PyPI

https://docs.pypi.org
Admin
PyPI is the official repository of packages for Python, providing a centralized platform for Python...
Tokens:26,981
Snippets:223
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Requesting Package Information via JSON

Source: https://docs.pypi.org/api/index-api

Example of a GET request to retrieve package information in JSON format.

```http
GET /simple/beautifulsoup4/ HTTP/1.1
Host: pypi.org
Accept: application/vnd.pypi.simple.v1+json
```

--------------------------------

### GET /simple/

Source: https://docs.pypi.org/api/index-api

Returns a list of all projects registered on PyPI.

```APIDOC
## GET /simple/

### Description
Returns all of the projects that have been registered on PyPI.

### Method
GET

### Endpoint
/simple/

### Response
#### Success Response (200)
- **X-PyPI-Last-Serial** (header) - The most recent serial ID number for any project.

#### Response Example
```json
{
  "meta": {
    "_last-serial": 24888689,
    "api-version": "1.4"
  },
  "projects": [
    { "name": "0" },
    { "name": "0-._.-._.-._.-._.-._.-._.-0" }
  ]
}
```
```

--------------------------------

### Install id and twine

Source: https://docs.pypi.org/trusted-publishers/using-a-publisher

Install the necessary tools for OIDC credential detection and package uploading.

```bash
python -m pip install -U id twine
```

--------------------------------

### Retrieve release metadata via GET request

Source: https://docs.pypi.org/api/json

Example of a GET request to fetch JSON metadata for a specific project version.

```http
GET /pypi/sampleproject/4.0.0/json HTTP/1.1
Host: pypi.org
Accept: application/json
```

--------------------------------

### GET /simple/{project}/

Source: https://docs.pypi.org/api/index-api

Retrieves the list of files and metadata for a specific project from the PyPI simple index.

```APIDOC
## GET /simple/{project}/

### Description
Retrieves a JSON list of files available for a specific project. This endpoint provides metadata such as file hashes, upload times, and URLs for distribution files.

### Method
GET

### Endpoint
/simple/{project}/

### Parameters
#### Path Parameters
- **project** (string) - Required - The name of the package to retrieve files for.

### Request Example
GET /simple/beautifulsoup4/ HTTP/1.1
Host: pypi.org
Accept: application/vnd.pypi.simple.v1+json

### Response
#### Success Response (200)
- **files** (array) - A list of file objects containing metadata.
- **meta** (object) - API version and serial information.
- **name** (string) - The name of the project.
- **versions** (array) - A list of available version strings.

#### Response Example
{
  "files": [
    {
      "filename": "beautifulsoup4-4.12.3-py3-none-any.whl",
      "hashes": {
        "sha256": "b80878c9f40111313e55da8ba20bdba06d8fa3969fc68304167741bbf9e082ed"
      },
      "size": 147925,
      "url": "https://files.pythonhosted.org/packages/b1/fe/e8c672695b37eecc5cbf43e1d0638d88d66ba3a44c4d321c796f4e59167f/beautifulsoup4-4.12.3-py3-none-any.whl"
    }
  ],
  "name": "beautifulsoup4"
}
```

--------------------------------

### GET /simple/<project>/

Source: https://docs.pypi.org/api/index-api

Retrieves all distribution download URLs for a specific project's available releases.

```APIDOC
## GET /simple/<project>/

### Description
Get all of the distribution download URLs for the project's available releases (wheels and source distributions). The project name is matched case-insensitively.

### Method
GET

### Endpoint
/simple/<project>/

### Parameters
#### Path Parameters
- **project** (string) - Required - The name of the project to retrieve distributions for.

### Response
#### Success Response (200)
- **X-PyPI-Last-Serial** (header) - The most recent serial ID number for the project.
```

--------------------------------

### Full GitLab CI workflow with attestations

Source: https://docs.pypi.org/attestations/producing-attestations

A complete example showing build, generate-pypi-attestations, and publish jobs configured for Trusted Publishing.

```yaml
build-job:
  stage: build
  image: python:3-bookworm
  script:
    - python -m pip install -U build
    - cd python_pkg && python -m build
  artifacts:
    paths:
      - "python_pkg/dist/"

generate-pypi-attestations:
  stage: build
  image: python:3-bookworm
  needs:
  - job: build-job
    artifacts: true
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  script:
    - python -m pip install -U pypi-attestations
    - python -m pypi_attestations sign python_pkg/dist/*
  artifacts:
    paths:
      - "python_pkg/dist/"

publish-job:
  stage: deploy
  image: python:3-bookworm
  dependencies:
    - build-job
    - generate-pypi-attestations
  id_tokens:
    PYPI_ID_TOKEN:
      # Use "testpypi" if uploading to TestPyPI
      aud: pypi
  script:
    # Install dependencies
    - python -m pip install -U twine

    # Upload to PyPI using Trusted Publishing, including the generated attestations
    # Add "--repository testpypi" if uploading to TestPyPI
    - twine upload  --attestations python_pkg/dist/*
```

