# listPackageRevisions

Immutable Draft-backed static publication. Omit manifest with a completed uploadId to infer a document directory, including commentary.package.json/yaml when present. Revisions reuse unchanged file ha

Canonical: https://commentary.dev/docs/reference/api/list-package-revisions

`GET /api/v1/review-packages/{packageId}/revisions`

Immutable Draft-backed static publication. Omit manifest with a completed uploadId to infer a document directory, including commentary.package.json/yaml when present. Revisions reuse unchanged file hashes and require the exact previous package ETag; deletePaths explicitly removes retained files. Publication and Activity commit together before retryable indexing. Current workspace, package, linked Resource and source authority are rechecked for every read and download; project links confer no access. Ready revisions alone expose coherent content; executable bundles remain unsupported. Downloads return private attachment bytes, never storage credentials or privileged HTML/SVG.

## Access

Use a credential with `commentary.review_packages.read`.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Parameters

| Name | Location | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `packageId` | path | string | Yes |  |
| `cursor` | query | string | No |  |
| `limit` | query | integer | No |  |

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request GET \
  'https://commentary.dev/api/v1/review-packages/<packageId>/revisions' \
  --header 'Authorization: Bearer <your-token>'
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `200` | Private upload status or immutable package revision result. | [ProjectAgentlistPackageRevisionsOutput](/docs/reference/schemas/project-agentlist-package-revisions-output) |
| `400` | Invalid manifest/chunk/checksum or missing retry key. | See response headers or body contract |
| `401` | Authentication required. | See response headers or body contract |
| `403` | Current actor/workspace/grant access denied. | See response headers or body contract |
| `409` | Expired/canceled upload, missing chunks, or conflicting retry. | See response headers or body contract |
| `413` | Actual request bytes exceed the bound. | See response headers or body contract |
| `429` | Rate limit exceeded. | See response headers or body contract |

### Successful response fields

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `data` | object | Yes |  |
| `idempotencyReplayed` | boolean | No |  |

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `listPackageRevisions`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).