<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Auditing Package Registry Security — API Reference

## npm CLI Commands

```bash
# Organization management
npm org ls <org> --json                    # List members and roles
npm access ls-packages <org> --json        # Packages the org can access
npm access ls-collaborators <pkg> --json   # Who can publish a package

# Profile and auth
npm profile get --json                     # Current user profile + 2FA status
npm token list --json                      # List active tokens
npm token revoke <token-id>                # Revoke a token

# Audit trail
npm view <pkg> time --json                 # Publication timestamps
npm view <pkg> maintainers --json          # Current maintainers
```

## Docker Registry HTTP API v2

```bash
# Check authentication requirement
curl -s -o /dev/null -w "%{http_code}" https://registry/v2/

# List repositories
curl -s -H "Authorization: Bearer $TOKEN" https://registry/v2/_catalog

# List tags
curl -s -H "Authorization: Bearer $TOKEN" https://registry/v2/<name>/tags/list

# Get manifest
curl -s -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
  https://registry/v2/<name>/manifests/<reference>
```

## PyPI API

```bash
# Package metadata
curl -s https://pypi.org/pypi/<package>/json | jq '.info'

# Package releases
curl -s https://pypi.org/pypi/<package>/json | jq '.releases | keys'

# Check Trusted Publishers (via PyPI admin)
# Configured per-project at https://pypi.org/manage/project/<package>/settings/publishing/
```

## JFrog Artifactory REST API

```bash
# System health
curl -s -u user:pass https://artifactory/api/system/ping

# List repositories
curl -s -u user:pass https://artifactory/api/repositories

# Permission targets
curl -s -u user:pass https://artifactory/api/v2/security/permissions

# Access tokens
curl -s -u user:pass https://artifactory/api/security/token
```

## Security Checklist

| Control | npm | PyPI | Docker | Artifactory |
|---------|-----|------|--------|-------------|
| MFA enforcement | `npm profile` | PyPI settings | N/A | Admin config |
| Token rotation | `npm token` | API tokens | `docker login` | Access tokens |
| Publish IP allowlist | npm Enterprise | N/A | Registry config | Artifactory config |
| Audit logging | npm audit log | N/A | Registry logs | Access logs |
| Webhook alerts | npm hooks | N/A | Registry notifications | Webhooks |
