User and Organization API
Relevant source files
The following files were used as context for generating this wiki page:
The User and Organization API provides the foundational endpoints for managing and retrieving information about individual users, authors, and organizations within the PRPM ecosystem. These APIs are central to package ownership, team collaboration, and displaying public-facing profile information on the PRPM registry. They distinguish between a general user and an "author," which is a user-centric view focused on their published packages.
Organizations are a key feature for teams, enabling them to manage members and publish packages under a shared namespace, including private packages. The API enforces rules outlined in the Acceptable Use Policy to prevent abuse, such as impersonation or trademark squatting.
Sources: packages/registry/src/routes/users.ts, packages/registry/src/routes/authors.ts, packages/registry/src/routes/organizations.ts, packages/webapp/src/app/blog/prpm-complete-feature-guide/page.tsx:115-119, packages/webapp/public/legal/ACCEPTABLE_USE_POLICY.md
Core Entities and Relationships
The API revolves around three main entities: User, Author, and Organization. A User can be an Author of packages and a Member of one or more Organizations. Organizations, in turn, have members and own packages.
The diagram below illustrates the relationships between these core entities as implied by the database queries in the API routes.
This Entity-Relationship diagram shows how Users, Organizations, Packages, and Collections are connected.
Sources: packages/registry/src/routes/users.ts:16-30, packages/registry/src/routes/authors.ts:16-30, packages/registry/src/routes/organizations.ts:16-32
User API
This API endpoint is responsible for fetching public information about a specific user.
Sources: packages/registry/src/routes/users.ts
GET /users/{name}
Retrieves a user's public profile, including their packages and collections. The user is identified by their unique name.
Request Flow
The following sequence diagram shows the process of fetching a user's data.
This diagram shows the sequence of events for a GET /users/{name} request.
Sources: packages/registry/src/routes/users.ts:11-37
Parameters
| Parameter | Type | Location | Description |
|---|---|---|---|
name | string | Path | The name of the user |
Sources: packages/registry/src/routes/users.ts:12
Response Body
On success, the API returns a user object with their associated packages and collections.
// packages/registry/src/routes/users.ts:16-30
const user = await db.user.findUnique({
where: { name },
include: {
packages: {
where: {
private: false,
},
},
collections: {
where: {
private: false,
},
},
},
});
This code snippet shows that only non-private packages and collections are included in the public user profile response.
Sources: packages/registry/src/routes/users.ts:16-30
Author API
This endpoint provides a public-facing view of a user in their capacity as a package author. It is functionally similar to the User API but is conceptually distinct, focusing on the user's contributions to the registry.
Sources: packages/registry/src/routes/authors.ts
GET /authors/{name}
Retrieves an author's public profile, including their packages and collections. The author is identified by their unique name.
Parameters
| Parameter | Type | Location | Description |
|---|---|---|---|
name | string | Path | The name of the author. |
Sources: packages/registry/src/routes/authors.ts:12
Response Body
The response includes the author's profile and their public packages and collections. The database query is identical to the /users/{name} endpoint, indicating that "author" is a specific role or view of a "user".
// packages/registry/src/routes/authors.ts:16-30
const author = await db.user.findUnique({
where: { name },
include: {
packages: {
where: {
private: false,
},
},
collections: {
where: {
private: false,
},
},
},
});
Sources: packages/registry/src/routes/authors.ts:16-30
Organization API
The Organization API manages team-based entities. Organizations can have members and own packages, including private ones accessible only to the organization.
Sources: packages/registry/src/routes/organizations.ts, packages/webapp/src/app/blog/prpm-complete-feature-guide/page.tsx
GET /organizations/{name}
Retrieves an organization's public profile, including its members and public packages.
Request Flow
This diagram outlines the logic for fetching an organization's profile.
Sources: packages/registry/src/routes/organizations.ts:11-39
Parameters
| Parameter | Type | Location | Description |
|---|---|---|---|
name | string | Path | The name of the organization |
Sources: packages/registry/src/routes/organizations.ts:12
Response Body
The response contains the organization's details, a list of its members (with their user profiles), and a list of its public packages.
// packages/registry/src/routes/organizations.ts:16-32
const organization = await db.organization.findUnique({
where: { name },
include: {
members: {
include: {
user: true,
},
},
packages: {
where: {
private: false,
},
},
},
});
This query demonstrates how organization members and their user data are fetched, along with the organization's public packages.
Sources: packages/registry/src/routes/organizations.ts:16-32
Private Packages
Organizations can publish private packages that are only accessible to their members. This feature is a key part of PRPM's offering for teams and companies. While the public API only returns public packages, the underlying system supports private package management for authenticated organization members.
Sources: packages/webapp/src/app/blog/prpm-complete-feature-guide/page.tsx:115-119
Acceptable Use and Conduct
The use of the User and Organization APIs is governed by the Acceptable Use Policy. This policy is in place to prevent abuse and ensure a fair and secure platform.
Key prohibitions related to users and organizations include:
- Account Abuse: Creating fake accounts, sharing credentials, or impersonating other users is forbidden.
- Intellectual Property Violations: Using trademarks in names without authorization or impersonating brands or organizations is not allowed.
- Package Naming: Names cannot be used for impersonation, typosquatting, or squatting on generic terms. For example, creating an organization named
@cursor/official-rulesto impersonate Cursor is a violation.
Sources: packages/webapp/public/legal/ACCEPTABLE_USE_POLICY.md
Conclusion
The User and Organization API endpoints are the backbone of identity and ownership on the PRPM registry. They provide public-facing profiles for individuals and teams, clearly defining authorship of packages and collections. The distinction between a "user" and an "author" endpoint suggests a design that separates a general user account from its public, contribution-focused persona. The organization functionality extends this by enabling team-based collaboration and private package management, making PRPM a viable tool for both open-source and commercial development.