Catalog API

A read-only, versioned API for distributions, release details and download availability.

OpenAPI specification · View the catalog JSON

Endpoints

All endpoints use GET and return JSON
Path	Returns
`/api/v1/distributions`	Searchable, paginated catalog
`/api/v1/distributions/{id}`	Distribution, releases and downloads
`/api/v1/distributions/{id}/releases`	All recorded releases; `?current=false` selects older versions
`/api/v1/distributions/{id}/releases/{release}`	One release and its downloads
`/api/v1/distributions/{id}/releases/{release}/downloads`	Official and hosted download options

Find a distribution

curl 'https://linux.wtf/api/v1/distributions?q=alpine&architecture=x86_64'

Combine q, purpose (desktop, server, minimal), architecture, and family (debian, fedora, arch, suse, independent). Architectures and enum values are listed in the OpenAPI schema. Pagination uses limit (1–100, default 24) and offset (0–10000). Unknown parameters and invalid values return 422.

Download information

Request /api/v1/distributions/alpine/releases/3.24.2/downloads. Example fields from an unhosted response:

{
  "release_version": "3.24.2",
  "official": {
    "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/releases/x86_64/alpine-virt-3.24.2-x86_64.iso",
    "kind": "image",
    "redirect_path": "/go/alpine/3.24.2/virt-x86-64"
  },
  "hosted": {
    "available": false,
    "status": "delivery_disabled",
    "url": null,
    "verification": null,
    "last_updated": null
  }
}

When a copy is available, hosted.url is a direct HTTPS file URL on linux.wtf or downloads.linux.wtf. Its verification contains the local SHA256, upstream checksum source, method and timestamp. upstream_algorithm and upstream_checksum distinguish modern SHA256/SHA512 checks from legacy SHA1/MD5 archive checks. EndeavourOS uses sha512-official-https; the local object digest remains SHA256. Entries with access_requires_account: true, such as RHEL, require the publisher's download portal and cannot be anonymously mirrored. unverified_archive copies have no upstream checksum: those fields and checksum_url are null, and method is local-sha256-official-https. Historical Ubuntu and Debian Live signature checks use signature_legacy: true. Always retain official.url as your fallback. An official URL with kind: download-page opens a chooser, not an ISO.

Red Star OS has source_type: user-provided and downloads with kind: external-image. These entries offer only a linux.wtf copy: official is null and source redirects are disabled. The ingestion URL remains in official_url as provenance metadata. A completed copy has hosted.status: owner_provided, method: local-sha256-owner-provided and review_type: owner-request. Its SHA256 is computed locally; checksum_algorithm, upstream_checksum and checksum_url are null, and publisher signatures are not verified.

Errors and limits

The server allows 60 requests per client per 60 seconds across API, redirect and file endpoints. A 429 response includes Retry-After. Deployments may enforce additional edge limits. A missing item returns 404; invalid parameters return 422; unavailable file delivery returns 503 with an official-source link.

{
  "error": {
    "code": "not_found",
    "message": "That page or download could not be found.",
    "request_id": "request-specific identifier"
  }
}

Catalog and availability responses are not cached. Verification dates are UTC. No arbitrary URL parameters are accepted by redirect or file endpoints. This API has no write or upload operations.