Registry API
Packages
List packages, read versions and their secret-scan results, and move versions through review.
Package versions are immutable once published. A pushed draft is submitted for review, then approved or rejected; the scan result for each version is readable here, and so is the list of workspaces that consume a package.
Operations
| Request | What it does |
|---|---|
| GET /api/v1/packages | List packages |
| PATCH /api/v1/packages/{scope}/{name} | Update package status |
| GET /api/v1/packages/{scope}/{name}/versions/{version}/scan | Get scan result |
| GET /api/v1/packages/{scope}/{name}/versions | List versions |
| GET /api/v1/packages/{scope}/{name}/versions/{version} | Get version detail |
| POST /api/v1/packages/{scope}/{name}/versions/{version}/submit | Submit version for review |
| POST /api/v1/packages/{scope}/{name}/versions/{version}/approve | Approve version |
| POST /api/v1/packages/{scope}/{name}/versions/{version}/reject | Reject version |
| GET /api/v1/packages/{scope}/{name}/consumers | Get package consumers |
Paths and summaries come from apps/api/openapi.json, which CI regenerates from the route definitions; this site checks its list against that file. Telemetry ingest accepts a workspace key without a user session; everything else needs a signed-in user.