Search packagesSearch the PHP package registry for packages by name, description and keyword, or browse it by tag or by Composer type. Each hit carries the package's description, its repository, its all-time downloads and its popularity, so a shortlist needs one step rather than one per candidate. The starting point for 'what is there for X in PHP?'. No account or API token required.
Get a packageGet everything Packagist publishes about a package: what it is, its latest stable release, its licence, its repository, its maintainers, how many times it has been installed all time and in the last month, how many other packages depend on it, and its GitHub stars, forks and open issues. Also reports whether its author has marked it abandoned and what they suggest instead. The starting point for almost any workflow about a package. No account or API token required.
List a package's versionsList the versions a package has published, each with the date it went out, its licence, the PHP version it needs, the commit it was built from and whether it is a tagged release or a branch. Ordered by version number rather than by date, so a back-ported fix released last week does not appear to be the newest release. Use it to build a release history, to see how often a project ships, or to find every version still on a supported line. No account or API token required.
Get one versionGet one version's composer.json, whole: its description, authors, licence, keywords, autoload rules, executables, support links, funding links and every dependency block. Leave the version blank for the latest stable release, which is what Composer would install. Naming a branch such as dev-main works too. No account or API token required.
List a package's dependenciesList what one version of a package depends on, with the version constraint it asks for. Package dependencies and platform requirements (php, ext-json and the like) are returned separately, because an audit almost always wants them counted apart. Choose which blocks to read - what it needs to run, what it needs to test, what it suggests, what it provides, conflicts with or replaces. No account or API token required.
Get a package's download statsGet a package's install counts - all time, the last month and the last day - along with every version it has published and the date Packagist started counting. The cheapest way to track adoption, and the step to chain when a workflow needs a package's version list without its whole manifest. No account or API token required.
List package namesList package names, filtered by vendor or by Composer type - every package one organization publishes, or every plugin of a given kind in the registry. Optionally return each name's repository, type and abandoned status alongside it. Use it to inventory what a team publishes, or to audit a whole class of package. Unfiltered this covers all 460,000+ packages, so it is cut to a length you choose. No account or API token required.
List popular packagesList the most-downloaded packages on Packagist, ranked by downloads over the past week rather than all time - so a package that was popular years ago does not hold the top spot. Each carries its description, downloads and popularity. Use it to see what the PHP ecosystem is actually installing today. No account or API token required.
List security advisoriesCheck packages for known vulnerabilities, or fetch every advisory published since a moment. Each carries its CVE, its severity, the exact version range affected and where it was disclosed - so a workflow can decide whether the version you run is one of them. Packages Packagist knows and has nothing on are reported separately from ones it has never heard of, which is the difference between 'clean' and 'misspelled'. The step for a scheduled dependency audit. No account or API token required.
List recent package changesList every package whose metadata changed since a moment - the feed Composer mirrors poll. Each entry says which package changed, whether a release or a branch moved, and when. Run it once with the moment blank to get the cursor to start from, then hand each run's 'next since' to the next. Packagist keeps 24 hours of history, and says so when you ask for more. No account or API token required.
Get registry statisticsGet Packagist's own totals: how many packages it hosts, how many versions those add up to, and how many times anything has been installed. One small request, useful for a dashboard tile or for putting a single package's downloads in proportion. No account or API token required.
