canonical: https://jentic.com/apis/myget.org/myget

# MyGet API

Jentic publishes the only available OpenAPI specification for MyGet API, keeping it validated and agent-ready. MyGet is a hosted package repository service that proxies and republishes NuGet, npm, Maven, PyPI, VSIX, and Symbols feeds for engineering teams that need private or curated package distribution. The API exposes both protocol-level endpoints under `/F/{feedName}` (NuGet V2 OData and V3 index, npm, Maven, PyPI, VSIX) and a management surface under `/api/v1/feeds` for creating feeds, listing packages, and configuring privileges. Authentication accepts an X-NuGet-ApiKey header or HTTP basic credentials.

## For AI agents

Provision MyGet feeds and publish, list, or delete NuGet, npm, Maven, and PyPI packages using a NuGet API key or basic auth.

## Scope

Does not handle source control, container image registries, or build orchestration - use for hosted NuGet/npm/Maven/PyPI/VSIX feed management only.

## Capabilities

- Create, configure, and delete private MyGet feeds for an organisation
- Push, download, and delete NuGet packages by ID and version against a feed
- Search packages within a feed using the NuGet V2 OData /Search() operation
- Resolve npm, Maven, PyPI, and VSIX packages through their MyGet protocol endpoints
- Mint short-lived feed access tokens via `/F/{feedName}/auth/token` for downstream tooling
- Manage feed privileges to grant read or push access to specific principals

## Use cases

### CI/CD Package Publishing

Publish build artifacts from a CI pipeline to a private MyGet feed using PUT `/F/{feedName}/api/v2/package/{packageId}/{version}.` The pipeline authenticates with X-NuGet-ApiKey, pushes the .nupkg, and the package is immediately available to downstream consumers via the V3 index. This replaces brittle file-share publishing with a versioned, queryable package registry.

Example prompt: Call PUT `/F/our-internal/api/v2/package/Acme.Library/1.4.2` with the .nupkg payload and the X-NuGet-ApiKey header to publish the build.

### Multi-Protocol Package Aggregation

Use a single MyGet feed as a unified source for NuGet, npm, Maven, and PyPI dependencies inside a polyglot codebase. Each language's package manager points at the appropriate protocol endpoint - `/api/v3/index.json` for NuGet, `/npm/{packageName}` for npm, `/maven/{groupPath}/{artifactId}/{version}/{fileName}` for Maven, and /pypi for PyPI. This consolidates package governance into one feed with one set of credentials.

Example prompt: Resolve the npm package @acme/cli by calling GET `/F/our-feed/npm`/@acme%2Fcli and Maven artifact com.acme:lib:1.0 by calling GET `/F/our-feed/maven/com/acme/lib/1.0/lib-1.0.jar.`

### Feed Provisioning and Access Control

Provision a new MyGet feed for a project team and grant access via the management API. The integration calls POST `/api/v1/feeds` to create the feed, then POST `/api/v1/feeds/{feedName}/privileges` to grant read or push rights to specific principals. This automates onboarding for new repos that need their own private feed without manual portal clicks.

Example prompt: Call POST `/api/v1/feeds` with the new feed name, then POST `/api/v1/feeds/{feedName}/privileges` to grant push rights to the team's CI service account.

### AI Agent Package Operator

An AI agent maintains a fleet of MyGet feeds for a developer platform team. It searches Jentic for MyGet operations, loads the feed creation and package push schemas, and chains GET `/api/v1/feeds`, POST `/api/v1/feeds`, and PUT package operations to create feeds on demand and migrate packages between them. Jentic isolates the X-NuGet-ApiKey so the agent never sees the raw secret.

Example prompt: Search Jentic for 'create a MyGet feed', execute POST `/api/v1/feeds`, then push three required packages with PUT `/F/{feedName}/api/v2/package/{packageId}/{version}.`

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/F/{feedName}/api/v3/index.json` | NuGet V3 service index |
| PUT | `/F/{feedName}/api/v2/package/{packageId}/{version}` | Push a NuGet package to a feed |
| DELETE | `/F/{feedName}/api/v2/package/{packageId}/{version}` | Delete a NuGet package version |
| GET | `/F/{feedName}/api/v2/Search()` | Search packages in a feed |
| GET | `/F/{feedName}/auth/token` | Mint a per-feed access token |
| POST | `/api/v1/feeds` | Create a new feed |
| GET | `/api/v1/feeds/{feedName}/packages` | List packages in a feed |
| POST | `/api/v1/feeds/{feedName}/privileges` | Add a feed privilege for a principal |

