Oct 25, 2026

pkg.go.dev gets an official API for module, package, symbol and vulnerability data

The Go team introduces a stateless, GET-only service under /v1beta so tools no longer need to scrape the pkg.go.dev web pages.

The Go team has announced an official pkg.go.dev API, a service interface for querying metadata about published Go modules. It is meant for tool builders, IDE integrations and automated workflows that previously relied on scraping the site.

The API is stateless and GET-only, built for stability and efficient caching, and its primary endpoints currently live under the /v1beta path. The team says it intends to move to a formal v1 release after a period of feedback and confirmed stability.

Endpoints cover package and module information, module versions, the packages in a module, search, symbols, imported-by lists and vulnerabilities. A version query parameter accepts a semantic version, or the master and main branches, and defaults to the latest tagged version.

The design favours precision over convenience. Where the web interface picks the longest matching module path, the API asks the client to name the module and returns a list of candidates with an error if a package path is ambiguous. Developers writing clients should pass the module path explicitly and read the OpenAPI specification published alongside the service.

Sources

Verified Oct 25, 2026 (official source). gopkg.go.devapidevelopertools