POST/repos/{owner}/{repo}/attestations

Create an attestation

Store an artifact attestation and associate it with a repository.

The authenticated user must have write permission to the repository and, if using a fine-grained access token, the attestations:write permission is required.

Artifact attestations are meant to be created using the attest action. For more information, see our guide on using artifact attestations to establish a build's provenance.

RetriesRetries up to 2×, 500ms backoff, 30s timeout.

2 parameters · 1 body field

ownerstringrequired

The account owner of the repository. The name is not case sensitive.

repostringrequired

The name of the repository without the `.git` extension. The name is not case sensitive.

bundleobjectrequired

The attestation's Sigstore Bundle. Refer to the [Sigstore Bundle Specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto) for more information.

3 status codes

201response

idintegeroptional

The ID of the attestation.

403Forbidden

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

422Validation failed, or the endpoint has been spammed.

messagestringrequired

documentation_urlstringrequired

errorsarray<object>optional

Error handling

A 403 is returned: Forbidden. A 422 is returned: Validation failed, or the endpoint has been spammed.

import { Client } from "acme-sdk";

const client = new Client({
  baseUrl: "https://api.acme.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.attestations.create({
  owner: "octocat",
  repo: "hello-world",
  bundle: {},
});

{
  "id": 2
}

Request

Response

Errors