For tools and bots

API

Everything public on this registry, as JSON. No token needed, and any website can call it (CORS).

Basics

Version 1

Base URL: https://gopkgreg.com/api/v1. Every endpoint is a GET and returns JSON.
Stable. Version 1 only grows: new fields may appear, but existing ones are never renamed or removed. Anything incompatible would come as /api/v2.
Module paths can be written in full (gopkgreg.com/alice/retry) or without the host (alice/retry).
Errors are {"error": "…"} with a 4xx status. Requests are rate limited per IP; slow down on 429.
Responses may be cached for up to a minute.

`/modules/{module}`

A module: latest version, synopsis, licenses, owners, every version (with yanked, retracted and verified flags), downloads, how many modules use it, security advisories, and links.

curl https://gopkgreg.com/api/v1/modules/alice/retry

{
  "path": "gopkgreg.com/alice/retry",
  "latest": "v1.2.0",
  "synopsis": "Package retry retries operations.",
  "licenses": ["MIT"],
  "owners": ["alice"],
  "versions": [{"version": "v1.2.0", "publishedAt": "2026-09-21T10:00:00Z", "yanked": false, "verified": true, …}],
  "downloads": {"lastDay": 12, "lastWeek": 80, "lastMonth": 311, "total": 1204},
  "usedBy": 4,
  "advisories": [],
  "urls": {"project": "…", "docs": "…", "proxy": "https://gopkgreg.com/api/proxy", "badge": "…"}
}

`/modules/{module}/@v/{version}`

One version: requirements from go.mod, packages, licenses, file count and size, the h1: checksums and SHA-256, the verified GitHub Actions provenance when a trusted publisher uploaded it, the advisories that affect it, and download links.

curl https://gopkgreg.com/api/v1/modules/alice/retry/@v/v1.2.0

`/search?q=`

Search the modules hosted here. Parameters: q, sort (relevance, downloads, updated, new), page, per_page (up to 100).

curl 'https://gopkgreg.com/api/v1/search?q=retry&sort=downloads'

`/owners/{name}`

A user's or organization's modules.

curl https://gopkgreg.com/api/v1/owners/alice

`/stats`

Registry totals, plus where its GOPROXY and vulnerability database live.

curl https://gopkgreg.com/api/v1/stats

README badges

SVG, refreshed every 5 minutes

https://gopkgreg.com/badge/{owner}/{module}.svg (add /v2 before .svg for major versions), with ?type=:

type	Shows
`version` (default)	The latest version `go get` installs
`downloads`	Downloads in the last 30 days
`verified`	Whether the latest version was published by a trusted publisher
`security`	Advisories affecting the latest version

Change the left text with &label=. Each project page has a copy-ready snippet for its README.

Also machine-readable

https://gopkgreg.com/api/proxy: the GOPROXY protocol, for the go command.
https://gopkgreg.com/vulndb: the Go vulnerability database format, for govulncheck -db.
Atom feeds of releases, new modules, owners, modules and advisories.
sitemap.xml of every project page.