Attestations API

5 endpoints. Request and response schemas are described on the schemas page; the other tags are listed in the API index.

Endpoints

GET /api/v1/repositories/{name}/attestation-trust

Get the attestation trust configuration

Returns the keys, Fulcio roots and identities a repository's attestations are verified against. Needs manage, or maintainer/owner of the repository's project.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Responses

Status	Description	Body
200	Trust configuration (empty when none is set)	application/json: AttestationTrust
403	Error	application/json: Error
404	Repository not found	-

PUT /api/v1/repositories/{name}/attestation-trust

Set the attestation trust configuration

Replaces the trust configuration of a docker repository. Keys and roots are PEM documents; Fulcio needs both roots and identities; every identity needs an issuer and exactly one of subject and subject_regexp (matched against the whole subject). Already indexed attestations keep their verdict until reverified. Needs manage, or maintainer/owner of the repository's project.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-

Request body (required)

application/json: AttestationTrust

Responses

Status	Description	Body
200	Stored trust configuration	application/json: AttestationTrust
400	Error	application/json: Error
403	Error	application/json: Error
404	Repository not found	-

GET /api/v1/repositories/{name}/attestations

List the attestations of an image

Lists the signatures, attestations (SLSA provenance and others) and SBOMs indexed for an image digest of a docker repository, with their verification outcome against the repository's attestation trust configuration. Needs read access to the repository.

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
subject	query	string	yes	Image manifest digest (sha256:<64 hex>). Pattern: ^sha256:[a-f0-9]{64}$.
image	query	string	no	Image name inside the repository

Responses

Status	Description	Body
200	Attestations of the image	application/json: object
400	Error	application/json: Error
403	Error	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
attestations	array of OCIAttestation	yes	-

POST /api/v1/repositories/{name}/attestations/reverify

Verify the attestations of an image again

Re-reads the cosign tags (.sig, .att, .sbom) and the referrers of the image digest and judges them against the current trust configuration; without subject every indexed image of the repository is re-verified. With subject and image it also re-indexes an image whose rows are gone. Needs manage, or maintainer/owner of the repository's project.

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
subject	query	string	no	Image manifest digest (sha256:<64 hex>). Pattern: ^sha256:[a-f0-9]{64}$.
image	query	string	no	Image name inside the repository

Responses

Status	Description	Body
200	Number of attachment manifests processed	application/json: object
400	Error	application/json: Error
403	Error	application/json: Error
404	Repository not found	-

Fields of the 200 response (application/json):

Field	Type	Required	Description
reverified	integer	yes	-

GET /api/v1/repositories/{name}/attestations/{digest}

Get the statement of an attestation

Returns the decoded in-toto statement of an indexed attachment (an SBOM or signature payload is wrapped as the predicate of a statement about the image). The statement is returned as stored, whether or not it verified. Needs read access to the repository.

Security: bearerAuth or cookieAuth or .

Parameters

Name	In	Type	Required	Description
name	path	string	yes	-
digest	path	string	yes	Attestation digest as listed (sha256:<64 hex>)
image	query	string	no	Image name inside the repository

Responses

Status	Description	Body
200	in-toto statement	application/json: InTotoStatement
400	Error	application/json: Error
403	Error	application/json: Error
404	Repository or attestation not found, or the attachment carries no readable statement	application/json: Error