Overview

Author's notes...

In December 2022 I needed to set about 100 older NuGet packages to Unlisted status. Doing this through the standard nuget.org website UI is a dreadfully tedious process, as you need several clicks and navigations to complete each change.

To overcome this inconvenience, I decided to learn the basics of the NuGet API so I could create a simple desktop utility that searches for packages, lists their versions and details and can toggle the Listed status.

The official NuGet Server API web pages are quite difficult reading because they discuss http requests and the Catalog at a low level and it's unclear if this is the recommended way to write a client app. Then I found the NuGet/Samples repository which contains a lot of empty files, but luckily the folder NuGetProtocolSamples does contain a file which shows how to use the Repository class and the GetResourceAsync method to perform some useful work. The design of the API is rather scatterbrained and it's hard to discover what functionality is available beyond the specific sample code. Meziantou's Blog clarifies the code required to perform many common tasks such as searching, getting versions and metadata, downloading, pushing, etc.

The previous links provided enough information to create a basic NuGet search and browse UI, but I couldn't find any way of toggling the Listed status of a package. I attempted to use GetResourceAsync with a certain type of resource and various parameters, but it silently did nothing. I eventually found in the Push and delete section of the official documentation that you could use raw http DELETE and POST requests to unlist and relist a package. It's a bit ugly to use a mixture of the strongly-typed API alongside raw requests, but it allowed me to complete the app's functionality.

I was initially confused by seeing duplicate versions in my package lists, then I realised that there is an important property:

IPackageSearchMetadata -> Identity.Version.OriginalVersion

That property will contain a string like 1.2.0-beta.1 which must be passed to some API calls to discriminate between different packages that all have version 1.2.0.

Screenshot

API Keys

Toggling the Listed property of a package requires an API Key with suitable permissions. Keys can be created in the NuGet web page under User icon > API Keys.

The screenshot shows a ComboBox in the toolbar where an API Key can be selected as the active one. When a key is selected, the Listed grid column becomes enabled to allow toggling of the Listed status.

One or more API Keys can be registered with the application by placing them in the config.json file in the following example format:

{
  "NuGet": {
    "ApiKeys": [
      {
        "Name": "Contoso Key",
        "Key": "oy2naivbiw3qnodyfq7aqtp7njmyh8dhrth3ovmqo7llcu"
      },
      {
        "Name": "ACME Pty. Ltd.",
        "Key": "oy2phn53t3jylpoo2gdt7tj8ul6db7oulksrrwdodeetp4"
      }
    ]
  }
}