API for accessing an org's projects

[pelson]

What's the problem this feature will solve?
The ability to programmatically access the project names that belong to an organisation

Describe the solution you'd like
A simple http endpoint which gives a JSON body containing an organisation's project

For example, to access the jupyter org's projects, an API which can give a single machine readable page containing the 140+ projects listed at https://pypi.org/org/jupyter/.

[di]

Hi, thanks for the issue. Can you give us some more details about the use case for such an API? What would you use it for?

[pelson]

👍

Internally, we run a simple-repository-server and apply a 48hr quarantining filter to all incoming projects. There are some in-house OSS developed projects published on PyPI which we want to allow-list to avoid that quarantine period (as we consider these projects to carry a higher level of trust, and it represents a lower risk of account hijacking in terms of absolute numbers of accounts who can write to those projects when compared to the whole of PyPI), and it would seem logical to use an organisation to specify a collection of projects that we would let through, rather than individual project names as we do today.

In practice, this would probably be a periodic request (e.g. every 24 hrs) to find out which projects are in the org. Alternatively we could make a request on simple-repository request demand, and use the provided cache headers to determine TTL and ETAG invalidation. Of course, the latter approach is the more sophisticated, but either would be fine in reality.

I could imagine having a few of such trusted organisations - I don't know if it is worth it to allow multiple orgs to be queried in the same request (ala GraphQL). I would probably hazard that sticking with the simplicity of the existing simple index http style is good enough.