab.example.com/api/v4/projects/1/packages/npm/@myscope%2fmy-pkg"

The metadata file content is generated by npm, but looks something like this:

{
    "_attachments": {
        "@myscope/my-pkg-1.3.7.tgz": {
            "content_type": "application/octet-stream",
            "data": "H4sIAAAAAAAAE+1TQUvDMBjdeb/iI4edZEldV2dPwhARPIjiyXlI26zN1iYhSeeK7L+bNJtednMg4l4OKe+9PF7DF0XzNS0ZVmEfr4wUgxODEJLEMRzjPRJyCYPJNCFRlCTE+dzH1PvJqYscQ2ss1a7KT3PCv8DX/kfwMQRAgjYMpYBuIoIzKtwy6MILG6YNl8Jr0XgyvgpswUyuubJ75TGMDuSaUcsKyDooa1C6De6G8t7GRcG2br4CGxKME3wDR1hmrLexvJKwQLdaS52CkOAFMIrlfMlZsUAwGgHbcgsRcid3fdqade9SFz7u9a1naGsrqX3gHbcPNINDyydWcmN1By+W19x2oU7NcyZMfwn3z/PAqTaruanmUix5+V3UXVKq9yEoRZW1yqQYl9zWNBvnssFUcbyJsdJyxXJrcHQdz8gsTg6PzGChGty3H+6Gvz0BZ5xxxn/FJ1EDRNIACAAA",
            "length": 354
        }
    },
    "_id": "@myscope/my-pkg",
    "description": "Package created by me",
    "dist-tags": {
        "latest": "1.3.7"
    },
    "name": "@myscope/my-pkg",
    "readme": "ERROR: No README data found!",
    "versions": {
        "1.3.7": {
            "_id": "@myscope/my-pkg@1.3.7",
            "_nodeVersion": "12.18.4",
            "_npmVersion": "6.14.6",
            "author": {
                "name": "GitLab Package Registry Utility"
            },
            "description": "Package created by me",
            "dist": {
                "integrity": "sha512-loy16p+Dtw2S43lBmD3Nye+t+Vwv7Tbhv143UN2mwcjaHJyBfGZdNCTXnma3gJCUSE/AR4FPGWEyCOOTJ+ev9g==",
                "shasum": "4a9dbd94ca6093feda03d909f3d7e6bd89d9d4bf",
                "tarball": "https://gitlab.example.com/api/v4/projects/1/packages/npm/@myscope/my-pkg/-/@myscope/my-pkg-1.3.7.tgz"
            },
            "keywords": [],
            "license": "ISC",
            "main": "index.js",
            "name": "@myscope/my-pkg",
            "publishConfig": {
                "@myscope:registry": "https://gitlab.example.com/api/v4/projects/1/packages/npm"
            },
            "readme": "ERROR: No README data found!",
            "scripts": {
                "test": "echo \"Error: no test specified\" && exit 1"
            },
            "version": "1.3.7"
        }
    }
}

Route prefix

For the remaining routes, there are two sets of identical routes that each make requests in different scopes:

  • Use the instance-level prefix to make requests in the scope of the entire instance.
  • Use the project-level prefix to make requests in a single project’s scope.
  • Use the group-level prefix to make requests in a group’s scope.

The examples in this document all use the project-level prefix.

Instance-level

/packages/npm
AttributeTypeRequiredDescription
idstringyesThe group ID or full group path.

Project-level

/projects/:id/packages/npm
AttributeTypeRequiredDescription
idstringyesThe project ID or full project path.

Group-level

History 
/groups/:id/-/packages/npm
AttributeTypeRequiredDescription
idstringyesThe group ID or full group path.

Metadata

Returns the metadata for a given package.

GET <route-prefix>/:package_name
AttributeTypeRequiredDescription
package_namestringyesThe name of the package.
curl --header "Authorization: Bearer <personal_access_token>" "https://gitlab.example.com/api/v4/projects/1/packages/npm/@myscope/my-pkg"

Example response:

{
  "name": "@myscope/my-pkg",
  "versions": {
    "0.0.2": {
      "name": "@myscope/my-pkg",
      "version": "0.0.1",
      "dist": {
        "shasum": "93abb605b1110c0e3cca0a5b805e5cb01ac4ca9b",
        "tarball": "https://gitlab.example.com/api/v4/projects/1/packages/npm/@myscope/my-pkg/-/@myscope/my-pkg-0.0.1.tgz"
      }
    }
  },
  "dist-tags": {
    "latest": "0.0.1"
  }
}

The URLs in the response have the same route prefix used to request them. If you request them with the instance-level route, the returned URLs contain /api/v4/packages/npm.

Dist-Tags

List tags

Lists the dist-tags for the package.

GET <route-prefix>/-/package/:package_name/dist-tags
AttributeTypeRequiredDescription
package_namestringyesThe name of the package.
curl --header "Authorization: Bearer <personal_access_token>" "https://gitlab.example.com/api/v4/projects/1/packages/npm/-/package/@myscope/my-pkg/dist-tags"

Example response:

{
  "latest": "2.1.1",
  "stable": "1.0.0"
}

The URLs in the response have the same route prefix used to request them. If you request them with the instance-level route, the returned URLs contain /api/v4/packages/npm.

Create or update a tag

Create or update a dist-tag.

PUT <route-prefix>/-/package/:package_name/dist-tags/:tag
AttributeTypeRequiredDescription
package_namestringyesThe name of the package.
tagstringyesThe tag to be created or updated.
versionstringyesThe version to be tagged.
curl --request PUT --header "Authorization: Bearer <personal_access_token>" "https://gitlab.example.com/api/v4/projects/1/packages/npm/-/package/@myscope/my-pkg/dist-tags/stable"

This endpoint responds successfully with 204 No Content.

Delete a tag

Delete a dist-tag.

DELETE <route-prefix>/-/package/:package_name/dist-tags/:tag
AttributeTypeRequiredDescription
package_namestringyesThe name of the package.
tagstringyesThe tag to be created or updated.
curl --request DELETE --header "Authorization: Bearer <personal_access_token>" "https://gitlab.example.com/api/v4/projects/1/packages/npm/-/package/@myscope/my-pkg/dist-tags/stable"

This endpoint responds successfully with 204 No Content.