API Reference

This page documents the public, unauthenticated endpoints developers and tooling can use to resolve a published pack, fetch install manifests, and download frozen release artifacts.

Namespace rules

Every public pack uses the same three-part identifier:

org / project / pack

Examples in this page use acme/brand/core-icons.

framework is limited to react, vue, or react-native
version_hash is a 12-character lowercase hex string such as 8f3a9c2d14be
latest endpoints are moving targets
Versioned endpoints are immutable release artifacts

Resolve the latest release

Use this when you need the current published release hash before fetching the full manifest.

GET /api/v1/install/{org_slug}/{project_slug}/{pack_slug}

Example:

GET /api/v1/install/acme/brand/core-icons

Response shape:

{
  "org_slug": "acme",
  "project_slug": "brand",
  "pack_slug": "core-icons",
  "pack_name": "Core Icons",
  "version_hash": "8f3a9c2d14be",
  "slot_count": 42,
  "published_at": "2026-03-14T10:00:00Z"
}

This endpoint is short-lived and should be treated as a live lookup, not a pinned artifact.

Fetch install manifests

Latest manifest shortcut

GET /api/v1/install/{org_slug}/{project_slug}/{pack_slug}/latest/{framework}.json

Examples:

GET /api/v1/install/acme/brand/core-icons/latest/react.json
GET /api/v1/install/acme/brand/core-icons/latest/vue.json
GET /api/v1/install/acme/brand/core-icons/latest/react-native.json

Use this when you want “whatever is currently published” for a given framework.

Pinned manifest

GET /api/v1/install/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/{framework}.json

Examples:

GET /api/v1/install/acme/brand/core-icons/8f3a9c2d14be/react.json
GET /api/v1/install/acme/brand/core-icons/8f3a9c2d14be/vue.json
GET /api/v1/install/acme/brand/core-icons/8f3a9c2d14be/react-native.json

Use the versioned form for reproducible installs, CI, or debugging. The manifest_url inside the response always points at this pinned form.

Install manifest contract

All JSON manifest endpoints return the same schema:

{
  "schema_version": "1",
  "framework": "react",
  "pack": {
    "org_slug": "acme",
    "project_slug": "brand",
    "pack_slug": "core-icons",
    "name": "Core Icons"
  },
  "release": {
    "version_hash": "8f3a9c2d14be",
    "published_at": "2026-03-14T10:00:00Z",
    "slot_count": 42
  },
  "install": {
    "file_extension": ".tsx",
    "barrel_exports": "default",
    "archive_url": "/api/v1/registry/acme/brand/core-icons/8f3a9c2d14be/react.tar.gz",
    "archive_hash": "sha256:..."
  },
  "manifest_url": "/api/v1/install/acme/brand/core-icons/8f3a9c2d14be/react.json",
  "components": [
    {
      "slot_name": "arrow-left",
      "component_name": "ArrowLeft",
      "file_name": "ArrowLeft.tsx",
      "source_url": "/api/v1/registry/acme/brand/core-icons/8f3a9c2d14be/react/ArrowLeft.tsx",
      "source_hash": "sha256:...",
      "svg": {
        "hash": "sha256:...",
        "view_box": "0 0 24 24",
        "width": 24,
        "height": 24
      },
      "metadata": {
        "label": "Arrow Left",
        "description": "Left arrow"
      }
    }
  ]
}

Key points:

schema_version is currently "1"
The manifest uses snake_case keys
pack identifies the live org/project/pack namespace
release.version_hash is the immutable release identifier
install.archive_url and install.archive_hash point to the preferred bulk-download artifact when available
components is the authoritative list of installable files for that release

Registry aliases and artifacts

The registry surface serves the same manifest contract plus frozen release artifacts.

Registry JSON aliases

GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/react.json
GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/vue.json
GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/react-native.json

These are thin aliases of the canonical install manifest. They return the same schema shown above.

Framework archives

GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/react.tar.gz
GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/vue.tar.gz
GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/react-native.tar.gz

These archive endpoints are the preferred bulk install path for the CLI.

Individual component source files

GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/react/{component_file}
GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/vue/{component_file}
GET /api/v1/registry/{org_slug}/{project_slug}/{pack_slug}/{version_hash}/react-native/{component_file}

Examples:

GET /api/v1/registry/acme/brand/core-icons/8f3a9c2d14be/react/ArrowLeft.tsx
GET /api/v1/registry/acme/brand/core-icons/8f3a9c2d14be/vue/ArrowLeft.vue
GET /api/v1/registry/acme/brand/core-icons/8f3a9c2d14be/react-native/ArrowLeft.tsx

These return the frozen generated source file for a single component in that release.

React Native endpoints require releases that include frozen React Native artifacts. Older releases return a clear unsupported-release error instead of generating React Native source on demand.

Cache behavior

GET /api/v1/install/{org}/{project}/{pack} and /latest/{framework}.json are moving targets and should be treated as live lookups
Versioned manifest, registry JSON, archive, and component-source endpoints are immutable release artifacts and can be cached aggressively

Publishing behavior that affects installs

The install surface reflects the current publish model:

Only assigned slots are included in a release
Releases are immutable once published
Publishing the same assigned content again returns the existing release as noop
Latest installs move forward when a new release is created; pinned installs stay on their exact version_hash

For the authoring side of that flow, see Publishing. For CLI usage, see Installing Packs.