pkg.go.dev API: Endpoints, Limits, Risks, and Evaluation

This older record retains its original scope. Current buying qualifications above take precedence where terms have changed.

Kingy verdict: The pkg.go.dev API is the official structured route to Go package, module, symbol, version, vulnerability and imported-by metadata. It is a better foundation than scraping rendered pages, especially for coding assistants and dependency tools, and the current reference documents v1 routes. Build around explicit versioning, pagination, caching, rate-limit handling and evidence links to the package record.

What changed

The Go Team announced the public API on June 12, 2026. The reference exposes GET-only JSON endpoints for search and package ecosystem metadata, including package and module records, symbols, versions, known vulnerabilities and imported-by relationships. An official OpenAPI document provides a machine-readable contract. That creates a supported integration surface for tools that previously had to parse HTML or assemble equivalent data from several systems.

The API is deliberately read-only and described as stateless. Responses use pagination tokens where relevant, and the live reference documents a rate limit of 45 queries per second for an IP block. Consumers should honor the published limit, cache stable responses and avoid turning every autocomplete keystroke or agent thought into a new request.

Why it matters for AI tools

A coding assistant can use structured package and symbol metadata to narrow retrieval before it generates an answer. Dependency inventory and security tools can connect versions with vulnerability notices and imported-by context. Those are useful primitives; they do not make the resulting recommendation correct. Package popularity is not a security review, a symbol match is not proof of compatibility and vulnerability data can be incomplete or updated after a response is cached.

Return the package path, version and pkg.go.dev source URL with any assistant answer so a developer can inspect the underlying record. Pin important decisions to a version rather than silently following latest. For security-sensitive workflows, reconcile the API with the Go vulnerability database and the organization’s own build graph.

Pricing, stability and support

The Go Team announcement does not describe a separate paid plan for the public service. That does not imply an unlimited service-level agreement. The published rate limit, versioned API contract and public issue tracker are practical operating constraints. Infrastructure, caching, observability and any model used around the API remain the adopter’s costs.

The June 12 announcement introduced v1beta and described a future move to v1. The current reference now documents /v1 routes, and the old reference URL redirects there. The pkgsite source and reference tooling can still change. Generate clients from a reviewed OpenAPI revision, keep contract tests, tolerate new fields, handle missing fields and error responses, and monitor the official issue tracker and announcement channels.

How Kingy would evaluate it

Build a frozen corpus spanning standard-library packages, modules with many versions, deprecated packages, similarly named paths, private-looking typosquats, packages with known vulnerabilities and entries with large imported-by graphs. Test endpoint completeness, pagination, version selection, response latency, caching behavior, error semantics and freshness against the rendered pkg.go.dev record.

For an AI assistant, measure citation correctness and whether the model preserves exact package paths and versions. Inject ambiguous names and stale cached data, then verify that the system asks for clarification or exposes uncertainty. Kingy reviewed the Go Team announcement, live API reference, OpenAPI specification, pkg.go.dev service pages, source repository and public issue tracker; we did not operate a sustained client or benchmark the service.

Primary sources

• Go Team API announcement
• pkg.go.dev API reference (redirects to v1)
• Official OpenAPI specification
• pkg.go.dev service
• About pkg.go.dev
• pkgsite source repository
• Go public issue tracker