Overview

The npm endpoints live alongside the v2 API and add npm coverage, an optional full advisory body, a consistent nested response shape, and cursor pagination. They are the recommended endpoints for new integrations; v2 remains available for backwards compatibility.

Authentication

Every request must include your API key in the PSKey HTTP request header. Request a key via https://patchstack.com/for-hosts/.

Platforms

Pass ?platform=npm (or ?platform=wordpress the default) on list endpoints. Platform names are case-insensitive.

Pagination

/all and /latest support two independent strategies, selected by which query parameter you pass:

• Offset (?page=&per_page=) returns totals; easy to jump to a specific page; susceptible to row-shift when new rows land while paging.
• Cursor (?cursor=) stable under concurrent inserts, faster at depth, no total count. Bootstrap with an empty value: ?cursor=.

cursor and page are mutually exclusive; passing both returns 422.

Including full advisory bodies

Pass ?include=details on any list endpoint to add an advisory_details markdown field to each item.

Scoped npm packages

npm package slugs that include a / (e.g. @scope/pkg) conflict with the route separator. URL-encode the / as %2F.

Rate limiting

Same policy as the Extended Threat Intelligence API. Contact https://patchstack.com/for-hosts/ if you need an elevated quota.

Errors

A malformed cursor returns 200 with an empty page rather than an error:

{ "vulnerabilities": [], "cursor": { "next_cursor": null, "has_more": false, "per_page": 100 } }

Related pages

• Narrative guide with code samples: NPM features
• OpenAPI spec (import into Postman / Insomnia / Bruno / Hoppscotch): https://docs.patchstack.com/schemas/threat-intel-npm.yaml
• Postman collection (pre-imported): https://docs.patchstack.com/schemas/threat-intel-npm.postman_collection.json

Integration questions: dave.jong@patchstack.com.