canonical: https://jentic.com/apis/amazonaws.com/codeartifact

# AWS CodeArtifact

Jentic publishes the only available OpenAPI specification for AWS CodeArtifact, keeping it validated and agent-ready. AWS CodeArtifact is a managed artifact repository for npm, PyPI, Maven, NuGet, generic, and Swift packages. The API covers domains, repositories, package versions, upstream connections, and authorization tokens, so an agent can publish, retrieve, copy, and clean up packages across an organization without managing repository servers.

## For AI agents

Manage AWS CodeArtifact domains, repositories, and package versions across npm, PyPI, Maven, and NuGet, plus mint authorization tokens for build-time access. Backed by 38 endpoints spanning domain, repository, and package operations.

## Scope

Does not handle source code hosting, container image storage, or build orchestration - use for npm, PyPI, Maven, NuGet, Swift, and generic package repository management only.

## Capabilities

- Create and configure CodeArtifact domains and repositories with upstream sources
- Publish, copy, and dispose package versions across npm, PyPI, Maven, NuGet, and Swift formats
- Mint short-lived authorization tokens for CI builds via GetAuthorizationToken
- Associate or disassociate external connections to public registries like npmjs.org or PyPI
- Attach and update domain and repository permissions policies for cross-account access
- List and describe package versions, including their assets and origin metadata
- Tag CodeArtifact domains and repositories for cost allocation and ownership

## Use cases

### Internal Package Registry for npm and PyPI

Engineering teams use CodeArtifact as a private npm and PyPI registry that proxies the public registries through an upstream connection. CreateRepository provisions the registry, AssociateExternalConnection wires up the public mirror, and GetAuthorizationToken issues a 12-hour token that CI runners use as the npm authToken or pip index-url credential. This consolidates package access behind IAM and removes long-lived registry passwords from build pipelines.

Example prompt: Create a repository named internal-npm in domain my-org with the public npm registry as an upstream, then mint an authorization token

### Promotion Pipeline Between Staging and Production Repositories

Teams that gate releases through manual or automated approvals publish first to a staging CodeArtifact repository and then promote approved versions with CopyPackageVersions. The API copies specific versions between repositories within the same domain, preserving asset hashes. ListPackageVersions and DescribePackageVersion let an agent confirm the version exists and is in the expected state before promotion.

Example prompt: Copy version 1.4.2 of package internal-utils from repository staging to repository prod inside domain my-org

### Vulnerability Cleanup Across Repositories

When a CVE is announced in a transitive dependency, an agent uses ListPackageVersions to find every cached copy and DeletePackageVersions or DisposePackageVersions to remove or mark them. This prevents new builds from pulling the vulnerable version while a fixed version is published. DescribePackage exposes origin configuration so the agent can confirm whether the package is internal or proxied from an upstream.

Example prompt: List versions of package log4j-core in repository internal-maven and dispose any version less than 2.17.1

### AI Agent Integration via Jentic

Through Jentic, an AI agent uses CodeArtifact by searching for an intent like 'mint a CodeArtifact authorization token', loading the GetAuthorizationToken schema, and executing it with a domain name. Jentic signs the SigV4 request server-side using IAM credentials in your Jentic One instance.

Example prompt: Search Jentic for 'mint a CodeArtifact authorization token', load the GetAuthorizationToken schema, and execute it for domain my-org with a 12-hour duration

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /v1/domain#domain | Create a new CodeArtifact domain |
| POST | /v1/repository#domain&repository | Create a repository inside a domain |
| POST | /v1/authorization-token#domain | Mint a short-lived authorization token |
| POST | /v1/package/versions/copy#domain&source-repository&destination-repository&format&package | Copy package versions between repositories |
| POST | /v1/repository/external-connection#domain&repository&external-connection | Connect a repository to a public registry |
| POST | /v1/package/versions/delete#domain&repository&format&package | Delete specific package versions |
| GET | /v1/package/version#domain&repository&format&package&version | Describe a single package version |
| GET | /v1/repository#domain&repository | Describe a repository |