--------------------------------

### Retrieve file provenance

Source: https://docs.pypi.org/api/integrity

Example request to fetch the provenance object for a specific project file.

```http
GET /integrity/sampleproject/4.0.0/sampleproject-4.0.0.tar.gz/provenance HTTP/1.1
Host: pypi.org
Accept: application/vnd.pypi.integrity.v1+json
```

--------------------------------

### Project metadata JSON response

Source: https://docs.pypi.org/api/json

Example JSON response containing project info, release history, and file metadata.

```json
HTTP/1.1 200 OK
Content-Type: application/json; charset="UTF-8"

{
    "info": {
        "author": "",
        "author_email": "\"A. Random Developer\" <author@example.com>",
        "bugtrack_url": null,
        "classifiers": [
            "Development Status :: 3 - Alpha",
            "Intended Audience :: Developers",
            "License :: OSI Approved :: MIT License",
            "Programming Language :: Python :: 3",
            "Programming Language :: Python :: 3 :: Only",
            "Programming Language :: Python :: 3.10",
            "Programming Language :: Python :: 3.11",
            "Programming Language :: Python :: 3.12",
            "Programming Language :: Python :: 3.13",
            "Programming Language :: Python :: 3.9",
            "Topic :: Software Development :: Build Tools"
        ],
        "description": "...",
        "description_content_type": "text/markdown",
        "docs_url": null,
        "download_url": "",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "dynamic": [
            "requires_dist"
        ],
        "home_page": "",
        "keywords": "sample, setuptools, development",
        "license": "...",
        "license_expression": null,
        "license_files": null,
        "maintainer": "",
        "maintainer_email": "\"A. Great Maintainer\" <maintainer@example.com>",
        "name": "sampleproject",
        "package_url": "https://pypi.org/project/sampleproject/",
        "platform": null,
        "project_url": "https://pypi.org/project/sampleproject/",
        "project_urls": {
            "Bug Reports": "https://github.com/pypa/sampleproject/issues",
            "Funding": "https://donate.pypi.org",
            "Homepage": "https://github.com/pypa/sampleproject",
            "Say Thanks!": "http://saythanks.io/to/example",
            "Source": "https://github.com/pypa/sampleproject/"
        },
        "provides_extra": [
            "dev",
            "test"
        ],
        "release_url": "https://pypi.org/project/sampleproject/4.0.0/",
        "requires_dist": [
            "peppercorn",
            "check-manifest ; extra == 'dev'",
            "coverage ; extra == 'test'"
        ],
        "requires_python": ">=3.9",
        "summary": "A sample Python project",
        "version": "4.0.0",
        "yanked": false,
        "yanked_reason": null
    },
    "last_serial": 25862117,
    "releases": {
        "1.0": [],
        "1.2.0": [
            {
                "comment_text": "",
                "core-metadata": false,
                "digests": {
                    "blake2b_256": "3052547eb3719d0e872bdd6fe3ab60cef92596f95262e925e1943f68f840df88",
                    "md5": "bab8eb22e6710eddae3c6c7ac3453bd9",
                    "sha256": "7a7a8b91086deccc54cac8d631e33f6a0e232ce5775c6be3dc44f86c2154019d"
                }
```

