Skip to main content
OSMA has fully open CORS and requires no authentication keys, so you can start fetching package data immediately — from a backend script, a CLI tool, or directly inside a browser application.

JavaScript (browser & Node.js)

CORS is fully open (Access-Control-Allow-Origin: *), so you can use the native fetch API directly. This example queries the NPM snapshot for react:

Python

For Python apps, tools, or data analysis scripts, requests makes querying the PyPI snapshot simple:

Command line (cURL)

Fastest way to test an endpoint from your terminal:
Rate limits applyThese endpoints are subject to the standard free-tier rate limits (10 requests/minute, 100/hour). If you’re writing a script that loops through hundreds of packages, you’ll need an X-Bypass-Token — see Utility Endpoints.

Copyright © 2025–2026 Amit Dutta