---
title: "List all packages with their locked source metadata"
method: GET
path: "/api/v1/catalog/catalogs/{catalog_name}/locked-sources"
tags: ["catalogs"]
---

# List all packages with their locked source metadata

`GET /api/v1/catalog/catalogs/{catalog_name}/locked-sources`

## Request

- The document declares no server URL.
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Return a flat paginated list of all packages in the catalog with their
locked source metadata (url, ref, rev, dir, buildType).

Only evaluated packages with source and build type metadata are included.
This endpoint supports the legacy lock protocol used by CLI v1.13.1;
CLI v1.13.2 uses build-input lookup. Generated SDK methods remain available,
and retirement requires an explicit compatibility policy.

Path Parameters:
- **catalog_name**: The name of the catalog

Query Parameters:
- **page**: Zero-indexed page number (default: 0)
- **pageSize**: Items per page (default: 10)

Returns:
- **LockedSourcesResponse**: Paginated list with total_count

## Path parameters

- `catalog_name` string, required

## Query parameters

- `page` integer
- `pageSize` integer

## Response `200`

Flat paginated list of packages with source metadata

- LockedSourcesResponse
  - `items` LockedSourceItem[], required
    - `attr_path` string, required
    - `attr_path_components` string[], required
    - `source` BuildSource, required: Source provenance for a published package.
      - `type` string
      - `url` string, required
      - `ref` string, nullable
      - `rev` string, required
      - `dir` string
    - `build_type` 'manifest' | 'nef', required: Records the build methodology used to produce a package. NEF packages carry full source metadata and can be reproduced from source; manifest packages were built via the traditional flox manifest workflow.
  - `total_count` integer, required

## Other responses

- `404`: The catalog could not be found.
- `422`: The request parameters are invalid

## Changes

- **2026-08-27** `8ec561551880`: 2 warning
  - for the `query` request parameter `page`, the min was set to `0.00`
  - for the `query` request parameter `pageSize`, the min was set to `0.00`
- **2026-07-28** `05d6283fc201`: 1 warning
  - changed the pattern of the `path` request parameter `catalog_name` from `[a-zA-Z0-9\-_]{3,64}` to `^[a-zA-Z0-9\-_]{3,63}$`
- **2026-04-13** `b99206a49d27`: 1 info
  - endpoint added
- **2024-04-11** `7ba31661b446`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/flox/apis/floxhub-catalog-server/changes/api/v1/catalog/catalogs/:catalog_name/locked-sources/get.md)

---

[API](https://skmtc.dev/flox/apis/floxhub-catalog-server.md) - [All operations](https://skmtc.dev/flox/apis/floxhub-catalog-server/llms.txt) - [OpenAPI document](https://skmtc.dev/flox/apis/floxhub-catalog-server/revisions/6731453cd7cd?raw)