pkg.go.dev API: Endpoints, Limits, Risks, and Evaluation

Full Guide

Kingy verdict: The pkg.go.dev API is the official structured route to Go package, module, symbol, version, vulnerability and imported-by metadata. It is a better foundation than scraping rendered pages, especially for coding assistants and dependency tools, but it is still a v1beta interface. Build around explicit versioning, pagination, caching, rate-limit handling and evidence links to the package record.

What changed

The Go Team announced the public API on June 12, 2026. The reference exposes GET-only JSON endpoints for search and package ecosystem metadata, including package and module records, symbols, versions, known vulnerabilities and imported-by relationships. An official OpenAPI document provides a machine-readable contract. That creates a supported integration surface for tools that previously had to parse HTML or assemble equivalent data from several systems.

The API is deliberately read-only and described as stateless. Responses use pagination tokens where relevant, and the live reference documents a rate limit of 45 queries per second for an IP block. Consumers should honor the published limit, cache stable responses and avoid turning every autocomplete keystroke or agent thought into a new request.

Why it matters for AI tools

A coding assistant can use structured package and symbol metadata to narrow retrieval before it generates an answer. Dependency inventory and security tools can connect versions with vulnerability notices and imported-by context. Those are useful primitives; they do not make the resulting recommendation correct. Package popularity is not a security review, a symbol match is not proof of compatibility and vulnerability data can be incomplete or updated after a response is cached.

Return the package path, version and pkg.go.dev source URL with any assistant answer so a developer can inspect the underlying record. Pin important decisions to a version rather than silently following latest. For security-sensitive workflows, reconcile the API with the Go vulnerability database and the organization’s own build graph.

Pricing, stability and support

The Go Team announcement does not describe a separate paid plan for the public service. That does not imply an unlimited service-level agreement. The reference rate limit, beta version and public issue tracker are the practical operating constraints. Infrastructure, caching, observability and any model used around the API remain the adopter’s costs.

The announcement says the team plans to move toward v1 after feedback, while the pkgsite source and reference tooling can change. Generate clients from a reviewed OpenAPI revision, keep contract tests, tolerate new fields, handle missing fields and error responses, and monitor the official issue tracker and announcement channels.

How Kingy would evaluate it

Build a frozen corpus spanning standard-library packages, modules with many versions, deprecated packages, similarly named paths, private-looking typosquats, packages with known vulnerabilities and entries with large imported-by graphs. Test endpoint completeness, pagination, version selection, response latency, caching behavior, error semantics and freshness against the rendered pkg.go.dev record.

For an AI assistant, measure citation correctness and whether the model preserves exact package paths and versions. Inject ambiguous names and stale cached data, then verify that the system asks for clarification or exposes uncertainty. Kingy reviewed the Go Team announcement, live API reference, OpenAPI specification, pkg.go.dev service pages, source repository and public issue tracker; we did not operate a sustained client or benchmark the service.

Primary sources

• Go Team API announcement
• pkg.go.dev v1beta API reference
• Official OpenAPI specification
• pkg.go.dev service
• About pkg.go.dev
• pkgsite source repository
• Go public issue tracker