Packagist
Developerrepo.packagist.org
PHP package metadata from Packagist: every Composer version, requirements and autoload configuration.
Capabilities (9)
GET /v1/data/packagist/details1 creditReturns Packagist's own record for a package: description, GitHub repository, maintainers, language and issue stats, total/monthly/daily download counts, favers (stars), abandoned flag, and the full expanded version list.
GET /v1/data/packagist/dev1 creditReturns the same Composer v2 metadata document but for the package's unreleased branches (dev-main, dev-master, 2.x-dev and so on) instead of its tagged versions.
GET /v1/data/packagist/downloads1 creditReturns two parallel arrays — month labels (YYYY-MM) and install counts — covering the package's entire recorded history on Packagist.
GET /v1/data/packagist/list1 creditReturns a flat array of every package name published under one vendor namespace.
GET /v1/data/packagist/package1 creditReturns the Composer v2 metadata document for a package's tagged releases: every stable version with its require/require-dev map, autoload config, dist and source URLs, license and release time.
GET /v1/data/packagist/popular1 creditReturns the Packagist leaderboard: the most-downloaded PHP packages with name, description, repository, download count and favers, paged.
GET /v1/data/packagist/search1 creditFull-text search over Packagist, returning matched packages with name, description, repository URL, total downloads and favers, plus a next-page URL.
GET /v1/data/packagist/security-advisories1 creditReturns every known security advisory affecting one Composer package: advisory id, title, CVE, affected version constraint, link and report date, sourced from the FriendsOfPHP and GitHub advisory databases.
GET /v1/data/packagist/stats1 creditReturns a package's total, monthly and daily install counts plus the list of version strings Packagist tracks stats for.
Licence
Packagist is the public Composer repository; the metadata endpoint is the documented way to read it. We pass it through and do not licence callers to rebuild the registry.
https://packagist.org/aboutAttribution
Display this wherever you show the data. It arrives on every response as provenance.attribution_text.
Source: Packagist
Cache: up to 3600s
