Terraform Public Module Version Evidence API

Inventory selected version metadata for exact modules in the public Terraform Registry. One fixed /v1/modules/namespace/name/system/versions request each, at most3 modules and first1..20 source versions. Verify module source identity and unique version strings; retain declared root providers/constraints plus root-dependency and submodule counts. Source order is preserved and not assumed to be latest-first. Version strings are not sorted, solved against a range or installed.

The full bounded JSON response may be read before local version truncation;2MiB decoded response cap applies. At a local cap complete=false and sourceRowsAvailable exposes the full returned version-list length. Root provider declarations are capped at30 and dependency/submodule list sizes at200; excessive lists fail rather than silently fabricate counts. No custom/private registry, token, source-code download, linked Git repository fetch, submodule traversal, Terraform execution, infrastructure provisioning, vulnerability check, signature validation or compatibility/license assurance. Empty provider constraints are preserved as empty text, not inferred. Missing versions in a later bounded sample are not deletions.

Quick start

{"modules": ["terraform-aws-modules/vpc/aws"], "maxVersionsPerModule": 2}

Pricing and budget

0.001 USD per emitted module version observation (1 USD per1000), plus0.005 USD startup at default256MB. Higher memory can multiply startup events; check effective Store pricing. Failed/empty sources do not emit result charges; startup can still apply. At zero result budget, input validation occurs but no upstream request is sent, and rowsAvailable is null (unknown). A positive budget can request the bounded source set before output; emission stops at the result cap and complete=false/PARTIAL_BUDGET reports truncation.

Snapshot, integration and limits

Use dataset rows together with OUTPUT and SNAPSHOT. Pass SNAPSHOT.previousHashes as previousHashes in a later run. NO_BASELINE/FIRST_SEEN/UNCHANGED/CHANGED compare only selected metadata including itemKey and sourceUrl; missing records are not deletions. FIRST_SEEN means absent from the supplied baseline. There is no persistent hidden state or automatic polling. Export JSON/CSV/Excel through the default dataset.

API example: POST https://api.apify.com/v2/actors/soilair~terraform-public-module-version-evidence-api/runs with your Apify Authorization header and the JSON input above. Poll the returned run; read dataset items and OUTPUT/SNAPSHOT records using its store IDs. Do not place tokens or confidential data in input. No upstream key is needed. Results live in Apify run storage according to retention; no separate analytics service.

Only fixed HTTPS provider endpoints are constructed from validated identifiers. Public-IP DNS validation, pinned connections, TLS hostname verification,2MiB decoded responses, approximately95 seconds of network budget, at most5 same-provider redirects. Official API calls are distinct from website crawling; no arbitrary URLs or HTML pages. No linked documents/files are fetched. Queries are sequential with1-second spacing. Provider403/429 or Retry-After stops later calls; retry instructions are reported and no retry/proxy/circumvention is attempted. Shared IP limits and changes to upstream services can still block runs. Caller must respect provider headers and cache/reduce repeated requests. Text is data and should not be executed.

Developed with AI assistance. Tests and live/cloud comparisons qualify the selected-field contract; they do not prove commercial demand, provider uptime or a legal/license determination. Support: share a run ID and expected fields, without credentials or private material.

References: https://developer.hashicorp.com/terraform/internals/module-registry-protocol