PyPI registry

The PyPI registry serves Python packages over the PEP 503 simple index for pip and accepts uploads from twine. See README.md for the conventions shared by every registry protocol.

Resource overview

All endpoints are scoped to a repository and served under /pypi/{owner}/{repo}/ on the API host (https://api.gitvetrix.com). The simple index lives at /pypi/{owner}/{repo}/simple/; uploads post to the repository root.

Auth & scopes

Reads are governed by repository visibility; uploading requires registry write. The credential is a session or access-token JWT sent as Authorization: Bearer <token>. See Push scopes.

Endpoints

Method	Path	Summary
GET	/pypi/{owner}/{repo}/simple/	Index of all packages
GET	/pypi/{owner}/{repo}/simple/{package}/	Download links for a package's files
GET	/pypi/{owner}/{repo}/packages/{digest}/{filename}	Download a package file
POST	/pypi/{owner}/{repo}/	Upload a distribution

GET /pypi/{owner}/{repo}/simple/

Returns the repository's top-level simple index as an HTML page of anchor links, one per package — the PEP 503 listing pip consumes.

GET /pypi/{owner}/{repo}/simple/{package}/

Returns the per-package simple index: an HTML page of links to the package's distribution files, each carrying a #sha256=<hex> fragment for integrity verification. The endpoint also answers without the trailing slash.

GET /pypi/{owner}/{repo}/packages/{digest}/{filename}

Streams a distribution file (referenced by the links in the package index) as application/octet-stream.

POST /pypi/{owner}/{repo}/

Uploads a distribution. The body is multipart/form-data in the legacy PyPI upload format twine sends: name and version fields plus a content file part. Returns 201 Created. Invoke it through twine rather than by hand.

Example

pip install my-pkg --index-url https://api.gitvetrix.com/pypi/alice/app/simple/
twine upload --repository-url https://api.gitvetrix.com/pypi/alice/app/ dist/*

twine reads the credential from its username/password configuration; supply the JWT as the password.

Errors

Errors use the shared status-code conventions in errors.md: 400 (missing name/version or no content part), 401 (missing credential on upload, with a Bearer challenge), 403 (authenticated but not a writer), and 404 (unknown package or file, or a private repository the caller may not read).

Rate limits

Metered under the registry scope. See rate-limits.md.