Skills and npm registry | Kuudo API Documentation

Direct download

Use an exchanged JWT with skills:read:

curl --fail-with-body \
  "https://app.kuudo.com/api/skills/${KUUDO_SKILL_NAME}/download?format=zip" \
  --header "Authorization: Bearer ${KUUDO_ACCESS_TOKEN}" \
  --output skill.zip

format accepts skill or zip and defaults to skill. Both are binary archive attachments; a .skill package uses a ZIP container. Unknown and unentitled skills both return 404. Direct downloads use private, no-store caching.

npm registry

The npm read registry uses the raw API key, because npm cannot perform the API-key-to-JWT exchange. Its linked client must be active and carry skills:read. Keep the key outside committed .npmrc files:

@kuudo:registry=https://app.kuudo.com/api/registry/
//app.kuudo.com/api/registry/:_authToken=${KUUDO_API_KEY}

Use that configuration in a trusted development or build environment and choose an entitled package and version.

Registry metadata is available under /api/registry/{packageName}. A scoped name can be encoded as a single segment, such as @kuudo%2Famazon-ads, or sent in split form as @kuudo/amazon-ads.

The metadata includes dist-tags, versions, and version-specific dist.tarball and integrity information. Follow the returned tarball URL; do not construct or guess filenames. Tarballs are served at /api/registry/{packageName}/-/{filename} and use private, immutable caching for one year. Metadata responses disable caching.

Invalid registry credentials return 401. Unknown and unentitled packages both return 404, preserving the organization’s catalog boundary. The registry exposes read metadata and artifacts; it is not an npm package publishing endpoint.