Packages

ProGet provides several pgutil commands (available as pgutil packages) and HTTP endpoints to to query, download, publish, delete, and perform other operations on packages in package-based feeds, regardless of the package type.

pgutil Commands

Available HTTP Endpoints

• Query Latest Packages - describes the latest version of a specified package
• Query Package Versions - describes all versions of a package, filtered as specified
• Download Package - downloads a package file
• Upload Package - uploads a package file to a feed
• Delete Package - deletes a package from a feed
• Set Package Status - sets the listed or deprecated status of a specified package
• Repackage Package - repackages a package
• Promote Package - promotes a package

The Packages API is available starting from ProGet 2023.0

Authenticating to Packages API

The following is a summary of access types and their corresponding requirements for various API keys types and endpoints within this API.

To specify an API Key, use the request header (X-ApiKey), querystring (key), or api:«api-key» as the username. See API Key Usage to learn more.

curl -X GET --header "X-ApiKey: abc12345" "https://proget.corp.local/api/packages/MyNugetFeed/versions"

403 The specified API key does not have the proper permissions to perform this action.

Package Identifiers (Group/Name/Version vs Purl)

Endpoints that work with a single package version (e.g. downloading, deleting, etc.) require identifying a single version package using querystring parameters. This can be done by specifying multiple parameters (name and version, and sometimes group and qualifier) or a single paramter (purl).

Using Multiple Parameters to Identify a Package

/api/packages/NpmFeed/download?group=angular&name=animation&version=12.3.1

/api/packages/MyDebianFeed/download?group=main&name=python3&version=3.9.2-3&qualifier=arch%3Damd64

Using a Purl to Identify a Package

To simplify package identification, you can also specify a purl (i.e. Package Url) that is compatible across all package types.

/api/packages/NpmFeed/download?purl=pkg:npm/%40angular/animation@12.3.1

This follows the purl-spec, and you can also find it on the PackageVersion Object

Documentation Conventions

In the operations that require package version identifier, we will use «package-identifiers»to reference the one or multiple parameters that you can use.

Data Specifications

PackageVersion Object Attributes

PackageVersion is a set of key/value pairs that correspond to the fields on a Package. It's used as output data for Query Latest Packages and Query Package Version as a JSON-formatted object.

Note that some values are optional (indicated by string?), and may be set to null or omitted.

JSON Object:

{
    "purl":"pkg:nuget/myNugetPackage@1.0.0",
    "group":null,
    "name":"MyNugetPackage",
    "version":"1.2.3",
    "totalDownloads":321,
    "downloads":23,
    "published":"2023-10-17T02:43:00.717Z",
    "publishedBy":"Admin",
    "size":2441966,
    "md5":"94d7f4cce0663c6a30340fe6fec831da",
    "sha1":"f418efd4238eb069cf38d1c86f4edc34444777dd",
    "sha256":"872fc189e638ab1056555b03aaa38f68bcb54286e221aa646eb1129babf63c77",
    "sha512":"99b252bc77d1c5f5f7b51fd4ea7d5653e9961d7b3061cf9207f8643a9c
    7cc9965eebc84d6467f2989bb4723b1a244915cc232a78f894e8b748ca882a7c89fb92"
    "deprecation": 
        { 
            "reason": ['Legacy'],
            "message": "Legacy version, deprecated on 01/01/2024",
            "alternateName": null,
            "alternateVersions": null
        } 
 }

PackageStatus Object Attributes

PackageStatus is a subset of attributes on the PackageVersion Object that correspond to settable fields. It's used as input for various endpoints:

All of the values are optional and may be omitted. An omitted property will not be set.

JSON Object:

{
    "listed": true,
    "allow": null, 
    "deprecation": 
        { 
            "reason": ['Legacy'],
            "message": "Legacy version, deprecated on 01/01/2024",
            "alternateName": null,
            "alternateVersions": null
        }
}

DeprecationInfo Object Attributes

DeprecationInfo is a set of key/value pairs that is used on the PackageVersion and PackageStatus Objects.

Note that all values are optional (indicated by string?), and may be set to null or omitted.

JSON Object:

{
    "reason": ['Legacy'],
    "message": "Legacy version, deprecated on 01/01/2024",
    "alternateName": null,
    "alternateVersions": null
}