Debian Sources API

Search Debian source packages and browse their file trees as JSON, with no key. Covers every suite from oldstable to sid. Verified example and endpoint map.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the Debian Sources API?

Debian Sources provides a public JSON API over every source package in the Debian archive. `GET https://sources.debian.org/api/search/{query}/` returns exact and fuzzy package name matches, and further endpoints expose version lists, directory trees and individual file contents.

sources.debian.org indexes the actual source code of every package in every Debian suite, which makes this API useful well beyond Debian itself. Because Debian packages most of the free software world, it doubles as a searchable mirror of upstream releases with a stable, versioned URL for any file in any release, something upstream projects themselves rarely provide.

The search response splits results into `exact` and `other`, and that split is the API's most useful feature. `exact` is either the single matching package name or null, so you can tell an unambiguous lookup from a prefix match without string comparison. Note the trailing slash on the path: `/api/search/apache2/` works and dropping the final slash does not.

Quick facts

Base URL: https://sources.debian.org/api
Authentication: No key or account. The service is run by the Debian project.
Rate limit: Not published. Debian asks that automated clients be considerate and identify themselves with a User-Agent.
Pricing: Free.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the Debian Sources API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Search for a source package by name

GET https://sources.debian.org/api/search/apache2/

curl

curl 'https://sources.debian.org/api/search/apache2/'

JavaScript (fetch)

const res = await fetch("https://sources.debian.org/api/search/apache2/");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://sources.debian.org/api/search/apache2/", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "query": "apache2",
  "results": {
    "exact": {
      "name": "apache2"
    },
    "other": [
      {
        "name": "apache2-mod-xforward"
      },
      {
        "name": "apache2-mpm-itk"
      },
      {
        "name": "apache2-redirtoservname"
      },
      {
        "name": "libapache2-authcassimple-perl"
      },
      {
        "name": "libapache2-authcookie-perl"
      },
      {
        "name": "libapache2-authenntlm-perl"
      },
      {
        "name": "libapache2-mod-annodex"
      },
      {
        "name": "libapache2-mod-auth-cas"
      },
      {
        "name": "libapache2-mod-auth-gssapi"
      },
      {
        "name": "libapache2-mod-auth-mellon"
      },
      {
        "name": "libapache2-mod-auth-memcookie"
      },
      {
        "name": "libapache2-mod-auth-openid"
      },
      {
        "name": "libapache2-mod-auth-openidc"
      },
      {
        "name": "libapache2-mod-auth-pam"
      },
      {
        "name": "libapache2-mod-auth-pgsql"
      },
      {
        "name": "libapache2-mod-auth-plain"
      },
      {
        "name": "libapache2-mod-auth-pubtkt"
      },
      {
        "name": "libapache2-mod-auth-tkt"
      },
      {
        "name": "libapache2-mod-authn-sasl"
      },
      {
        "name": "libapache2-mod-authn-yolo"
      },
      {
        "name": "libapache2-mod-authn-yubikey"
      },
      {
        "name": "libapache2-mod-authnz-external"
      },
      {
        "name": "libapache2-mod-authnz-pam"
      },
      {
        "name": "libapache2-mod-authz-unixgroup"
      },
      {
        "name": "libapach

Parameters

Parameter	Type	Required	Description
`{query}`	path	Required	Package name or fragment to search for. Keep the trailing slash on the path. `apache2`
`/api/src/{package}/`	path	Optional	List every version of a package that exists across Debian suites. `apache2`
`/api/src/{package}/{version}/{path}/`	path	Optional	Browse a directory tree, or fetch one file's contents and metadata. `apache2/latest/debian/control/`
`/api/info/package/{package}/{version}/`	path	Optional	Summary metadata for one package version. `apache2/latest`

Response fields

querystring: The search term echoed back, useful when several requests are in flight.
results.exactobject or null: The exactly matching package as `{"name": "..."}`, or null when nothing matched exactly. Test this before falling back to fuzzy results.
results.otherarray: Fuzzy matches, each `{"name": "..."}`. For a common term this list can be long and is sorted alphabetically, not by relevance.
(src endpoint) versionsarray: For package endpoints, every packaged version with the suites that carry it, which is how you map `bookworm` or `sid` to a concrete version.

What you can build with the Debian Sources API

Find which Debian release ships a given upstream version of a library
Fetch a specific patched source file to compare against upstream
Check whether a package exists in stable before depending on it in a Dockerfile
Trace how Debian patches a package across suites for a security review
Build a code search tool over the Debian archive without mirroring it

Common errors and how to fix them

404

The trailing slash is missing from the path.

Fix: Debian Sources paths end in `/`. Use `/api/search/apache2/`, not `/api/search/apache2`.

Empty exact with a long other list

Your term is a prefix shared by many packages rather than a package name.

Fix: Check `results.exact` for null before using `other`, and narrow the term.

Version not found

The suite alias you used does not exist for that package.

Fix: Use `latest` or query `/api/src/{package}/` first to list the concrete versions actually available.

Debian Sources API — frequently asked questions

Does the Debian Sources API need a key?

No. It is a public service run by the Debian project with no authentication of any kind.

Can I fetch actual source file contents?

Yes. Walk down `/api/src/{package}/{version}/{path}/` and the file endpoint returns the contents alongside metadata such as size, mime type and checksum.

Which Debian releases are covered?

All suites present in the archive, including oldstable, stable, testing and unstable, plus historical versions. The version list per package tells you which suites carry which version.

Why does my request 404 when the package clearly exists?

Almost always the missing trailing slash. Every Debian Sources API path ends with a slash.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Viewer

View JSON as a collapsible interactive tree online. Expand and collapse nodes, search keys and values, and copy the JSONPath of any node privately.

Text Compare

Compare two texts online free and highlight every difference. A private text comparison tool that finds matches and changes right in your browser.

Unified Diff Generator

Compare two texts and generate a real unified diff patch with @@ hunk headers and configurable context, ready to save as .patch and apply with git apply.

Debian Sources is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.