canonical: https://jentic.com/apis/packagist.com/packagist

# Packagist Private Packagist API

Private Packagist REST API for managing packages, teams, customers, and credentials in your organization's private Composer repository.

## For AI agents

Private Packagist REST API for managing packages, teams, customers, and credentials in your organization's private Composer repository.

## Scope

Provides access to Private Packagist API functionality as defined in the OpenAPI specification.

## Capabilities

- List all packages
- Create a new package
- Get a specific package
- Update a package
- Delete a package
- List customers with access to a package
- List security issues for a package

## Use cases

### Basic Private Packagist API Integration

Integrate Private Packagist API into your application to access its core functionality.

Example prompt: Use the Private Packagist API API to access vendor services and data.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /packages/ | List all packages |
| POST | /packages/ | Create a new package |
| GET | /packages/{packageId} | Get a specific package |
| PUT | /packages/{packageId} | Update a package |
| DELETE | /packages/{packageId} | Delete a package |
| GET | /packages/{packageId}/customers/ | List customers with access to a package |
| GET | /packages/{packageId}/security-issues/ | List security issues for a package |

## Key resources

- **Main API** — Primary Private Packagist API resources and operations

## Why Jentic

- **Setup:** Wiring Private Packagist by hand means choosing between its HMAC-SHA256 signed requests and token auth, then building the correct Authorization header for every package call. Through Jentic you install once, import the Private Packagist API from the API Directory, store the credentials once, and your agent calls it.
- **Permission scoping:** Private Packagist puts the package id in the URL path (/packages/{packageId}), so a rule can pin your agent to one package for reads like its customers and security issues. You choose the operations it may call, so destructive ones like deleting or updating a package are not included unless you add them.
- **Credential handling:** Your Private Packagist credentials are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list packages' or 'check a package's security issues', and Jentic returns the matching Private Packagist operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## FAQ

### What authentication does the Private Packagist API use?

The Private Packagist API uses apiKey authentication.

### How many endpoints does the Private Packagist API have?

The Private Packagist API has 32 endpoints available.

### Can I limit what my agent is allowed to do with the Private Packagist API?

Yes. Jentic One runs self-hosted on your own infrastructure, so your rules decide which Private Packagist operations and credentials your agent may use. Because the package id sits in the URL path (/packages/{packageId}), you can pin the agent to a single package and allow only read operations such as listing its customers or security issues. You choose which operations are exposed, so destructive calls like deleting or updating a package stay out of reach unless you explicitly add them.