Attestations

Use this API to retrieve and download provenance attestations for a project.

The availability of these endpoints is controlled by a feature flag. They are available for testing, but not ready for production use.

Retrieve an attestation bundle

GET /api/v4/projects/{id}/attestations/{attestation_iid}/download

This feature was introduced in GitLab 18.7

Parameters

Name	Type	Description
`id` Path, required	String or integer	The ID or URL-encoded path of the project
`attestation_iid` Path, required	String or integer	The iid of the attestation

Responses

GET /api/v4/projects/{id}/attestations/{subject_digest}

Lists all attestations for a specified project and artifact hash. This feature was introduced in GitLab 18.7.

Parameters

Name	Type	Description
`id` Path, required	String or integer	The ID or URL-encoded path of the project
`subject_digest` Path, required	String	The SHA-256 hash of the artifact

Responses

Code	Description	Schema
`200`	OK	APIEntitiesSupplyChainAttestation
`400`	Bad Request	—
`404`	Artifact SHA-256 not found	—

Objects returned by the operations above and objects nested in their request bodies.

Property	Type	Description
`build_id`	Integer (int64)	—
`created_at`	String (date-time)	Example: `2025-09-17T02:26:10.898Z`
`download_url`	String	—
`expire_at`	String (date-time)	Example: `2025-09-17T02:26:10.898Z`
`id`	Integer (int64)	Example: `1`
`iid`	Integer	Example: `14`
`predicate_kind`	String	Example: `provenance`
`predicate_type`	String	Example: `https://slsa.dev/provenance/v1`
`project_id`	Integer (int64)	—
`status`	String	Example: `success`
`subject_digest`	String	Example: `5db1fee4b5703808c48078a76768b155b421b210c0761cd6a5d223f4d99f1eaa`
`updated_at`	String (date-time)	Example: `2025-09-17T02:26:10.898Z`