{
  "opencollection": "1.0.0",
  "info": {
    "name": "npm Public API",
    "version": "1.0.0"
  },
  "request": {
    "auth": {
      "type": "bearer",
      "token": "{{bearerToken}}"
    }
  },
  "items": [
    {
      "info": {
        "name": "Tokens",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "List access tokens",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://registry.npmjs.org/-/npm/v1/tokens",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Page number for paginated results."
              },
              {
                "name": "perPage",
                "value": "",
                "type": "query",
                "description": "Number of tokens to return per page."
              }
            ]
          },
          "docs": "Retrieves a list of the authenticated user's active npm access tokens. Token UUIDs are redacted in the response, but each token object includes a key attribute containing the hexadecimal SHA-512 hash of the token for identification purposes."
        },
        {
          "info": {
            "name": "Create an access token",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://registry.npmjs.org/-/npm/v1/tokens",
            "headers": [
              {
                "name": "npm-otp",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Creates a new npm access token with customizable permissions, scope restrictions, expiration settings, and CIDR IP range limitations. The response includes the full token value, which is only returned once and cannot be retrieved again."
        },
        {
          "info": {
            "name": "Delete an access token",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://registry.npmjs.org/-/npm/v1/tokens/token/:token_id",
            "headers": [
              {
                "name": "npm-otp",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "token_id",
                "value": "",
                "type": "path",
                "description": "The token key hash or UUID identifying the token to delete."
              }
            ]
          },
          "docs": "Deletes an npm access token by its identifier. Note that the token may remain valid in cache for up to one hour after deletion."
        }
      ]
    },
    {
      "info": {
        "name": "OIDC",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Exchange an OIDC token for an npm token",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://registry.npmjs.org/-/npm/v1/security/oidc/tokens",
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "bearer",
              "token": "{{bearerToken}}"
            }
          },
          "docs": "Exchanges a valid OIDC identity token from a supported CI/CD provider for a short-lived npm registry access token. The OIDC token must be provided as a Bearer token in the Authorization header. The provider must be pre-configured as a trusted publisher for the target package."
        }
      ]
    },
    {
      "info": {
        "name": "Trusted Publishers",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "List trusted publishers for a package",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://registry.npmjs.org/-/npm/v1/security/trusted-publishers/packages/:package",
            "params": [
              {
                "name": "package",
                "value": "",
                "type": "path",
                "description": "The name of the package, URL-encoded for scoped packages (e.g., @scope%2Fpackage)."
              }
            ]
          },
          "docs": "Retrieves the trusted publisher configurations for a given package. Each configuration specifies a CI/CD provider and the conditions under which it is trusted to publish."
        },
        {
          "info": {
            "name": "Add a trusted publisher for a package",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://registry.npmjs.org/-/npm/v1/security/trusted-publishers/packages/:package",
            "params": [
              {
                "name": "package",
                "value": "",
                "type": "path",
                "description": "The name of the package, URL-encoded for scoped packages (e.g., @scope%2Fpackage)."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Configures a new trusted publisher for a package. This allows the specified CI/CD provider to publish the package using OIDC token exchange without requiring long-lived npm tokens. Only users with write permissions on the package can configure trusted publishers."
        },
        {
          "info": {
            "name": "Remove a trusted publisher from a package",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://registry.npmjs.org/-/npm/v1/security/trusted-publishers/packages/:package/:publisher_id",
            "params": [
              {
                "name": "package",
                "value": "",
                "type": "path",
                "description": "The name of the package, URL-encoded for scoped packages (e.g., @scope%2Fpackage)."
              },
              {
                "name": "publisher_id",
                "value": "",
                "type": "path",
                "description": "The identifier of the trusted publisher configuration to remove."
              }
            ]
          },
          "docs": "Removes a trusted publisher configuration from a package, revoking the CI/CD provider's ability to publish via OIDC token exchange."
        }
      ]
    }
  ],
  "bundled": true
}