--------------------------------

### Get distributions for a project via HTML

Source: https://docs.pypi.org/api/index-api

Retrieve distribution download URLs for a specific project in HTML format.

```http
GET /simple/beautifulsoup4/ HTTP/1.1
Host: pypi.org
Accept: application/vnd.pypi.simple.v1+html
```

```http
HTTP/2 200 OK
Content-Type: application/vnd.pypi.simple.v1+html
Etag: "q4SqZutq1tfRDqhh3zQ4gQ"
X-PyPI-Last-Serial: 2857110

<!DOCTYPE html>
<html>
  <head>
    <meta name="pypi:repository-version" content="1.4">
    <meta name="pypi:project-status" content="active">
    <title>Links for beautifulsoup4</title>
  </head>
  <body>
    <h1>Links for beautifulsoup4</h1>
    <a href="https://files.pythonhosted.org/packages/6f/be/99dcf74d947cc1e7abef5d0c4572abcb479c33ef791d94453a8fd7987d8f/beautifulsoup4-4.0.1.tar.gz#sha256=dc6bc8e8851a1c590c8cc8f25915180fdcce116e268d1f37fa991d2686ea38de" >beautifulsoup4-4.0.1.tar.gz</a><br />
    <a href="https://files.pythonhosted.org/packages/a0/75/db36172ea767dd2f0c9817a99e24f7e9b79c2ce63eb2f8b867284cc60daf/beautifulsoup4-4.0.2.tar.gz#sha256=353792f8246a9551b232949fb14dce21d9b6ced9207bf9f4a69a4c4eb46c8127" >beautifulsoup4-4.0.2.tar.gz</a><br />
    <!-- ...More files... -->
    <a href="https://files.pythonhosted.org/packages/14/7e/e4313dad823c3a0751c99b9bc0182b1dd19aea164ce7445e9a70429b9e92/beautifulsoup4-4.13.0b2-py3-none-any.whl#sha256=7e05ad0b6c26108d9990e2235e8a9b4e2c03ead6f391ceb60347f8ebea6b80ba" data-requires-python="&gt;=3.6.0" data-dist-info-metadata="sha256=d0aa787c2b55e5b0b3aff66f137cf33341c5e781cb87b4dc184cbb25c7ac0ab5" data-core-metadata="sha256=d0aa787c2b55e5b0b3aff66f137cf33341c5e781cb87b4dc184cbb25c7ac0ab5">beautifulsoup4-4.13.0b2-py3-none-any.whl</a><br />
    <a href="https://files.pythonhosted.org/packages/81/bd/c97d94e2b96f03d1c50bc9de04130e014eda89322ba604923e0c251eb02e/beautifulsoup4-4.13.0b2.tar.gz#sha256=c684ddec071aa120819889aa9e8940f85c3f3cdaa08e23b9fa26510387897bd5" data-requires-python="&gt;=3.6.0" >beautifulsoup4-4.13.0b2.tar.gz</a><br />
  </body>
</html>
<!--SERIAL 22406780-->
```

--------------------------------

### GET /rss/packages.xml

Source: https://docs.pypi.org/api/feeds

Retrieves a feed of the latest newly created projects on PyPI.

```APIDOC
## GET /rss/packages.xml

### Description
Provides the latest newly created projects on PyPI, including the package name, description, and a link to the project page.

### Method
GET

### Endpoint
https://pypi.org/rss/packages.xml
```

--------------------------------

### Publish to TestPyPI using Trusted Publishing

Source: https://docs.pypi.org/trusted-publishers/using-a-publisher

Example configuration for publishing to TestPyPI using the pypi-publish action.

```yaml
- name: Publish package distributions to TestPyPI
  uses: pypa/gh-action-pypi-publish@release/v1
  with:
    repository-url: https://test.pypi.org/legacy/
```

--------------------------------

### GET /pypi/<project>/<version>/json

Source: https://docs.pypi.org/api/json

Retrieves metadata about an individual release at a specific version of a project.

```APIDOC
## GET /pypi/<project>/<version>/json

### Description
Returns metadata about an individual release at a specific version. This endpoint provides details specific to that release, excluding the full list of all project releases.

### Method
GET

### Endpoint
/pypi/<project>/<version>/json

### Parameters
#### Path Parameters
- **project** (string) - Required - The name of the project.
- **version** (string) - Required - The specific version of the project.

### Response
#### Success Response (200)
- **info** (object) - Metadata about the release.
- **urls** (array) - List of files and their associated metadata for this release.

### Response Example
{
  "info": { ... },
  "urls": [
    {
      "filename": "sampleproject-4.0.0.tar.gz",
      "packagetype": "sdist",
      "url": "https://files.pythonhosted.org/...",
      "size": 5760,
      "upload_time": "2024-11-06T22:37:10"
    }
  ]
}
```

--------------------------------

### Request project metadata

Source: https://docs.pypi.org/api/json

Example HTTP request to retrieve JSON metadata for a specific project.

```http
GET /pypi/sampleproject/json HTTP/1.1
Host: pypi.org
Accept: application/json
```

