List the registry packages linked to a repo

GET/api/repos/{owner}/{repo}/packages

listRepoPackages

Packages whose optional repo link names this repo, each with its most recently pushed tag. Each package is filtered through the same authorization the pull path uses — the link lends a package no visibility, so a private package on a public repo is omitted for a caller who could not pull it.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/repos/OWNER/REPO/packages'

fetch

fetch("https://neosource.dev/api/repos/OWNER/REPO/packages", {
  method: "GET",
});

Path parameters

ownerrequired: Repository owner or organization slug.
string
reporequired: Repository name.
string

Responses

200Linked packages

application/json

RepoPackageListResponse

object

`GET /api/repos/{owner}/{repo}/packages` — the packages that LINK the repo and that the caller could pull.

packagesrequired

array

items

RepoPackageResponse

object

One package linked to a repo, with its most recent tag.

latest_tag: one of
PackageTagSummary
null
packagerequired: PackageResponse

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
403Forbidden — one of: forbidden
404Not Found — one of: not_found
423Locked — one of: busy
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`PackageTagSummary`

object

The latest push of a package, as the repo sidebar shows it.

digestrequired: string
`sha256:<hex>` — the manifest digest the tag points at.
tagrequired: string
updated_atrequired: integerint64
When the tag was last pushed (Unix millis).

`PackageResponse`

object

One registry package. `visibility` is the package's OWN visibility, never the linked repo's: anonymous pull is gated on this field alone (ADR 0097 §4), and a private repo may hold a public package or the reverse.

created_atrequired: integerint64
namerequired: string
The `{package}` path component. Obeys the OCI `path-component` grammar, which is narrower than a repo slug.
ownerrequired: string
Owner handle the package is served under — the `{owner}` in `/v2/{owner}/{package}`.
package_idrequired: string
pull_refrequired: string
What `docker pull` takes, without a tag: `{registry_host}/{owner}/{name}`, where the host is the registry's ADVERTISED hostname (`neocr.io` in production, ADR 0097 §1) — the forge's own host only where no separate registry host is configured.
example"neocr.io/neosource/server"
repo_id: string | null
The optional repo link. `null` for an unlinked package, and on the read routes also when the caller cannot read the linked repo (a public package may link a private one).
updated_atrequired: integerint64
visibilityrequired: RepoVisibilityInput
string
"public""internal""private"
workspace_idrequired: string