## Key resources

- **Domain** — Create, describe, and delete CodeArtifact domains and manage their permissions policy
- **Repository** — Create, describe, update, and delete repositories within a domain
- **Package** — Describe packages, configure origins, and delete entire packages
- **Package Version** — List, describe, copy, delete, and dispose specific package versions
- **External Connection** — Associate and disassociate upstream public registries (npm, PyPI, Maven, NuGet)
- **Authorization Token** — Mint short-lived tokens used by package managers and CI

## Why Jentic

- **Setup:** Wiring AWS CodeArtifact by hand means holding an access key ID and secret access key, computing an AWS Signature Version 4 signature per request, resolving the correct regional codeartifact host, and passing domain and repository query parameters and handling retries yourself. Through Jentic you install once, import AWS CodeArtifact from the API Directory, store the AWS access key once, and your agent calls it.
- **Permission scoping:** CodeArtifact passes the domain and repository as query parameters rather than fixed URL path segments, so scope your agent by the operations it needs, such as getting an authorization token or reading a package version. You choose which operations it may call, so changes like copying or deleting package versions are not included unless you add them.
- **Credential handling:** Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'mint a CodeArtifact authorization token' or 'copy a package version between repositories', and Jentic returns the matching CodeArtifact operation with its input schema so the agent calls the right endpoint without crawling the AWS reference.

## Related APIs

- **GitHub** — GitHub Packages provides multi-format package hosting tied to GitHub repositories
- **AWS CodeCommit** — CodeCommit hosts source repositories whose builds publish to CodeArtifact
- **AWS CodePipeline** — CodePipeline orchestrates build and deploy stages that read from and publish to CodeArtifact

## FAQ

### Why is there no official OpenAPI spec for AWS CodeArtifact?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS CodeArtifact via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the AWS CodeArtifact API use?

CodeArtifact uses AWS Signature Version 4 (HMAC) signed requests with an IAM access key ID and secret. For package manager (npm, pip, mvn) access, GetAuthorizationToken returns a separate short-lived bearer token. Through Jentic, IAM credentials live in your Jentic One instance and SigV4 signing happens server-side.

### Can I copy package versions between repositories with this API?

Yes. Call CopyPackageVersions with the source-repository, destination-repository, format (npm, pypi, maven, nuget, generic, swift), package name, and an array of versions. Both repositories must live in the same domain and the agent's IAM principal needs codeartifact:CopyPackageVersions on both.

### How long does a CodeArtifact authorization token last?

GetAuthorizationToken accepts a durationSeconds value between 900 (15 minutes) and 43200 (12 hours), defaulting to 12 hours. Set durationSeconds to 0 to inherit the maximum session duration of the calling IAM role. The token is scoped to the domain, not a specific repository.

### What are the rate limits for the AWS CodeArtifact API?

AWS enforces per-account, per-region throttling on CodeArtifact control-plane calls; throttled requests return ThrottlingException. Package read operations through the package manager endpoints are billed and throttled separately from the management API. Use exponential backoff via the AWS SDKs that Jentic wraps.

### How do I publish to a CodeArtifact repository through Jentic with an AI agent?

Run pip install jentic, then have the agent search for 'mint a CodeArtifact authorization token', load the GetAuthorizationToken schema, and execute it. The returned token can then be exported as the CODEARTIFACT_AUTH_TOKEN env var for npm, pip, or Maven publish commands.

### Can I limit what my agent is allowed to do with the AWS CodeArtifact API?

Yes. Because you run Jentic One yourself, your own rules decide which CodeArtifact operations and AWS credentials the agent may use. CodeArtifact takes the domain and repository as query parameters rather than fixed URL paths, so you scope the agent to only the operations it needs, such as getting an authorization token or describing a package version. Higher-impact actions like copying or deleting package versions stay out of reach unless you explicitly grant them.