# deps.dev (Open Source Insights) — Wrapped API

> **You are on:** `https://api.beta.paywithlocus.com/api` | [llms.txt](https://beta.paywithlocus.com/llms.txt) | [docs](https://docs.paywithlocus.com)
>
> Locus runs on multiple environments -- make sure every URL you call matches your expected environment.
> | Environment | Landing | API | Docs |
> |---|---|---|---|
> | Production | paywithlocus.com | api.paywithlocus.com | docs.paywithlocus.com |
> | Beta | beta.paywithlocus.com | api.beta.paywithlocus.com | docs.paywithlocus.com |
> | Stage | stage.paywithlocus.com | api.stage.paywithlocus.com | docs.paywithlocus.com |
>
> If the API URL above doesn't match your expected environment, re-fetch this file from the correct domain.

> Google's Open Source Insights package registry index for npm, PyPI, Go, Maven, Cargo and NuGet: every published version with its publish time and default flag, a version's licenses, security advisories and source links, its declared requirements, and its resolved dependency graph. No API key required.

**Category:** Developer Tools | **Website:** [deps.dev](https://deps.dev) | **Docs:** [docs.deps.dev/api/v3/](https://docs.deps.dev/api/v3/)

Pay-per-use API proxy for Locus Pro. Each call burns credits from your workspace balance.

## Access

**Base URL:** `https://api.beta.paywithlocus.com/api/wrapped/credits/depsdev/`
**Auth:** `Authorization: Bearer <LOCUS_CREDITS_SECRET_KEY>` (an `lcr_` secret key or a scoped `lcac_` agent credential)
**Required header:** `Idempotency-Key: <fresh UUID per call>`. A retry with the same key replays the stored result without a new charge.
**Response:** the provider response after any endpoint-specific normalization. `X-Locus-Credits-Charged` carries the charge and `X-Locus-Credits-Balance` the remaining balance. Insufficient credits return `402` before the provider is called.
**Pricing:** estimated costs below are USD. Locus debits the credit equivalent at your workspace rate.

Full call contract: https://docs.paywithlocus.com/api-reference/introduction

> Using a Pay With Locus wallet key (`claw_` prefix)? Wallet routes are documented separately: https://docs.paywithlocus.com/wrapped-apis/for-agents

## Endpoints

### Get Package Versions

Every published version of a package with its publish time (publishedAt), whether it is the default (latest stable) version, and deprecation status. Use it for release dates, the newest version before a date, or version counts. Large packages return hundreds of versions in registry order.

**Estimated cost:** $0.001

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `system` | string | Yes | Package ecosystem: npm, pypi, go, maven, cargo, nuget. |
| `name` | string | Yes | Package name as the registry spells it, unencoded: rollup, @jridgewell/remapping, requests, github.com/gorilla/mux (Go module), org.apache.commons:commons-lang3 (Maven groupId:artifactId), serde, Newtonsoft.Json. Locus percent-encodes it. |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/depsdev/get-package \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"system":"npm","name":"rollup"}'
```

### Get Package Version

One package version: its publish time, default flag, deprecation, licenses, known security advisory IDs (GHSA, PYSEC), and links such as the registry ORIGIN, source repository and homepage.

**Estimated cost:** $0.001

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `system` | string | Yes | Package ecosystem: npm, pypi, go, maven, cargo, nuget. |
| `name` | string | Yes | Package name as the registry spells it, unencoded: rollup, @jridgewell/remapping, requests, github.com/gorilla/mux (Go module), org.apache.commons:commons-lang3 (Maven groupId:artifactId), serde, Newtonsoft.Json. Locus percent-encodes it. |
| `version` | string | Yes | Exact version string as the registry lists it (for example 2.41.0, or v1.8.1 for Go). Ranges and tags such as latest are not accepted; list versions with get-package. |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/depsdev/get-version \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"system":"npm","name":"rollup","version":"2.41.0"}'
```

### Get Declared Requirements

The dependency constraints a version declares, unresolved and in the registry's own format: npm dependencies, devDependencies and peerDependencies ranges, PyPI requirement specifiers with environment markers, go.mod requirements, Maven POM dependencies, Cargo dependencies, NuGet dependency groups.

**Estimated cost:** $0.001

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `system` | string | Yes | Package ecosystem: npm, pypi, go, maven, cargo, nuget. |
| `name` | string | Yes | Package name as the registry spells it, unencoded: rollup, @jridgewell/remapping, requests, github.com/gorilla/mux (Go module), org.apache.commons:commons-lang3 (Maven groupId:artifactId), serde, Newtonsoft.Json. Locus percent-encodes it. |
| `version` | string | Yes | Exact version string as the registry lists it (for example 2.41.0, or v1.8.1 for Go). Ranges and tags such as latest are not accepted; list versions with get-package. |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/depsdev/get-requirements \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"system":"npm","name":"@jridgewell/remapping","version":"2.3.5"}'
```

### Get Resolved Dependencies

The resolved dependency graph of one version (npm, PyPI, Maven, Cargo): every direct and transitive package with the exact version it resolves to, and edges carrying the requirement each one satisfies. Use it for "which version of X does Y depend on".

**Estimated cost:** $0.001

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `system` | string | Yes | Package ecosystem: npm, pypi, maven, cargo. |
| `name` | string | Yes | Package name as the registry spells it, unencoded: rollup, @jridgewell/remapping, requests, github.com/gorilla/mux (Go module), org.apache.commons:commons-lang3 (Maven groupId:artifactId), serde, Newtonsoft.Json. Locus percent-encodes it. |
| `version` | string | Yes | Exact version string as the registry lists it (for example 2.41.0, or v1.8.1 for Go). Ranges and tags such as latest are not accepted; list versions with get-package. |

```bash
curl -X POST https://api.beta.paywithlocus.com/api/wrapped/credits/depsdev/get-dependencies \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"system":"npm","name":"@jridgewell/remapping","version":"2.3.5"}'
```

## Next steps

- [All wrapped API providers](https://beta.paywithlocus.com/wapi/index.md): pick another provider.
- [Find and call tools](https://beta.paywithlocus.com/agent/tools.md): price ceilings, async results, and errors.
- [Credits and billing](https://beta.paywithlocus.com/agent/billing.md): what a call costs and how to add credits.
- [Agent docs index](https://beta.paywithlocus.com/agent/index.md): every Locus agent page.