--------------------------------

### Retrieve Package Release JSON

Source: https://docs.pypi.org/api/json

Example of a successful HTTP 200 response from the PyPI API containing package metadata and release details.

```http
HTTP/1.1 200 OK
Content-Type: application/json; charset="UTF-8"

{
    "info": {
        "author": "",
        "author_email": "\"A. Random Developer\" <author@example.com>",
        "bugtrack_url": null,
        "classifiers": [
            "Development Status :: 3 - Alpha",
            "Intended Audience :: Developers",
            "License :: OSI Approved :: MIT License",
            "Programming Language :: Python :: 3",
            "Programming Language :: Python :: 3 :: Only",
            "Programming Language :: Python :: 3.10",
            "Programming Language :: Python :: 3.11",
            "Programming Language :: Python :: 3.12",
            "Programming Language :: Python :: 3.13",
            "Programming Language :: Python :: 3.9",
            "Topic :: Software Development :: Build Tools"
        ],
        "description": "...",
        "description_content_type": "text/markdown",
        "docs_url": null,
        "download_url": "",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "dynamic": [
            "requires_dist"
        ],
        "home_page": "",
        "keywords": "sample, setuptools, development",
        "license": "... ",
        "license_expression": null,
        "license_files": null,
        "maintainer": "",
        "maintainer_email": "\"A. Great Maintainer\" <maintainer@example.com>",
        "name": "sampleproject",
        "package_url": "https://pypi.org/project/sampleproject/",
        "platform": null,
        "project_url": "https://pypi.org/project/sampleproject/",
        "project_urls": {
            "Bug Reports": "https://github.com/pypa/sampleproject/issues",
            "Funding": "https://donate.pypi.org",
            "Homepage": "https://github.com/pypa/sampleproject",
            "Say Thanks!": "http://saythanks.io/to/example",
            "Source": "https://github.com/pypa/sampleproject/"
        },
        "provides_extra": [
          "dev",
          "test"
        ],
        "release_url": "https://pypi.org/project/sampleproject/4.0.0/",
        "requires_dist": [
            "peppercorn",
            "check-manifest ; extra == 'dev'",
            "coverage ; extra == 'test'"
        ],
        "requires_python": ">=3.9",
        "summary": "A sample Python project",
        "version": "4.0.0",
        "yanked": false,
        "yanked_reason": null
    },
    "last_serial": 25862117,
    "urls": [
      {
        "comment_text": "",
        "core-metadata": {
          "sha256": "a1d0c6e83f027327d8461063f4ac58a6e4a7a5d0a0e0d5b6c3b2e1f0a9b8c7d6"
        },
        "digests": {
          "blake2b_256": "d773c16e5f3f0d37c60947e70865c255a58dc408780a6474de0523afd0ec553a",
          "md5": "d3857a217dacbca9e40a85f06f2b34f1",
          "sha256": "c23e447ea90d796d1e645c35c4b2de125040add12a845825546f91c93f391b6b"
        },
        "downloads": -1,
        "filename": "sampleproject-4.0.0-py3-none-any.whl",
        "has_sig": false,
        "md5_digest": "d3857a217dacbca9e40a85f06f2b34f1",
        "packagetype": "bdist_wheel",
        "python_version": "py3",
        "requires_python": ">=3.9",
        "size": 4661,
        "upload_time": "2024-11-06T22:37:09",
        "upload_time_iso_8601": "2024-11-06T22:37:09.220617Z",
        "url": "https://files.pythonhosted.org/packages/d7/73/c16e5f3f0d37c60947e70865c255a58dc408780a6474de0523afd0ec553a/sampleproject-4.0.0-py3-none-any.whl",
        "yanked": false,
        "yanked_reason": null
      },
      {
        "comment_text": "",
        "core-metadata": {
          "sha256": "b2e1d7f94a138438e9572174a5bd69b7f5b8b6e1b1f1e6c7d4c3f2a1b0c9d8e7"
        },
        "digests": {
          "blake2b_256": "488cc18d25735962870ccb6d1cd2ac7bde40008a332211055e260cb7ec4c6bab",
          "md5": "9eab89661feaaf3b05b60fb1ed1f7171",
          "sha256": "0ace7980f82c5815ede4cd7bf9f6693684cec2ae47b9b7ade9add533b8627c6b"
        },
        "downloads": -1,
        "filename": "sampleproject-4.0.0.tar.gz",
        "has_sig": false,
        "md5_digest": "9eab89661feaaf3b05b60fb1ed1f7171",
        "packagetype": "sdist",
        "python_version": "source",
        "requires_python": ">=3.9",
        "size": 5760,
        "upload_time": "2024-11-06T22:37:10",
        "upload_time_iso_8601": "2024-11-06T22:37:10.868088Z",
        "url": "https://files.pythonhosted.org/packages/48/8c/c18d25735962870ccb6d1cd2ac7bde40008a332211055e260cb7ec4c6bab/sampleproject-4.0.0.tar.gz",
        "yanked": false,
        "yanked_reason": null
      }
    ],
    "vulnerabilities": [],
    "ownership": {
        "roles": [
            {"role": "Owner", "user": "theacodes"},
            {"role": "Maintainer", "user": "pypa-bot"}
        ],
        "organization": "pypa"
    }
}
```

