List the indexed versions of one nixpkgs attribute

GET/api/packages/{attr}

getNixPackage

Returns every (version, system) the corpus carries for `attr`, with each row's availability. Versions are ordered as TEXT, which is not a version ordering — nixpkgs versions are not semver, so there is deliberately no `latest`. Pass `?version=` to ask about one version specifically. A version the corpus does not carry comes back in `requested` with `availability: not_indexed`, which means the pair predates the indexed window — it is never a stored row.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/packages/ATTR'

fetch

fetch("https://neosource.dev/api/packages/ATTR", {
  method: "GET",
});

Path parameters

attrrequired: The nixpkgs attribute path, e.g. `python311`.
string

Query parameters

version: Ask about one specific version. See [`NixPackageVersionsResponse::requested`].
string | null

Responses

200Indexed versions

application/json

NixPackageVersionsResponse

object

Everything the corpus carries for one attribute.

attrrequired

string

index_version

integer | nullint64

Which load generation answered.

requested

one of

null
NixPackageVersion
object
One indexed (version, system) of a nixpkgs attribute.
availabilityrequired
PackageAvailability
insecurerequired
boolean
known_vulnsrequired
array
`meta.knownVulnerabilities` at `revision`. Empty means the revision listed none, not "unknown".
items
string
license_free
boolean | null
`meta.license.free`. `null` means the metadata asserts nothing either way, which is **not** the same as "unfree".
output_namerequired
string
Which output nixpkgs designates primary (`meta.outputName`). **Not** a claim about which output carries `bin/`.
outputsrequired
array
items
string
revisionrequired
string
The newest sampled nixpkgs revision carrying this pair that also had bytes. Empty for a synthesised `not_indexed` entry, which names no revision because no revision was found.
store_path_candidatesrequired
array
Store-path hashes whose name matches this entry. A set of **candidates**, not an identification: the join back from `store-paths.xz` is by name only, so one entry legitimately produces several. An authoritative attribute → store-path mapping needs Hydra metadata and is not in the corpus yet.
items
string
systemrequired
string
`x86_64-linux` for every row today; the index carries no other system.
versionrequired
string

versionsrequired

array

Every indexed version, ordered by `version` **as text**. That is not a version ordering — `3.9` sorts after `3.10` — and it is deliberate: nixpkgs versions are not semver, so the caller gets the whole list and there is no "latest" for anyone to trust.

items

NixPackageVersion

object

One indexed (version, system) of a nixpkgs attribute.

availabilityrequired: PackageAvailability
insecurerequired: boolean
known_vulnsrequired: array
`meta.knownVulnerabilities` at `revision`. Empty means the revision listed none, not "unknown".
items
string
license_free: boolean | null
`meta.license.free`. `null` means the metadata asserts nothing either way, which is **not** the same as "unfree".
output_namerequired: string
Which output nixpkgs designates primary (`meta.outputName`). **Not** a claim about which output carries `bin/`.
outputsrequired: array
items
string
revisionrequired: string
The newest sampled nixpkgs revision carrying this pair that also had bytes. Empty for a synthesised `not_indexed` entry, which names no revision because no revision was found.
store_path_candidatesrequired: array
Store-path hashes whose name matches this entry. A set of **candidates**, not an identification: the join back from `store-paths.xz` is by name only, so one entry legitimately produces several. An authoritative attribute → store-path mapping needs Hydra metadata and is not in the corpus yet.
items
string
systemrequired: string
`x86_64-linux` for every row today; the index carries no other system.
versionrequired: string

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
404Not Found — one of: not_found
429Rate limited — retry after the interval in the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`PackageAvailability`

string

Whether a package's bytes can be fetched, and if not, why not. The distinction the enum exists to hold is one a narinfo probe **cannot** make on its own: a `404` from `cache.nixos.org` is the same `404` whether nixpkgs never built the pair or the pair predates the corpus entirely. What tells them apart is *presence in the index*, not the probe.

"substitutable""never_built""not_indexed"