List environment packages
Retrieves a list of all Malloy packages within the specified environment. Each package contains models, notebooks, databases, and other resources. This endpoint is useful for discovering available packages and their basic metadata.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Name of the environment Standard identifier pattern for resource names
^[a-zA-Z0-9_-]+$Response
A list of all packages in the environment
Resource path to the package
Package name
Package description
Package location, can be an absolute path or URI (e.g. github, s3, gcs, etc.)
Optional opt-in for curated discovery. When present, only these model file paths (relative to the package root) are listed via listModels(), and within-file discovery is filtered to each model's export {} closure. When absent or empty, every model is listed with its full source set (backward-compatible). Every other .malloy file still compiles for import/join resolution but is hidden from listings once explores is declared. Notebooks are always listed regardless of this field.
Actionable messages for declared explores that do not resolve to a real model in this package (e.g. a misspelled path, or a notebook listed as an explore). Server-computed and read-only: it is ignored on create/update requests and only ever returned in responses. Present only when there are such problems. Loading is fail-safe — the unresolved entry simply lists nothing rather than exposing everything — so this is the signal that a package is misconfigured; publishing such a package is rejected.
Non-fatal render-tag findings collected when the package loaded: a render annotation (e.g. # big_value or # currency) misconfigured for the field it sits on, so it renders as "[object Object]" or an inline error at query time but does not stop the model compiling or the package loading. Server-computed and read-only: ignored on create/update requests and only returned in responses. Present only when there are such findings.
Controls whether the discovery surface is also a query boundary. "declared" (the default) makes queryable == discoverable: when explores is declared, only explores model files — and within them only the export {} closure — are valid top-level query targets; every other source still compiles, imports, joins, and extends but is not directly queryable (denied with 404). "all" decouples them: explores/export {} gate discovery only and every compiled source stays directly queryable. When explores is absent there is no curated surface, so both modes are equivalent (everything queryable). Invalid values fall back to "declared". Identity-based access is a separate concern — see #(authorize).
declared, all URI (gs:// or s3://) of the externally-computed manifest for this package. On (re)load the publisher reads it and binds persist references (sourceEntityId -> physicalTableName). Null = serve live.
Package-level materialization scope mode, declared at the malloy-publisher.json manifest root. Governs the lifetime/ownership of every persisted source and dimension index in the package, and replaces the removed per-source/per-dimension sharing annotation:
version: materializations are owned by (scoped to) the package version; no cross-version reuse. Cadence is a single package-levelmaterialization.scheduleOR freshness (never both).package: materializations may be reused across the package's own versions when fresh; cadence is freshness only (noscheduleallowed). Null/absent = unknown this request; the control plane treats it as the platform default (package) and never as a scope change. See docs/persistence.md §3.1.
version, package Package-level Malloy Persistence policy declared in
malloy-publisher.json. The control plane reads it to drive scheduled
re-materialization. The object is present whenever the package is
loaded (with schedule: null when none is declared), so its
presence is the authoritative manifest policy; null/absent means
only that metadata was unavailable this request, which the control
plane treats as "unknown" (never a schedule removal). A published
version's schedule is persisted write-once and thereafter only
verified, so it cannot self-wipe on a later build.
Server-computed, read-only: whether the configured build manifest is currently bound to this package's served models. unbound = no manifest configured, so the package serves live. bound = a manifest was fetched and applied, so persist sources route to their materialized physical tables. live_fallback = a manifestLocation is configured but the fetch/bind failed or timed out, so the package is serving live despite intending to be materialized-routed. Lets the caller confirm the publisher actually bound the configured manifest rather than inferring it from logs.
unbound, bound, live_fallback Server-computed, read-only: number of sourceEntityId -> physical-table entries currently bound (0 when unbound or on live fallback).
Server-computed, read-only: the manifest URI actually bound to the served models. Usually equals manifestLocation, but can differ after an in-memory auto-load following a materialization build (no URI), in which case it is null. Null whenever the package is unbound.
Server-computed, read-only: the persist build plan for this package version (per-source sourceEntityId, output columns, build SQL, dependency graphs), exposed as a deterministic property of the compiled package. A caller reads it directly off the load/get-package response, assigns physical names/identity per source, and issues a single build call (see CreateMaterializationRequest.buildInstructions) — no separate plan round-trip. The plan is a pure function of the compiled model + connection config (no warehouse access), so it is stable for a given (package version, connection config). Returned by default whenever the package is compiled; null only when the package declares no persist source.