--------------------------------

### GET /stats/

Source: https://docs.pypi.org/api/stats

Retrieves statistics regarding the total size of PyPI packages and the top 100 packages by size.

```APIDOC
## GET /stats/

### Description
Returns statistics in JSON format, including the total size of PyPI packages in bytes and the top 100 packages with their respective sizes.

### Method
GET

### Endpoint
/stats/

### Request Example
GET /stats HTTP/1.1
Host: pypi.org
Accept: application/json

### Response
#### Success Response (200)
- **top_packages** (object) - A dictionary of the top 100 packages and their size in bytes.
- **total_packages_size** (integer) - The total size of all PyPI packages in bytes.

#### Response Example
{
  "top_packages": {
    "CodeIntel": {
      "size": 23767329521
    },
    "Fiona": {
      "size": 6209535709
    },
    "FlexGet": {
      "size": 4387002448
    },
    "...": "..."
  },
  "total_packages_size": 23965450269
}
```

--------------------------------

### Verifying Redirects for Predictable URLs

Source: https://docs.pypi.org/api

Example command to verify that a predictable URL redirects to the canonical file location.

```bash
$ curl -I https://files.pythonhosted.org/packages/source/v/virtualenv/virtualenv-15.2.0.tar.gz
HTTP/2 302
location: https://files.pythonhosted.org/packages/b1/72/2d70c5a1de409ceb3a27ff2ec007ecdd5cc52239e7c74990e32af57affe9/virtualenv-15.2.0.tar.gz
```

--------------------------------

### GET /pypi/<project>/json

Source: https://docs.pypi.org/api/json

Retrieves metadata about an individual project at the latest version, including a list of all releases and project URLs.

```APIDOC
## GET /pypi/<project>/json

### Description
Returns metadata (info) about an individual project at the latest version, a list of all releases for that project, and project URLs. Releases include the release name, URL, and hash digests for MD5, SHA256, and BLAKE2b-256.

### Method
GET

### Endpoint
/pypi/<project>/json

### Parameters
#### Path Parameters
- **project** (string) - Required - The name of the project to retrieve metadata for.

### Response
#### Success Response (200)
- **info** (object) - Metadata about the project.
- **last_serial** (integer) - The last serial number for the project.
- **releases** (object) - A dictionary of all releases for the project, keyed by version string.

### Response Example
{
    "info": {
        "name": "sampleproject",
        "version": "4.0.0",
        "summary": "A sample Python project"
    },
    "last_serial": 25862117,
    "releases": {
        "1.0": []
    }
}
```

--------------------------------

### GET /pypi/{package_name}/{version}/json

Source: https://docs.pypi.org/api/json

Retrieves detailed information about a specific release of a package, including metadata, release URLs, and ownership information.

```APIDOC
## GET /pypi/{package_name}/{version}/json

### Description
Retrieves detailed information about a specific release of a package, including metadata, release URLs, and ownership information.

### Method
GET

### Endpoint
/pypi/{package_name}/{version}/json

### Response
#### Success Response (200)
- **info** (object) - Metadata about the package release.
- **last_serial** (integer) - The last serial number for the package.
- **urls** (array) - List of available files and download URLs for the release.
- **vulnerabilities** (array) - List of known vulnerabilities.
- **ownership** (object) - Information about package owners and maintainers.

#### Response Example
{
    "info": {
        "name": "sampleproject",
        "version": "4.0.0",
        "summary": "A sample Python project"
    },
    "last_serial": 25862117,
    "urls": [],
    "vulnerabilities": [],
    "ownership": {}
}
```

