GitHub APIapi.github.com ↗
Fetch parsed package.json manifests from any public GitHub repository. Returns scripts, dependencies, devDependencies, engines, version, and more.
What is the GitHub API?
This API exposes one endpoint, get_package_manifest, that reads a package.json file from any public GitHub repository and returns 11 structured fields including the package name, version, npm scripts, and all dependency maps. You can target a specific branch, tag, or commit SHA, and point to any repository-relative path such as frontend/package.json for monorepo sub-packages.
curl -X GET 'https://api.parse.bot/scraper/ea66bd2d-e1ee-4e4f-b76b-2e726ceecb36/get_package_manifest?path=frontend%2Fpackage.json&repo=adsb-history&owner=bellingcat' \ -H 'X-API-Key: $PARSE_API_KEY'
Typed, relational, agent-ready
A generated client with real types, enums, and the links between objects — the structure a flat JSON response can't carry. Autocompletes in your editor and reads cleanly to coding agents.
- Fully typed · autocompletes
- Objects link to objects
- Typed errors & pagination
Typed Python client. Set up the SDK in your uv project, then pull this API’s typed client:
uv add parse-sdk uv run parse init uv run parse add --marketplace api-github-com-api
uv run parse add --marketplace pulls a pinned snapshot of this canonical API — it won’t change underneath you. To customize it, subscribe and swap to your own copy.
"""Walkthrough: GitHub Package Manifest API — fetch and inspect a package.json."""
from parse_apis.api_github_com_api import GitHub, ManifestNotFound
client = GitHub()
# Fetch the root package.json for a well-known public repository.
try:
manifest = client.manifests.get(owner="vuejs", repo="core")
except ManifestNotFound:
print("Repository or manifest not found")
raise
print(f"{manifest.name} v{manifest.version} ({manifest.owner}/{manifest.repo})")
print(f"module type: {manifest.module_type} size: {manifest.size} bytes")
print(f"web: {manifest.html_url}")
# List available npm scripts (typed Command objects).
print("\nscripts:")
for cmd in manifest.commands:
print(f" {cmd.name}: {cmd.command}")
# Inspect runtime dependency counts via the typed DependencyCount object.
counts = manifest.dependency_counts
print(f"\ndependency counts — runtime: {counts.dependencies}, dev: {counts.dev_dependencies}")
# Browse the actual dependency map (package -> version range).
print("\nruntime dependencies:")
for pkg, version_range in sorted(manifest.dependencies.items()):
print(f" {pkg}: {version_range}")
# Fetch a manifest from a subdirectory on a specific branch.
frontend = client.manifests.get(owner="bellingcat", repo="adsb-history", path="frontend/package.json", ref="main")
print(f"\n{frontend.owner}/{frontend.repo} ({frontend.path}): {frontend.name}")
print("\nexercised: manifests.get / Command / DependencyCount / dependencies map")
Fetches one package.json file from a public GitHub repository and returns its parsed manifest: package name and version, npm scripts as both a name->command map (scripts) and a list of {name, command} rows (commands), and the dependencies, dev_dependencies, peer_dependencies and optional_dependencies maps of package -> version range, plus engines, packageManager and workspaces when declared. One round trip per call; the result is a single object, never paginated. Fields the manifest does not declare are null (scalars) or empty objects (maps). A path that does not exist in the repository at the requested ref returns a stale_input error (input_not_found); a path that resolves to a directory returns stale_input (input_format_invalid); a file that is not valid JSON returns extraction_failed. Private repositories are not accessible. Unauthenticated GitHub access is rate limited (about 60 requests per hour per network address); exceeding it surfaces as an upstream_error with status 403.
| Param | Type | Description |
|---|---|---|
| ref | string | Branch name, tag, or commit SHA to read the file from. Omitted = the repository's default branch; the response echoes 'default branch' in ref in that case. |
| path | string | Repository-relative path of the manifest file, e.g. frontend/package.json for a package in a subdirectory. Omitted = the package.json at the repository root. |
| reporequired | string | Repository name within the owner's account (e.g. adsb-history). |
| ownerrequired | string | GitHub user or organization that owns the repository (e.g. bellingcat). |
{
"type": "object",
"fields": {
"ref": "the requested ref, or 'default branch' when none was supplied",
"sha": "git blob SHA of the manifest file",
"name": "package name from the manifest, null when not declared",
"path": "path of the manifest file within the repository",
"repo": "repository name as supplied",
"size": "manifest file size in bytes (integer)",
"owner": "repository owner as supplied",
"engines": "object of engine -> version range constraints, empty when not declared",
"private": "boolean private flag from the manifest, null when not declared",
"scripts": "object of script name -> shell command (the project's runnable commands)",
"version": "package version string, null when not declared",
"commands": "array of {name, command} rows, one per entry in scripts, in manifest order",
"html_url": "GitHub web URL of the file",
"workspaces": "workspaces declaration (array or object) or null when not declared",
"description": "package description, null when not declared",
"module_type": "value of the manifest 'type' field (module/commonjs), null when not declared",
"dependencies": "object of package -> version range for runtime dependencies",
"package_manager": "value of the manifest packageManager field, null when not declared",
"dev_dependencies": "object of package -> version range for devDependencies",
"dependency_counts": "object with integer counts of each dependency map",
"peer_dependencies": "object of package -> version range for peerDependencies",
"optional_dependencies": "object of package -> version range for optionalDependencies"
},
"sample": {
"data": {
"ref": "main",
