Go module registry

The Go module registry implements the GOPROXY protocol so the go toolchain can resolve and download modules, and accepts module publishing by upload. See README.md for the conventions shared by every registry protocol.

Resource overview

All endpoints are scoped to a repository and served under /go/{owner}/{repo}/ on the API host (https://api.gitvetrix.com). The path after the base is the module path plus a GOPROXY action — for example /go/alice/app/example.com/mod/@v/v1.0.0.zip. Set GOPROXY to the base path to resolve modules through the registry.

Auth & scopes

Reads are governed by repository visibility; publishing requires registry write. The credential is a session or access-token JWT sent as Authorization: Bearer <token>. See Push scopes.

Endpoints

Method	Path	Summary
`GET`	`/go/{owner}/{repo}/{module}/@v/list`	List available versions
`GET`	`/go/{owner}/{repo}/{module}/@latest`	Resolve the latest version
`GET`	`/go/{owner}/{repo}/{module}/@v/{version}.info`	Version metadata
`GET`	`/go/{owner}/{repo}/{module}/@v/{version}.mod`	The module's `go.mod`
`GET`	`/go/{owner}/{repo}/{module}/@v/{version}.zip`	The module source archive
`PUT`	`/go/{owner}/{repo}/{module}/@v/{version}.mod`	Publish a `go.mod`
`PUT`	`/go/{owner}/{repo}/{module}/@v/{version}.zip`	Publish a source archive

Reads

The GOPROXY read actions follow the standard protocol:

@v/list returns the known versions, one per line, as text/plain.
@latest returns the newest version as { "Version": "...", "Time": "..." }.
@v/{version}.info returns the same JSON shape for a specific version.
@v/{version}.mod returns the stored go.mod as text/plain.
@v/{version}.zip returns the module archive as application/zip.

`PUT /go/{owner}/{repo}/{module}/@v/{version}.{mod,zip}`

Publishes a module version. Only .mod and .zip uploads are accepted: PUT the .zip source archive and the .mod file for the version (the two are merged onto the same version record). Each returns 201 Created.

Example

GOPROXY=https://api.gitvetrix.com/go/alice/app/ \
GONOSUMCHECK=1 \
  go get example.com/mod@v1.0.0

For an authenticated module path, configure the credential through a .netrc entry for the API host (or the GOAUTH mechanism) so the toolchain sends the bearer token.

Errors

Errors use the shared status-code conventions in errors.md: 400 (an unparseable module path, or a publish that is not .mod/.zip), 401 (missing credential on publish, with a Bearer challenge), 403 (authenticated but not a writer), and 404 (unknown module or version, or a private repository the caller may not read).

Rate limits

Metered under the registry scope. See rate-limits.md.