--------------------------------

### Secret Disclosure Request Example

Source: https://docs.pypi.org/api/secrets

An example of a POST request to the disclose-token endpoint.

```http
POST /_/secrets/disclose-token HTTP/1.1
Host: pypi.org
Some-Public-Key-Identifier: ...
Some-Public-Key-Signature: ...

[
  {
    "token": "pypi-NMIfyYncKcRALEXAMPLE...",
    "type": "pypi_api_token",
    "url": "https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt",
  }
]
```

--------------------------------

### GET /rss/updates.xml

Source: https://docs.pypi.org/api/feeds

Retrieves a feed of the latest releases for individual projects on PyPI.

```APIDOC
## GET /rss/updates.xml

### Description
Provides the latest newly created releases for individual projects on PyPI, including the package name and description, release version, and a link to the release page.

### Method
GET

### Endpoint
https://pypi.org/rss/updates.xml
```

--------------------------------

### List all projects via HTML

Source: https://docs.pypi.org/api/index-api

Request the list of all projects in HTML format using the appropriate Accept header.

```http
GET /simple/ HTTP/1.1
Host: pypi.org
Accept: application/vnd.pypi.simple.v1+html
```

```http
HTTP/1.0 200 OK
Content-Type: application/vnd.pypi.simple.v1+html
X-PyPI-Last-Serial: 24888689

<html>
  <head>
    <meta name="pypi:repository-version" content="1.4">
    <title>Simple index</title>
  </head>
  <body>
    <a href="/simple/0/">0</a>
    <a href="/simple/0-0/">0-._.-._.-._.-._.-._.-._.-0</a>
    <!-- More projects... -->
  </body>
</html>
```

--------------------------------

### GET /rss/project/<project_name>/releases.xml

Source: https://docs.pypi.org/api/feeds

Retrieves a feed of the latest releases for a specific project.

```APIDOC
## GET /rss/project/<project_name>/releases.xml

### Description
Available for each project, this feed provides the latest releases for the given project on PyPI, including the package name and description, release version, and a link to the release page.

### Method
GET

### Endpoint
https://pypi.org/rss/project/<project_name>/releases.xml

### Parameters
#### Path Parameters
- **project_name** (string) - Required - The name of the project to retrieve releases for.
```

--------------------------------

### Project Statistics JSON Response

Source: https://docs.pypi.org/api/stats

Example structure of the JSON response returned by the stats endpoint.

```json
{
  "top_packages": {
    "CodeIntel": {
      "size": 23767329521
    },
    "Fiona": {
      "size": 6209535709
    },
    "FlexGet": {
      "size": 4387002448
    },
    "...": "..."
  },
  "total_packages_size": 23965450269
}
```

--------------------------------

### Produce Sigstore bundles with GitHub Actions

Source: https://docs.pypi.org/attestations/producing-attestations

Use the actions/attest action to create Sigstore bundles compatible with PyPI's attestation format.

```yaml
- name: attest
  uses: actions/attest@v1
  with:
    # Attest to every distribution
    subject-path: dist/*
    predicate-type: 'https://docs.pypi.org/attestations/publish/v1'
    predicate: '{}'
```

--------------------------------

### List all projects via JSON

Source: https://docs.pypi.org/api/index-api

Request the list of all projects in JSON format using the appropriate Accept header.

```http
GET /simple/ HTTP/1.1
Host: pypi.org
Accept: application/vnd.pypi.simple.v1+json
```

```http
HTTP/1.1 200 OK
Content-Type: application/vnd.pypi.simple.v1+json
X-PyPI-Last-Serial: 24888689

{
  "meta": {
    "_last-serial": 24888689,
    "api-version": "1.4"
  },
  "projects": [
    {
      "_last-serial": 3075854,
      "name": "0"
    },
    {
      "_last-serial": 1448421,
      "name": "0-._.-._.-._.-._.-._.-._.-0"
    },
    "More projects..."
  ]
}
```

--------------------------------

### Represent a withdrawn vulnerability

Source: https://docs.pypi.org/api/json

Example of a vulnerability object where the withdrawn field contains an RFC 3339 timestamp.

```json
{
    "aliases": [
        "CVE-2022-XXXXX"
    ],
    "details": "A long description.",
    "summary": "A shorter summary.",
    "fixed_in": [
        "1.2.3"
    ],
    "id": "PYSEC-2022-XXX",
    "link": "https://osv.dev/vulnerability/PYSEC-2022-XXX",
    "source": "osv",
    "withdrawn": "2022-06-28T16:39:06Z"
}
```

