{"uid":"cap_jiQ1THBeXB_0Kmnw2ehzI","slug":"paket-artifact-hash-lookup-295642ac","name":"Paket Artifact Hash Lookup","description":"Takes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, the digest length is checked against the declared algorithm before anything is fetched, and the response names every matching package version, since one artefact can be published under more than one coordinate.","url":"https://paket.halowerk.com/v1/artifact-hash","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"hash":{"type":"string","maxLength":200,"minLength":16,"description":"The digest, hex or base64."},"algorithm":{"enum":["SHA1","SHA256","SHA512","MD5"],"type":"string","default":"SHA1","description":"Digest algorithm. SHA1 is what most registries publish for archives."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_9Kg4O8wiHTXLpRIP_UxeX","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Resolves a file digest (hash) to the released package versions that match it, across multiple ecosystems.","exampleAgentPrompt":"I found a file in a container layer with SHA256 digest a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2 — can you tell me which released package version this artifact belongs to?","exampleUseCases":[{"title":"Container layer artifact identification","prompt":"We scanned a Docker image and found an unknown file with SHA256 hash 9b74c9897bac770ffc029102a200c5de2b9c9f9f9f9f9f9f9f9f9f9f9f9f9f9f — can you look that up and tell me which package release it corresponds to?"},{"title":"Supply chain audit of unknown binary","prompt":"During a security audit we found a JAR file with no metadata and MD5 digest d8e8fca2dc0f896fd7cb4cb0031ba249 — tell me which released Java package versions published this exact artifact."},{"title":"Build directory file provenance check","prompt":"There's a file sitting in our build output directory with SHA512 hash Z2QwZjg5NmZjMmRjMGY4OTZmZDdjYjRjYjAwMzFiYTI0OQ== in base64 — I need to know which package version this artifact was published under."}],"resultDescription":"A list of every package version (with name, version, ecosystem, and coordinate) that matches the given digest, since a single artifact can be published under more than one coordinate. The response includes all matching packages found across supported ecosystems.","failureModes":["Digest length does not match the declared algorithm — returns validation error before any fetch","Unknown or unsupported hash algorithm specified — returns error","No package version matches the given digest — returns empty result set","Malformed hex or base64 input — returns parsing error","Network or upstream registry unavailable — returns timeout or service error"],"whenToPreferThis":"Use this endpoint when you have a file artifact and need to identify which package version(s) published it, without any other metadata. It is the right choice when dealing with unidentified binaries in container layers, build outputs, or attachments, especially when the digest is available in either hex or base64 format. It handles cross-ecosystem matching and covers cases where a single artifact was published under multiple coordinates.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:44:54.585Z","isFirstParty":false}