# pypi.files

**stable** **Advanced**

Distribution files (wheels/sdist) of a specific PyPI release.

`GET /v1/pypi/files`

## What you get

A list of PyPI results in Onekey's unified shape, in `data` (an array). An empty array is a normal, successful answer and is charged like any other; a source that reports "nothing found" as an error returns a free `404 not_found` instead.

## What it costs

- **Advanced · 5 credits** for a fresh fetch, charged only when it succeeds.
- **Free when served from cache (0.2 credit for a cached response over 100 KB).**
- **Free** if the request is invalid (never charged) or the source fails or reports not found (refunded).

## Parameters

| Name | Type | Required | Default | What it is | Constraints |
| --- | --- | --- | --- | --- | --- |
| `name` | string | yes | (required) | PyPI project name, e.g. requests | max 100 chars; must match `[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?`; trimmed, lowercased |
| `version` | string | yes | (required) | Exact version, e.g. 2.31.0 | max 64 chars; must match `[A-Za-z0-9][A-Za-z0-9._+!-]{0,63}`; trimmed |

## Request

```bash
curl "https://api.onekey.dev/v1/pypi/files?name=requests&version=2.31.0" \
  -H "x-api-key: YOUR_API_KEY"
```

```python
import requests

res = requests.get(
    "https://api.onekey.dev/v1/pypi/files",
    params={"name": "requests", "version": "2.31.0"},
    headers={"x-api-key": "YOUR_API_KEY"},
)
body = res.json()

if body["success"]:
    print(body["data"])
else:
    print(body["error"]["code"], body["error"]["message"])
```

```javascript
const params = new URLSearchParams({ name: "requests", version: "2.31.0" });
const res = await fetch(`https://api.onekey.dev/v1/pypi/files?${params}`, {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const body = await res.json();

if (body.success) console.log(body.data);
else console.error(body.error.code, body.error.message);
```

## Recorded response

A real PyPI response, recorded and returned in Onekey's shape. Fields the platform does not provide are `null`.

```json
{
  "success": true,
  "data": [
    {
      "content": {
        "title": "requests-2.31.0-py3-none-any.whl",
        "url": "https://files.pythonhosted.org/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl",
        "createdAt": "2023-05-22T15:12:42Z"
      },
      "ext": {
        "size": 62574,
        "pythonVersion": "py3",
        "sha256": "58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f"
      },
      "entity": {
        "type": "bdist_wheel"
      }
    },
    {
      "content": {
        "title": "requests-2.31.0.tar.gz",
        "url": "https://files.pythonhosted.org/packages/9d/be/10918a2eac4ae9f02f6cfe6414b7a155ccd8f7f9d4380d62fd5b955065c3/requests-2.31.0.tar.gz",
        "createdAt": "2023-05-22T15:12:44Z"
      },
      "ext": {
        "size": 110794,
        "pythonVersion": "source",
        "sha256": "942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"
      },
      "entity": {
        "type": "sdist"
      }
    }
  ],
  "metadata": {
    "platform": "pypi",
    "endpoint": "files",
    "cached": false,
    "stale": false,
    "age_s": 0,
    "fetched_at": "2026-01-01T12:00:00+00:00",
    "credits_charged": 5,
    "request_id": "7f3a9c2e5b1d4c8fa2e6d0b9c4f18e37"
  },
  "error": null
}
```

## Field mapping

How this endpoint's source fields become Onekey's [unified schema](https://onekey.dev/docs/schema.md). Fields the source lacks come back as `null`.

| Source path | Onekey field | Transform |
| --- | --- | --- |
| `filename` | `content.title` | - |
| `url` | `content.url` | `safeUrl` |
| `upload_time_iso_8601` | `content.createdAt` | `toIsoDate` |
| `size` | `ext.size` | `toNumber` |
| `packagetype` | `entity.type` | - |
| `python_version` | `ext.pythonVersion` | - |
| `digests.sha256` | `ext.sha256` | - |

## Caching and freshness

- Fresh for about 2 minutes. Repeat calls in that window are served from cache and are free.
- Between 2 minutes and 15 minutes the cached copy is still served instantly and marked `stale: true` while Onekey refreshes it in the background.
- If the source is down when a refresh is needed, the last copy can be served for up to 1 hour more (marked stale).
- A "not found" is remembered for 1 minute and is free.
- The cache is shared across all customers, which is what keeps repeat calls cheap.

## What can go wrong

| Status | Code | What to do |
| --- | --- | --- |
| 401 | `unauthorized` | Check the `x-api-key` header. |
| 402 | `insufficient_credits` | [Add credits](https://onekey.dev/pricing); your balance must cover the price. |
| 404 | `not_found` | Unknown endpoint path. |
| 422 | `invalid_params` | Fix the parameters using the table above. Free. |
| 429 | `rate_limited` | Wait `Retry-After` seconds, then retry. |
| 502 | `upstream_error` | The source failed. Refunded; retry with backoff. |

See [Errors](https://onekey.dev/docs/errors.md) for the full list and retry guidance.

Status: stable (verified against the live source).