"sha": "f51fc14bcaa88ea7ae2be6a4f75b96c3d654a18f",
"name": "adsb-history-frontend",
"path": "frontend/package.json",
"repo": "adsb-history",
"size": 799,
"owner": "bellingcat",
"engines": {},
"private": true,
"scripts": {
"dev": "vite",
"build": "vite build",
"format": "prettier --write src/",
"preview": "vite preview"
},
"version": "0.0.0",
"commands": [
{
"name": "dev",
"command": "vite"
},
{
"name": "build",
"command": "vite build"
},
{
"name": "preview",
"command": "vite preview"
},
{
"name": "format",
"command": "prettier --write src/"
}
],
"html_url": "https://github.com/bellingcat/adsb-history/blob/main/frontend/package.json",
"workspaces": null,
"description": null,
"module_type": "module",
"dependencies": {
"vue": "^3.5.13",
"uuid": "^11.1.0",
"axios": "^1.6.7",
"pinia": "^3.0.1",
"geojson": "^0.5.0",
"vuetify": "^3.8.0",
"chart.js": "^4.4.8",
"firebase": "^10.8.0",
"@mdi/font": "^7.4.47",
"maplibre-gl": "^2.3.0",
"vue-chartjs": "^5.3.2",
"vue-maplibre-gl": "^2.0.0",
"@mapbox/mapbox-gl-draw": "^1.4.3"
},
"package_manager": null,
"dev_dependencies": {
"vite": "^6.2.4",
"prettier": "3.5.3",
"@types/geojson": "^7946.0.16",
"@vitejs/plugin-vue": "^5.2.3",
"vite-plugin-vue-devtools": "^7.7.2"
},
"dependency_counts": {
"dependencies": 13,
"dev_dependencies": 5,
"peer_dependencies": 0,
"optional_dependencies": 0
},
"peer_dependencies": {},
"optional_dependencies": {}
},
"status": "success"
}
}About the GitHub API
What the endpoint returns
The get_package_manifest endpoint accepts four parameters: owner and repo (both required) identify the repository, while ref and path are optional. Omit ref to read from the default branch; the response echoes back 'default branch' as the ref value so you always know what was resolved. Omit path to read from the root package.json.
Response fields
The parsed response includes name and version from the manifest itself, a scripts object mapping each script name to its shell command, and engines for runtime version constraints. Dependency data comes back as dependencies, dev_dependencies, and peer_dependencies — each as a name-to-version-range object. The response also includes file-level metadata: sha (the git blob SHA), size in bytes, and the resolved path and ref. The private flag is returned as a boolean or null when absent.
Targeting specific revisions
Passing a branch name, tag, or full commit SHA in ref lets you pin reads to a point in time or compare manifests across releases. This is useful for auditing dependency changes between tagged versions, verifying what packages shipped in a specific release, or tracking when a script was added or renamed.
Scope and limitations
The endpoint reads a single file per call and covers only fields defined in the package.json specification. It does not return package-lock.json, yarn.lock, or resolved transitive dependency trees — only the direct declarations in the manifest.
The GitHub API is a managed, monitored endpoint for api.github.com — not a raw scraper you maintain. Every endpoint is automatically health-checked on a schedule, and when api.github.com changes and a check fails, the API is automatically queued for repair and re-verified. It is built to keep working as the site underneath it changes.
This isn't an official api.github.com API — it's an independent, maintained REST wrapper over public data. Where the source has no official API (or only a limited one), Parse gives you a stable contract over a source that never promised one, and keeps it current. Need a new endpoint or field? You can revise it yourself in plain English and the agent rebuilds it against the live site in minutes — contributing the change back to the shared API is free.
Will this API break when the source site changes?+
Is this an official API from the source site?+
Can I fix or extend this API myself if I need a new endpoint or field?+
What happens if I call an endpoint that has an issue?+
- Audit dependency versions across multiple public repositories by comparing the
dependenciesanddev_dependenciesfields. - Check which npm scripts a project exposes (build, test, lint, etc.) before contributing or integrating.
- Track when a package's declared
enginesconstraints change between tagged releases using therefparameter. - Verify the
nameandversionof a sub-package in a monorepo by settingpathto its directory. - Monitor whether the
privateflag is set on a repository's manifest as part of an open-source compliance check. - Compare
devDependenciesacross projects to standardize tooling across a portfolio of repositories. - Retrieve the git blob
shato detect file changes without fetching full repository history.
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 200 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 100 req/min |
| Team | $300/mo | 20,000 | 300 req/min |
| Company | $1,000/mo | 100,000 | 500 req/min |
Each endpoint has a fixed posted price per successful call — most fall between 1 and 10 credits — shown on this API's page before you run it. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does GitHub have an official developer API?+
What does `get_package_manifest` return for dependencies?+
dependencies (runtime), dev_dependencies (development-only), and peer_dependencies. Each maps package names to their declared version range strings exactly as written in the manifest. If a category is absent from the file, the corresponding field is an empty object.Can this endpoint read `package-lock.json` or `yarn.lock` to get resolved transitive dependencies?+
package.json only — direct dependencies and devDependencies, scripts, engines, name, and version. Resolved lockfile data is not included. You can fork the API on Parse and revise it to add an endpoint that reads and parses lockfile formats.Does the API work with private repositories?+
Can I read multiple `package.json` files from a monorepo in one call?+
path parameter lets you target any subdirectory, but one call resolves one file. You can fork the API on Parse and revise it to add a batch endpoint that accepts a list of paths and returns all manifests in one response.