{"meta":{"title":"REST API endpoints for artifact attestations","intro":"Use the REST API to interact with artifact attestations.","product":"REST API","breadcrumbs":[{"href":"/en/rest","title":"REST API"},{"href":"/en/rest/orgs","title":"Organizations"},{"href":"/en/rest/orgs/attestations","title":"Artifact attestations"}],"documentType":"article"},"body":"# REST API endpoints for artifact attestations\n\nUse the REST API to interact with artifact attestations.\n\n> [!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## List attestations by bulk subject digests\n\n```\nPOST /orgs/{org}/attestations/bulk-list\n```\n\nList a collection of artifact attestations associated with any entry in a list of subject digests owned by an organization.\nThe collection of attestations returned by this endpoint is filtered according to the authenticated user's permissions; if the authenticated user cannot read a repository, the attestations associated with that repository will not be included in the response. In addition, when using a fine-grained access token the attestations:read permission is required.\nPlease note: in order to offer meaningful security benefits, an attestation's signature and timestamps must be cryptographically verified, and the identity of the attestation signer must be validated. Attestations can be verified using the GitHub CLI attestation verify command. For more information, see our guide on how to use artifact attestations to establish a build's provenance.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`per_page`** (integer)\n  The number of results per page (max 100). For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n- **`before`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`after`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n#### Body parameters\n\n- **`subject_digests`** (array of strings) (required)\n  List of subject digests to fetch attestations for.\n\n- **`predicate_type`** (string)\n  Optional filter for fetching attestations with a given predicate type.\nThis option accepts provenance, sbom, release, or freeform text\nfor custom predicate types.\n\n### HTTP response status codes\n\n- **200** - OK\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/attestations/bulk-list \\\n  -d '{\n  \"subject_digests\": [\n    \"sha256:abc123\",\n    \"sha512:def456\"\n  ]\n}'\n```\n\n**Response schema (Status: 200):**\n\n* `attestations_subject_digests`: object, additional properties: array or null\n* `page_info`: object:\n  * `has_next`: boolean\n  * `has_previous`: boolean\n  * `next`: string\n  * `previous`: string\n\n## Delete attestations in bulk\n\n```\nPOST /orgs/{org}/attestations/delete-request\n```\n\nDelete artifact attestations in bulk by either subject digests or unique ID.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n#### Body parameters\n\n- **`subject_digests`** (array of strings) (required)\n  List of subject digests associated with the artifact attestations to delete.\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **404** - Resource not found\n\n## Delete attestations by subject digest\n\n```\nDELETE /orgs/{org}/attestations/digest/{subject_digest}\n```\n\nDelete an artifact attestation by subject digest.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n- **`subject_digest`** (string) (required)\n  Subject Digest\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **204** - No Content\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example 1: Status Code 200\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/orgs/ORG/attestations/digest/SUBJECT_DIGEST\n```\n\n**Response schema (Status: 200):**\n\n#### Example 2: Status Code 204\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/orgs/ORG/attestations/digest/SUBJECT_DIGEST\n```\n\n**Response schema (Status: 204):**\n\n## List attestation repositories\n\n```\nGET /orgs/{org}/attestations/repositories\n```\n\nList repositories owned by the provided organization that have created at least one attested artifact\nResults will be sorted in ascending order by repository ID\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`per_page`** (integer)\n  The number of results per page (max 100). For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n- **`before`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`after`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n- **`predicate_type`** (string)\n  Optional filter for fetching attestations with a given predicate type.\nThis option accepts provenance, sbom, release, or freeform text\nfor custom predicate types.\n\n### HTTP response status codes\n\n- **200** - OK\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/attestations/repositories\n```\n\n**Response schema (Status: 200):**\n\nArray of objects:\n  * `id`: integer\n  * `name`: string\n\n## Delete attestations by ID\n\n```\nDELETE /orgs/{org}/attestations/{attestation_id}\n```\n\nDelete an artifact attestation by unique ID that is associated with a repository owned by an org.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n- **`attestation_id`** (integer) (required)\n  Attestation ID\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **204** - No Content\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example 1: Status Code 200\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/orgs/ORG/attestations/ATTESTATION_ID\n```\n\n**Response schema (Status: 200):**\n\n#### Example 2: Status Code 204\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/orgs/ORG/attestations/ATTESTATION_ID\n```\n\n**Response schema (Status: 204):**\n\n## List attestations\n\n```\nGET /orgs/{org}/attestations/{subject_digest}\n```\n\nList a collection of artifact attestations with a given subject digest that are associated with repositories owned by an organization.\nThe collection of attestations returned by this endpoint is filtered according to the authenticated user's permissions; if the authenticated user cannot read a repository, the attestations associated with that repository will not be included in the response. In addition, when using a fine-grained access token the attestations:read permission is required.\nPlease note: in order to offer meaningful security benefits, an attestation's signature and timestamps must be cryptographically verified, and the identity of the attestation signer must be validated. Attestations can be verified using the GitHub CLI attestation verify command. For more information, see our guide on how to use artifact attestations to establish a build's provenance.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`per_page`** (integer)\n  The number of results per page (max 100). For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n- **`before`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`after`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n- **`subject_digest`** (string) (required)\n  The parameter should be set to the attestation's subject's SHA256 digest, in the form sha256:HEX_DIGEST.\n\n- **`predicate_type`** (string)\n  Optional filter for fetching attestations with a given predicate type.\nThis option accepts provenance, sbom, release, or freeform text\nfor custom predicate types.\n\n### HTTP response status codes\n\n- **200** - OK\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/attestations/SUBJECT_DIGEST\n```\n\n**Response schema (Status: 200):**\n\n* `attestations`: array of objects:\n  * `repository_id`: integer\n  * `bundle_url`: string\n  * `initiator`: string"}