pub.dev API

Fetch any Dart or Flutter package's versions, pubspec, archive URL and SHA-256 from pub.dev as JSON. No key required. Live example plus the version-ordering trap.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the pub.dev API?

pub.dev, the official Dart and Flutter package registry, has a public JSON API. `GET https://pub.dev/api/packages/{name}` returns the package's latest version, its full pubspec, the archive download URL and a SHA-256 checksum, along with every historical version. No API key is needed.

This is the same API the `dart pub` and `flutter pub` commands use, so what you read here is exactly what the tooling sees. That makes it dependable for supply-chain work: `archive_sha256` on each version is the checksum the client verifies after download, so you can validate a cached artefact without trusting your mirror.

The `versions` array is ordered oldest first, which catches out anyone who reaches for the last element expecting the newest release. It is also not sorted by semantic version, only by publication order, so a patch backport to an older line will appear after a newer major release. Use the top-level `latest` object whenever you want the current release, and only walk `versions` when you genuinely need history. Note also that pub.dev asks clients to send a descriptive User-Agent identifying the tool making the request.

Quick facts

Base URL: https://pub.dev/api
Authentication: Read endpoints are public and unauthenticated. Publishing requires OAuth, which is unrelated to anything documented here.
Rate limit: Not published. pub.dev asks that clients send an identifying User-Agent and avoid unnecessary polling.
Pricing: Free. The registry is operated by Google as part of the Dart ecosystem.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the pub.dev API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch metadata for a Dart package

GET https://pub.dev/api/packages/http

curl

curl 'https://pub.dev/api/packages/http'

JavaScript (fetch)

const res = await fetch("https://pub.dev/api/packages/http");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://pub.dev/api/packages/http", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "name": "http",
  "latest": {
    "version": "1.6.0",
    "pubspec": {
      "name": "http",
      "version": "1.6.0",
      "description": "A composable, multi-platform, Future-based API for HTTP requests.",
      "repository": "https://github.com/dart-lang/http/tree/master/pkgs/http",
      "topics": [
        "http",
        "network",
        "protocols"
      ],
      "environment": {
        "sdk": "^3.4.0"
      },
      "dependencies": {
        "async": "^2.5.0",
        "http_parser": "^4.0.0",
        "meta": "^1.3.0",
        "web": ">=0.5.0 <2.0.0"
      },
      "dev_dependencies": {
        "dart_flutter_team_lints": "^3.0.0",
        "fake_async": "^1.2.0",
        "http_client_conformance_tests": {
          "path": "../http_client_conformance_tests/"
        },
        "shelf": "^1.1.0",
        "stream_channel": "^2.1.1",
        "test": "^1.21.2"
      }
    },
    "archive_url": "https://pub.dev/api/archives/http-1.6.0.tar.gz",
    "archive_sha256": "87721a4a50b19c7f1d49001e51409bddc46303966ce89a65af4f4e6004896412",
    "published": "2025-11-10T18:27:56.434747Z"
  },
  "versions": [
    {
      "version": "0.2.7+0",
      "pubspec": {
        "dependencies": {
          "unittest": null
        },
        "name": "http",
        "version": "0.2.7+0",
        "description": "A composable, Future-based API for making HTTP requests."
      },
      "archive_url": "https://pub.dev/api/archives/http-0.2.7%2B0.tar.gz",
      "archive_sha256": "cc4fedb40b3c48d1a7558fcfe8d0f479046f017337d7b6b883208d65dbf8724d",
      "published": "2012-11-30T20:40:39.500320

Parameters

Parameter	Type	Required	Description
`{package}`	path	Required	The exact package name as published on pub.dev. `http`
`/api/packages/{package}/score`	path	Optional	Alternative endpoint returning pub points, popularity and likes for the package. `http`
`/api/search`	path	Optional	Search endpoint accepting a `q` query parameter. `?q=http`

Response fields

namestring: Canonical package name, lowercase with underscores. Package names are case-insensitive on lookup but canonical in responses.
latest.versionstring: The current release. Always prefer this to the last element of `versions`.
latest.pubspecobject: The complete pubspec for that release: `description`, `repository`, `topics`, `environment` SDK constraint, `dependencies` and `dev_dependencies`.
latest.pubspec.environment.sdkstring: The Dart SDK constraint, such as `^3.4.0`. This is the field to check for compatibility before upgrading.
latest.archive_urlstring: Direct download URL for the `.tar.gz` package archive.
latest.archive_sha256string: SHA-256 of the archive. Use it to verify a downloaded or mirrored copy.
latest.publishedstring: ISO 8601 publication timestamp with microsecond precision.
versionsarray: Every published version, oldest first and ordered by publication rather than by semver. Each element repeats the same structure as `latest`.

What you can build with the pub.dev API

Check whether a Flutter dependency has a newer release before upgrading
Verify the SHA-256 of a cached package archive in an air-gapped build
Read a package's SDK constraint to decide whether it supports your Dart version
Build a dependency dashboard for a Flutter monorepo
Detect packages that have not published a release in a long time

Common errors and how to fix them

404

The package name does not exist or has been retracted.

Fix: Names use lowercase and underscores. Confirm the exact name on pub.dev before querying.

Wrong version picked

You read the last element of `versions` expecting the newest release.

Fix: Use the `latest` object. The array is ordered by publication date, so backported patches appear after newer majors.

Large response for popular packages

`versions` repeats the full pubspec for every historical release, which can run to megabytes.

Fix: If you only need the current release, parse `latest` and discard the rest, or use the score endpoint instead.

pub.dev API — frequently asked questions

Is the pub.dev API free and public?

Yes. Read endpoints need no key or token, and they are the same endpoints the official Dart and Flutter tooling calls.

How do I get just the latest version of a package?

Read `latest.version` from the package response. Do not sort `versions` yourself; it is ordered by publication, not by semantic version.

Can I verify a downloaded package archive?

Yes. Each version carries `archive_sha256`, which is the same digest the pub client checks after downloading from `archive_url`.

Is there a search endpoint?

Yes, `/api/search?q=` returns matching package names with paging. The per-package endpoint documented here is for when you already know the name.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

YAML to JSON Converter

Convert YAML to JSON online in your browser. Handles block scalars, flow collections, anchors and multi-document files — nothing is uploaded.

JSON Viewer

View JSON as a collapsible interactive tree online. Expand and collapse nodes, search keys and values, and copy the JSONPath of any node privately.

Hash Comparer

Compare two hashes or strings side by side to check they match. Get a normalized equality verdict plus per-character diff highlighting, all offline in your browser.

pub.dev is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.