## Key resources

- **Feeds (V1 management)** — Create, list, update, delete feeds and configure feed privileges via `/api/v1/feeds.`
- **NuGet V2 packages** — OData package list, search, push, download, and delete on `/F/{feedName}/api/v2.`
- **NuGet V3 index** — Service index discovery on `/F/{feedName}/api/v3/index.json` for NuGet V3 clients.
- **npm feed** — Resolve npm packages and metadata against a MyGet feed via `/F/{feedName}/npm.`
- **Maven feed** — Download Maven artifacts via `/F/{feedName}/maven/{groupPath}/{artifactId}/{version}/{fileName}.`
- **PyPI and VSIX feeds** — Simple-index PyPI and VSIX endpoints under `/F/{feedName}/pypi` and `/F/{feedName}/vsix.`
- **Auth tokens** — Mint per-feed access tokens via `/F/{feedName}/auth/token` for downstream tooling.
- **Public gallery** — Read the public MyGet gallery via `/api/v1/gallery.`

## Why Jentic

- **Setup:** Wiring the MyGet API by hand means handling two auth modes, the X-NuGet-ApiKey header and basic auth, and picking between the V2 OData, V3 index, and management endpoints for each feed yourself. Through Jentic you install once, import the MyGet API from the API Directory, store the credentials once, and your agent calls it.
- **Permission scoping:** MyGet puts the feed name in the URL path (`/F/{feedName}/...`), so a rule can pin your agent to one feed: it can read its index or push packages there and nothing else. You choose the operations it may call, so a destructive call like deleting a package version is not included unless you add it.
- **Credential handling:** Your MyGet API key and basic credentials are stored once, encrypted, by your own Jentic One instance and injected per operation at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'push a nuget package to a private feed' or 'list feed packages', and Jentic returns the matching MyGet operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **PyPI API** — PyPI is the public Python package index and a direct comparison for MyGet's PyPI proxy when packages can be public.
- **Docker Engine API** — Docker Engine handles container image distribution that complements MyGet's NuGet/npm/Maven coverage.
- **GitHub REST API** — GitHub Packages provides another private package registry that often co-exists with MyGet for repo-bound distribution.

## FAQ

### Why is there no official OpenAPI spec for MyGet API?

MyGet does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MyGet API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the MyGet API use?

The MyGet API accepts two schemes: an `X-NuGet-ApiKey` header for package operations and HTTP basic authentication for management endpoints. Through Jentic, both credential types are stored in the encrypted vault and injected per operation, so agent prompts never see raw API keys.

### Can I push a NuGet package with the MyGet API?

Yes. Call PUT `/F/{feedName}/api/v2/package/{packageId}/{version}` with the .nupkg as the request body and the X-NuGet-ApiKey header. The package is added to the feed and surfaced through the V2 OData and V3 index endpoints to downstream NuGet clients.

### How do I create a new feed through Jentic?

Search Jentic for 'create a MyGet feed', load the POST `/api/v1/feeds` schema, and execute it with the new feed name and configuration. Chain POST `/api/v1/feeds/{feedName}/privileges` in the same agent run to grant access to your CI principal.

### Does MyGet support npm and Maven through the same feed?

Yes. The same feed exposes protocol-specific endpoints - `/npm/{packageName}` for npm metadata, `/maven/{groupPath}/{artifactId}/{version}/{fileName}` for Maven artifacts, and /pypi for the PyPI simple index. A polyglot project can point all three package managers at one MyGet feed.

### What are the rate limits for the MyGet API?

The published spec does not define explicit numeric rate limits. Treat package push and search endpoints as throttled in CI, implement exponential backoff on 429 responses, and contact MyGet support for plan-specific quotas before bulk migrations.

### Can I limit what my agent is allowed to do with the MyGet API?

Yes. Because you run Jentic One yourself, your own rules decide which MyGet operations and credentials the agent may use. MyGet puts the feed name in the URL path (`/F/{feedName}/...`), so you can pin the agent to a single feed and let it only read the V3 index (GET `/F/{feedName}/api/v3/index.json`) or push packages (PUT `/F/{feedName}/api/v2/package/{packageId}/{version}`) there. You choose which endpoints it may call, so a destructive operation like DELETE `/F/{feedName}/api/v2/package/{packageId}/{version}` stays out of reach unless you explicitly grant it.