`GET /api/marketplace/items/{id}/versions` — the item's version history, newest first, each entry carrying its own changelog (#1060).

GET

/api/marketplace/items/{id}/versions

const url = 'https://example.com/api/marketplace/items/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/versions';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/marketplace/items/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/versions

The service fn and the SQL for this have existed since ADR 0027; there was simply no handler, so the detail page’s Versions and Changelog tabs had no way to obtain their data and rendered an em-dash on every item. This is the missing half, not a new capability.

Withdrawn versions are INCLUDED and carry withdrawn_at, because history is history — the UI marks them rather than hiding them, so a buyer can see that a version they may be running was pulled.

Parameters

Path Parameters

required

string format: uuid

Responses

200

application/json

Array<object>

Public catalog projection of a released item version.

object

changelog

string | null

expected_build_minutes

integer | null format: int32

expected_storage_mb

integer | null format: int32

framework

#[serde(default)] on both defaulted fields mirrors the persistence row’s own serde attributes, so the generated contract keeps them OPTIONAL exactly as before this projection — an older server’s payload must still parse (api-schemas-marketplace.test.ts).

string

Allowed values: plain react svelte

required

string format: uuid

item_id

required

string format: uuid

manifest_sha256

required

The manifest checksum the ADR 0034 P4b signature covers. A hash, not a fetch handle — it lets a buyer confirm that what they install is what the catalog advertised.

string

package_manifest

required

Catalog metadata from the stored manifest. Complete for a version the caller may install (free, or licensed); redacted to catalog metadata for a paid version the caller holds no license for.

prerequisites_md

string | null

prerequisites_md_de

string | null

prerequisites_must_acknowledge

boolean

readme

string | null

released_at

required

string format: date-time

source_tarball_sha256

Content hash of the source tarball. Kept for the same reason as manifest_sha256 and harmless without source_tarball_url, which this projection withholds.

string | null

version

required

string

withdrawn_at

string | null format: date-time

Example

[
  {
    "framework": "plain"
  }
]