POST
/repos/{owner}/{repo}/git/tagsCreate a tag object
Note that creating a tag object does not create the reference that makes a tag in Git. If you want to create an annotated tag in Git, you have to do this call to create the tag object, and then create the refs/tags/[tag] reference. If you want to create a lightweight tag, you only have to create the tag reference - this call would be unnecessary.
Signature verification object
The response will include a verification object that describes the result of verifying the commit's signature. The following fields are included in the verification object:
| Name | Type | Description |
|---|---|---|
verified | boolean | Indicates whether GitHub considers the signature in this commit to be verified. |
reason | string | The reason for verified value. Possible values and their meanings are enumerated in table below. |
signature | string | The signature that was extracted from the commit. |
payload | string | The value that was signed. |
verified_at | string | The date the signature was verified by GitHub. |
These are the possible values for reason in the verification object:
| Value | Description |
|---|---|
expired_key | The key that made the signature is expired. |
not_signing_key | The "signing" flag is not among the usage flags in the GPG key that made the signature. |
gpgverify_error | There was an error communicating with the signature verification service. |
gpgverify_unavailable | The signature verification service is currently unavailable. |
unsigned | The object does not include a signature. |
unknown_signature_type | A non-PGP signature was found in the commit. |
no_user | No user was associated with the committer email address in the commit. |
unverified_email | The committer email address in the commit was associated with a user, but the email address is not verified on their account. |
bad_email | The committer email address in the commit is not included in the identities of the PGP key that made the signature. |
unknown_key | The key that made the signature has not been registered with any user's account. |
malformed_signature | There was an error parsing the signature. |
invalid | The signature could not be cryptographically verified using the key whose key-id was found in the signature. |
valid | None of the above errors applied, so the signature is considered to be verified. |
- RetriesRetries up to 2×, 500ms backoff, 30s timeout.
ownerstringrequired
The account owner of the repository. The name is not case sensitive.
repostringrequired
The name of the repository without the `.git` extension. The name is not case sensitive.
tagstringrequired
The tag's name. This is typically a version (e.g., "v0.0.1").
messagestringrequired
The tag message.
objectstringrequired
The SHA of the git object this is tagging.
typestringrequired
The type of the object we're tagging. Normally this is a `commit` but it can also be a `tree` or a `blob`.
taggerobjectoptional
An object with information about the individual creating the tag.
201Response
node_idstringrequired
tagstringrequired
Name of the tag
shastringrequired
urlstringrequired
URL for the tag
messagestringrequired
Message describing the purpose of the tag
taggerobjectrequired
objectobjectrequired
verificationobjectoptional
409Conflict
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed, or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<object>optional
Error handling
A 409 is returned: Conflict. A 422 is returned: Validation failed, or the endpoint has been spammed.