Search projectsFind projects whose name contains, starts with, ends with or exactly matches some text. PyPI publishes no full-text search, so this matches names rather than descriptions: it is the step for 'is there a package called something like this?'. Matching ignores capitals and treats '-', '_' and '.' as the same character, exactly as PyPI does. No API key required.
Get a projectGet everything PyPI publishes about a package at its latest version: what it is, who maintains it, its licence, the Pythons it supports, how many releases it has, when the last one went out and how many security advisories it carries. The starting point for almost any workflow about a package. No API key required.
Get a project's descriptionGet a package's long description: the README shown on its PyPI page, in the Markdown or reStructuredText the author wrote. Kept out of Get a project because it can run to hundreds of kilobytes, and cut to a length you choose. No API key required.
Get a releaseGet one specific version of a package, with the files it shipped and their download URLs and checksums. Use it to read the metadata of a version a project has pinned, rather than whatever is newest today. No API key required.
List releasesList every version a package has published, with the date it went out, how many files it shipped and whether it was a pre-release or has since been withdrawn. Filter to stable versions only, or to a window of dates, to build a changelog or see how often a project ships. No API key required.
Check for a new releaseCheck whether a package has published anything newer than the version you already have. Give it the version a project pins and it says whether an upgrade exists, what the newest is, how many releases are in between and what they were. The step to put on a schedule to watch a dependency. No API key required.
List distribution filesList the files a package has published: the wheels, the source distributions and anything else, each with the URL it downloads from, its size, its SHA-256 and whether PyPI holds signed provenance for it. Narrow it to one version or one kind of file. No API key required.
List dependenciesList what a package installs alongside itself. PyPI publishes dependencies as raw lines like 'urllib3<3,>=1.21.1; python_version < "3.11"'; each one comes back split into the package it names, the versions it accepts and the condition it applies under, so a workflow can act on it without parsing text. Optional groups are left out unless you ask for them. No API key required.
List security advisoriesList the known security advisories for a package, from the Open Source Vulnerability database PyPI reports from. Ask about a specific version to check something a project has pinned; each advisory says what the issue is, which versions fix it and where to read more. No API key required.
Get a file's provenanceFind out which repository and which CI workflow built a distribution file, proved by the attestation signed when it was published rather than claimed in its metadata. The supply chain check for a dependency. Attestations are recent and opt-in, so many files have none; List distribution files says which do. No API key required.
Get new releases for a projectGet the releases a package has published, newest first, from the feed PyPI publishes for exactly this purpose. Pass the moment the last run finished and only what has appeared since comes back, so a scheduled workflow announces each release once. No API key required.
List recent releasesList the newest releases published anywhere on PyPI, from its own feed: the last hundred packages to ship a version, whatever they are. Use it to watch the ecosystem rather than one project. No API key required.
List new projectsList the projects most recently registered on PyPI for the first time, from its own feed. Distinct from recent releases: these are names that did not exist before, which is what a typosquat watch or a 'what's new in Python' digest wants. No API key required.
Get index statisticsGet how much storage PyPI holds in total and which hundred projects take up the most of it, largest first. The numbers behind 'PyPI is how many terabytes now?', and a way to see what a heavy dependency costs the index. No API key required.