--------------------------------

### POST upload.pypi.org/legacy/

Source: https://docs.pypi.org/api/upload

Uploads a distribution file to PyPI. The first file uploaded for a version creates the release and populates its metadata.

```APIDOC
## POST upload.pypi.org/legacy/

### Description
Uploads a distribution file to PyPI. Releases are created by uploading one file at a time, with the first file defining the release metadata.

### Method
POST

### Endpoint
upload.pypi.org/legacy/

### Parameters
#### Request Body
- **:action** (string) - Required - Must be set to 'file_upload'.
- **protocol_version** (string) - Required - Must be set to '1'.
- **content** (file) - Required - The file to be uploaded.
- **md5_digest** (string) - Optional - MD5 hash of the file in urlsafe base64 (no padding).
- **sha256_digest** (string) - Optional - SHA2-256 hash of the file in hexadecimal.
- **blake2_256_digest** (string) - Optional - Blake2b 256-bit hash of the file in hexadecimal.
- **filetype** (string) - Required - Must be 'bdist_wheel' or 'sdist'.
- **pyversion** (string) - Required - Python tag for 'bdist_wheel' or 'source' for 'sdist'.
- **metadata_version** (string) - Required - Core metadata version.
- **name** (string) - Required - Package name.
- **version** (string) - Required - Package version.
- **attestations** (json) - Optional - JSON array of attestation objects.
```

--------------------------------

### Upload with Twine

Source: https://docs.pypi.org/trusted-publishers/using-a-publisher

Use the minted API token to upload packages via Twine.

```bash
TWINE_USERNAME=__token__ TWINE_PASSWORD=${api_token} twine upload dist/*
```

--------------------------------

### Verify PyPI artifact provenance

Source: https://docs.pypi.org/attestations/consuming-attestations

Use the pypi-attestations CLI to download a wheel and verify its provenance against a specified repository.

```bash
export WHEEL_DIRECT_URL=https://files.pythonhosted.org/packages/d7/73/c16e5f3f0d37c60947e70865c255a58dc408780a6474de0523afd0ec553a/sampleproject-4.0.0-py3-none-any.whl

pypi-attestations verify pypi --repository https://github.com/pypa/sampleproject $WHEEL_DIRECT_URL
```

