NuGet Server API

The NuGet Server API is a set of HTTP endpoints that can be used to download packages, fetch metadata, publish new packages, and perform most other operations available in the official NuGet clients.

This API is used by the NuGet client in Visual Studio, nuget.exe, and the .NET CLI to perform NuGet operations such as dotnet restore, search in the Visual Studio UI, and nuget.exe push.

Note in some cases, has additional requirements that are not enforced by other package sources. These differences are documented by the Protocols.

For a simple enumeration and download of available nuget.exe versions, see the tools.json endpoint.

If you are implementing a NuGet package repository, also see the implementation guide for additional requirements and recommendations.

Service index

The entry point for the API is a JSON document in a well known location. This document is called the service index. The location of the service index for is

This JSON document contains a list of resources which provide different functionality and fulfill different use cases.

Clients that support the API should accept one or more of these service index URL as the means of connecting to the respective package sources.

For more information about the service index, see its API reference.


The API is version 3 of NuGet's HTTP protocol. This protocol is sometimes referred to as "the V3 API". These reference documents will refer to this version of the protocol simply as "the API."

The service index schema version is indicated by the version property in the service index. The API mandates that the version string has a major version number of 3. As non-breaking changes are made to the service index schema, the version string's minor version will be increased.

Older clients (such as nuget.exe 2.x) do not support the V3 API and only support the older V2 API, which is not documented here.

The NuGet V3 API is named as such because it's the successor of the V2 API, which was the OData-based protocol implemented by the 2.x version of the official NuGet client. The V3 API was first supported by the 3.0 version of the official NuGet client and is still the latest major protocol version supported by the NuGet client, 4.0 and on.

Non-breaking protocol changes have been made to the API since it was first released.

Resources and schema

The service index describes a variety of resources. The current set of supported resources are as follows:

Resource name Required Description
Catalog no Full record of all package events.
PackageBaseAddress yes Get package content (.nupkg).
PackageDetailsUriTemplate no Construct a URL to access a package details web page.
PackagePublish yes Push and delete (or unlist) packages.
RegistrationsBaseUrl yes Get package metadata.
ReportAbuseUriTemplate no Construct a URL to access a report abuse web page.
RepositorySignatures no Get certificates used for repository signing.
SearchAutocompleteService no Discover package IDs and versions by substring.
SearchQueryService yes Filter and search for packages by keyword.
SymbolPackagePublish no Push symbol packages.
VulnerabilityInfo no Packages with known vulnerabilities.

In general, all non-binary data returned by a API resource are serialized using JSON. The response schema returned by each resource in the service index is defined individually for that resource. For more information about each resource, see the topics listed above.

In the future, as the protocol evolves, new properties may be added to JSON responses. For the client to be future-proof, the implementation should not assume that the response schema is final and cannot include extra data. All properties that the implementation does not understand should be ignored.


When a source does not implement SearchAutocompleteService any autocomplete behavior should be disabled gracefully. When ReportAbuseUriTemplate is not implemented, the official NuGet client falls back to's report abuse URL (tracked by NuGet/Home#4924). Other clients may opt to simply not show a report abuse URL to the user.

Undocumented resources on

The V3 service index on has some resources that are not documented above. There are a few reasons for not documenting a resource.

First, we don't document resources used as an implementation detail of The SearchGalleryQueryService falls into this category. NuGetGallery uses this resource to delegate some V2 (OData) queries to our search index instead of using the database. This resource was introduced for scalability reasons and is not intended for external use.

Second, we don't document resources that never shipped in an RTM version of the official client. PackageDisplayMetadataUriTemplate and PackageVersionDisplayMetadataUriTemplate fall into this category.

Thirdly, we don't document resources that are tightly coupled with the V2 protocol, which itself is intentionally undocumented. The LegacyGallery resource falls into this category. This resource allows a V3 service index to point to a corresponding V2 source URL. This resource supports the nuget.exe list.

If a resource is not documented here, we strongly recommend that you do not take a dependency on them. We may remove or change the behavior of these undocumented resources which could break your implementation in unexpected ways.


All timestamps returned by the API are UTC or are otherwise specified using ISO 8601 representation.

HTTP methods

Verb Use
GET Performs a read-only operation, typically retrieving data.
HEAD Fetches the response headers for the corresponding GET request.
PUT Creates a resource that doesn't exist or, if it does exist, updates it. Some resources may not support update.
DELETE Deletes or unlists a resource.

HTTP status codes

Code Description
200 Success, and there is a response body.
201 Success, and the resource was created.
202 Success, the request has been accepted but some work may still be incomplete and completed asynchronously.
204 Success, but there is no response body.
301 A permanent redirect.
302 A temporary redirect.
400 The parameters in the URL or in the request body aren't valid.
401 The provided credentials are invalid.
403 The action is not allowed given the provided credentials.
404 The requested resource doesn't exist.
409 The request conflicts with an existing resource.
500 The service has encountered an unexpected error.
503 The service is temporarily unavailable.

Any GET request made to a API endpoint may return an HTTP redirect (301 or 302). Clients should gracefully handle such redirects by observing the Location header and issuing a subsequent GET. Documentation concerning specific endpoints will not explicitly call out where redirects may be used.

In the case of a 500-level status code, the client can implement a reasonable retry mechanism. The official NuGet client retries three times when encountering any 500-level status code or TCP/DNS error.

HTTP request headers

Name Description
X-NuGet-ApiKey Required for push and delete, see PackagePublish resource
X-NuGet-Client-Version Deprecated and replaced by X-NuGet-Protocol-Version
X-NuGet-Protocol-Version Required in certain cases only on, see protocols
X-NuGet-Session-Id Optional. NuGet clients v4.7+ identify HTTP requests that are part of the same NuGet client session.

The X-NuGet-Session-Id has a single value for all operations related to a single restore in PackageReference. For other scenarios such as autocomplete and packages.config restore there may be several different session ID's due to how the code is factored.


Authentication is left up to the package source implementation to define. For, only the PackagePublish resource requires authentication via a special API key header. See PackagePublish resource for details.