Artifact Hub API

Search Helm charts, operators, Falco rules and other CNCF artefacts as JSON with no key. Includes security-scan summaries per package. Verified live example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the Artifact Hub API?

Artifact Hub, the CNCF's package discovery service, has a public REST API. `GET https://artifacthub.io/api/v1/packages/search?ts_query_web=nginx&limit=2` returns matching Helm charts and other artefacts with versions, star counts, repository details and a security report summary. No API key is required for search.

Artifact Hub indexes far more than Helm charts: Kubernetes operators, Falco rules, OPA policies, Tekton tasks, container images and Krew plugins all live in the same index, which is why the search result carries a numeric `category` and a numeric `repository.kind` rather than a friendly label. Those numbers are the discriminator you filter on, and they are documented in the API reference rather than being self-evident from the response.

The genuinely distinctive field is `security_report_summary`, a per-package count of critical, high, medium, low and unknown findings from Artifact Hub's own scanning. Very few package registries publish anything comparable, and it makes this API a reasonable first gate in a supply-chain policy: reject anything with criticals before a chart ever reaches a cluster. Note that total result counts arrive in a `Pagination-Total-Count` response header, not in the body.

Quick facts

Base URL: https://artifacthub.io/api/v1
Authentication: Search and read endpoints are anonymous. An API key is only needed for managing your own repositories.
Rate limit: Not published. Artifact Hub asks for a descriptive User-Agent and reasonable request volume.
Pricing: Free and open source, hosted by the CNCF.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Artifact Hub API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Search for Helm charts by keyword

GET https://artifacthub.io/api/v1/packages/search?ts_query_web=nginx&limit=2

curl

curl 'https://artifacthub.io/api/v1/packages/search?ts_query_web=nginx&limit=2'

JavaScript (fetch)

const res = await fetch("https://artifacthub.io/api/v1/packages/search?ts_query_web=nginx&limit=2");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://artifacthub.io/api/v1/packages/search?ts_query_web=nginx&limit=2", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "packages": [
    {
      "package_id": "bec45f52-fe90-46a1-b6eb-a3dcd9bb203f",
      "name": "nginx",
      "normalized_name": "nginx",
      "category": 5,
      "logo_image_id": "df8b0c56-3686-47ad-b3cf-44ab4c2ef096",
      "stars": 106,
      "description": "NGINX Open Source is a web server that can be also used as a reverse proxy, load balancer, and HTTP cache. Recommended for high-demanding sites due to its ability to provide faster content.",
      "version": "25.1.1",
      "app_version": "1.31.4",
      "deprecated": false,
      "has_values_schema": false,
      "signed": true,
      "signatures": [
        "cosign"
      ],
      "security_report_summary": {
        "low": 0,
        "high": 0,
        "medium": 0,
        "unknown": 0,
        "critical": 0
      },
      "all_containers_images_whitelisted": false,
      "production_organizations_count": 2,
      "ts": 1787159362,
      "repository": {
        "url": "https://charts.bitnami.com/bitnami",
        "kind": 0,
        "name": "bitnami",
        "official": false,
        "display_name": "Bitnami",
        "repository_id": "64117528-d525-41d6-862c-41a43207c431",
        "scanner_disabled": false,
        "organization_name": "bitnami",
        "verified_publisher": true,
        "organization_display_name": "Bitnami"
      }
    },
    {
      "package_id": "ba70c546-4f86-4d82-b414-0bd0f47fc731",
      "name": "nginx",
      "normalized_name": "nginx",
      "category": 5,
      "logo_image_id": "2e078225-f162-4fe7-bd80-bb6ccf0d8376",
      "stars": 7,
      "description": "Nginx is a high-perfo

Parameters

Parameter	Type	Required	Description
`ts_query_web`	string	Optional	Free-text search across package names and descriptions. `nginx`
`limit`	integer	Optional	Results per page, maximum 60. `2`
`offset`	integer	Optional	Zero-based offset for paging. The total is in the `Pagination-Total-Count` header. `20`
`kind`	integer	Optional	Artefact kind filter: 0 Helm charts, 1 Falco rules, 2 OPA policies, 3 OLM operators, and so on. `0`
`verified_publisher / official`	boolean	Optional	Restrict to verified publishers or officially recognised packages. `true`
`sort`	string	Optional	`relevance` or `stars`. `stars`

Response fields

packagesarray: The search results. The total match count is in the `Pagination-Total-Count` response header, not in the body.
package_idstring: UUID for the package. This is the stable key for fetching full details later.
name / normalized_namestring: Display name and its URL-safe form. Use the normalised value when building links.
version / app_versionstring: Chart version and the version of the application it packages. These differ and are frequently confused.
category / repository.kindinteger: Numeric enums, not labels. Map them via the API documentation before showing anything to a user.
security_report_summaryobject: Counts of `critical`, `high`, `medium`, `low` and `unknown` findings from Artifact Hub's scanner. Unusual and valuable for supply-chain gating.
signed / signaturesboolean / array: Whether the artefact is signed and by which scheme, typically `cosign`.
repositoryobject: Source repository details including `url`, `name`, `organization_name`, `official` and `verified_publisher`.
tsinteger: Last update time in Unix epoch SECONDS. Multiply by 1000 for JavaScript date constructors.

What you can build with the Artifact Hub API

Find a Helm chart for a piece of software and check its security findings first
Build an internal chart catalogue restricted to verified publishers
Block deployments of charts carrying critical vulnerabilities in CI
Compare competing charts for the same application by stars and scan results
Track when a chart you depend on last published an update

Common errors and how to fix them

400

An enum parameter received a label instead of a number.

Fix: `kind` and `category` are integers. Check the API docs for the mapping rather than sending `helm`.

Missing total count

You looked for a total in the response body.

Fix: Read the `Pagination-Total-Count` response header; the body contains only the current page.

Empty security_report_summary

Not every artefact has been scanned, particularly for non-container kinds.

Fix: Treat an absent report as unknown rather than as a clean result.

Artifact Hub API — frequently asked questions

Is the Artifact Hub API free?

Yes. Search and read endpoints are anonymous and need no key. Keys exist only for publishers managing their own repositories.

What is the difference between version and app_version?

`version` is the packaging version of the chart itself, while `app_version` is the version of the software it installs. A chart can publish several versions without the application changing at all.

Can I filter to Helm charts only?

Yes, pass `kind=0`. Artifact Hub indexes many artefact types, so without a kind filter your results will mix operators, policies and plugins with charts.

How reliable is the security report?

It comes from Artifact Hub's own scanning of container images referenced by a package. It is a useful first filter, not a substitute for scanning what you actually deploy.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Viewer

View JSON as a collapsible interactive tree online. Expand and collapse nodes, search keys and values, and copy the JSONPath of any node privately.

YAML to JSON Converter

Convert YAML to JSON online in your browser. Handles block scalars, flow collections, anchors and multi-document files — nothing is uploaded.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

Artifact Hub is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.