--------------------------------

### PyPI Simple API JSON Response

Source: https://docs.pypi.org/api/index-api

Example of the JSON response structure returned by the PyPI Simple API.

```json
HTTP/2 200 OK
Content-Type: application/vnd.pypi.simple.v1+json
Etag: "hVGQAYl/eoNrx2H5FmPuXw"
X-PyPI-Last-Serial: 22406780

{
  "files": [
    {
      "core-metadata": false,
      "data-dist-info-metadata": false,
      "filename": "beautifulsoup4-4.0.1.tar.gz",
      "hashes": {
        "sha256": "dc6bc8e8851a1c590c8cc8f25915180fdcce116e268d1f37fa991d2686ea38de"
      },
      "requires-python": null,
      "size": 51024,
      "upload-time": "2014-01-21T05:35:05.558877Z",
      "url": "https://files.pythonhosted.org/packages/6f/be/99dcf74d947cc1e7abef5d0c4572abcb479c33ef791d94453a8fd7987d8f/beautifulsoup4-4.0.1.tar.gz",
      "yanked": false
    },
    {
      "core-metadata": false,
      "data-dist-info-metadata": false,
      "filename": "beautifulsoup4-4.0.2.tar.gz",
      "hashes": {
        "sha256": "353792f8246a9551b232949fb14dce21d9b6ced9207bf9f4a69a4c4eb46c8127"
      },
      "requires-python": null,
      "size": 51240,
      "upload-time": "2014-01-21T05:35:09.581933Z",
      "url": "https://files.pythonhosted.org/packages/a0/75/db36172ea767dd2f0c9817a99e24f7e9b79c2ce63eb2f8b867284cc60daf/beautifulsoup4-4.0.2.tar.gz",
      "yanked": false
    },
    "...More files...",
    {
      "core-metadata": {
        "sha256": "524392d64a088e56a4232f50d6edb208dc03105394652acb72c6d5fa64c89f3e"
      },
      "data-dist-info-metadata": {
        "sha256": "524392d64a088e56a4232f50d6edb208dc03105394652acb72c6d5fa64c89f3e"
      },
      "filename": "beautifulsoup4-4.12.3-py3-none-any.whl",
      "hashes": {
        "sha256": "b80878c9f40111313e55da8ba20bdba06d8fa3969fc68304167741bbf9e082ed"
      },
      "requires-python": ">=3.6.0",
      "size": 147925,
      "upload-time": "2024-01-17T16:53:12.779164Z",
      "url": "https://files.pythonhosted.org/packages/b1/fe/e8c672695b37eecc5cbf43e1d0638d88d66ba3a44c4d321c796f4e59167f/beautifulsoup4-4.12.3-py3-none-any.whl",
      "yanked": false
    },
    {
      "core-metadata": false,
      "data-dist-info-metadata": false,
      "filename": "beautifulsoup4-4.12.3.tar.gz",
      "hashes": {
        "sha256": "74e3d1928edc070d21748185c46e3fb33490f22f52a3addee9aee0f4f7781051"
      },
      "requires-python": ">=3.6.0",
      "size": 581181,
      "upload-time": "2024-01-17T16:53:17.902970Z",
      "url": "https://files.pythonhosted.org/packages/b3/ca/824b1195773ce6166d388573fc106ce56d4a805bd7427b624e063596ec58/beautifulsoup4-4.12.3.tar.gz",
      "yanked": false
    },
    {
      "core-metadata": {
        "sha256": "d0aa787c2b55e5b0b3aff66f137cf33341c5e781cb87b4dc184cbb25c7ac0ab5"
      },
      "data-dist-info-metadata": {
        "sha256": "d0aa787c2b55e5b0b3aff66f137cf33341c5e781cb87b4dc184cbb25c7ac0ab5"
      },
      "filename": "beautifulsoup4-4.13.0b2-py3-none-any.whl",
      "hashes": {
        "sha256": "7e05ad0b6c26108d9990e2235e8a9b4e2c03ead6f391ceb60347f8ebea6b80ba"
      },
      "requires-python": ">=3.6.0",
      "size": 179607,
      "upload-time": "2024-03-20T13:00:33.355932Z",
      "url": "https://files.pythonhosted.org/packages/14/7e/e4313dad823c3a0751c99b9bc0182b1dd19aea164ce7445e9a70429b9e92/beautifulsoup4-4.13.0b2-py3-none-any.whl",
      "yanked": false
    },
    {
      "core-metadata": false,
      "data-dist-info-metadata": false,
      "filename": "beautifulsoup4-4.13.0b2.tar.gz",
      "hashes": {
        "sha256": "c684ddec071aa120819889aa9e8940f85c3f3cdaa08e23b9fa26510387897bd5"
      },
      "requires-python": ">=3.6.0",
      "size": 550258,
      "upload-time": "2024-03-20T13:00:31.245327Z",
      "url": "https://files.pythonhosted.org/packages/81/bd/c97d94e2b96f03d1c50bc9de04130e014eda89322ba604923e0c251eb02e/beautifulsoup4-4.13.0b2.tar.gz",
      "yanked": false
    }
  ],
  "meta": {
    "_last-serial": 22406780,
    "api-version": "1.4"
  },
  "name": "beautifulsoup4",
  "project-status": {
    "status": "active"
  },
  "versions": [
    "4.0.1",
    "4.0.2",
    "...More versions...",
    "4.12.3",
    "4.13.0b2"
  ]
}
```

--------------------------------

### Publish to ActiveState

Source: https://docs.pypi.org/trusted-publishers/using-a-publisher

Publish a package to the ActiveState catalog using the State Tool CLI.

```bash
state publish \
  --namespace private/ORGNAME \
  --name PKG_NAME PKG_FILENAME \
  --depend "builder/python-module-builder@>=0" \
  --depend "language/python@>=3" \
  --depend "language/python/setuptools@>=43.0.0" \
  --depend "language/python/wheel@>=0"
```

--------------------------------

### Generate attestations with pypi-attestations CLI

Source: https://docs.pypi.org/attestations/producing-attestations

Use the CLI to generate attestations for all distribution files in the dist directory.

```bash
python -m pip install pypi-attestations
python -m pypi_attestations sign dist/*
```
Tokens:
Raw