{"meta":{"title":"아티팩트 메타데이터에 대한 REST API 엔드포인트","intro":"이러한 엔드포인트를 사용하여 조직의 아티팩트에 대한 메타데이터를 검색하고 관리합니다. 아티팩트 메타데이터는 빌드 아티팩트, 해당 출처 및 관련 세부 정보에 대한 정보를 제공합니다.","product":"REST API","breadcrumbs":[{"href":"/ko/enterprise-cloud@latest/rest","title":"REST API"},{"href":"/ko/enterprise-cloud@latest/rest/orgs","title":"조직"},{"href":"/ko/enterprise-cloud@latest/rest/orgs/artifact-metadata","title":"아티팩트 메타데이터"}],"documentType":"article"},"body":"# 아티팩트 메타데이터에 대한 REST API 엔드포인트\n\n이러한 엔드포인트를 사용하여 조직의 아티팩트에 대한 메타데이터를 검색하고 관리합니다. 아티팩트 메타데이터는 빌드 아티팩트, 해당 출처 및 관련 세부 정보에 대한 정보를 제공합니다.\n\n이러한 엔드포인트를 사용하여 조직에서 빌드하는 소프트웨어에 대한 스토리지 및 배포 레코드를 업로드할 수 있습니다 GitHub Actions. 레코드는 조직의 linked artifacts page.에 표시됩니다.\n[연동된 아티팩트 개요](/ko/enterprise-cloud@latest/code-security/concepts/supply-chain-security/linked-artifacts)을(를) 참조하세요.\n\n> \\[!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## Create an artifact deployment record\n\n```\nPOST /orgs/{org}/artifacts/metadata/deployment-record\n```\n\nCreate or update deployment records for an artifact associated\nwith an organization.\nThis endpoint allows you to record information about a specific\nartifact, such as its name, digest, environments, cluster, and\ndeployment.\nThe deployment name has to be uniqe within a cluster (i.e a\ncombination of logical, physical environment and cluster) as it\nidentifies unique deployment.\nMultiple requests for the same combination of logical, physical\nenvironment, cluster and deployment name will only create one\nrecord, successive request will update the existing record.\nThis allows for a stable tracking of a deployment where the actual\ndeployed artifact can change over time.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n#### Body parameters\n\n* **`name`** (string) (required)\n  The name of the artifact.\n\n* **`digest`** (string) (required)\n  The hex encoded digest of the artifact.\n\n* **`version`** (string)\n  The artifact version.\n\n* **`status`** (string) (required)\n  The status of the artifact. Can be either deployed or decommissioned.\n  Can be one of: `deployed`, `decommissioned`\n\n* **`logical_environment`** (string) (required)\n  The stage of the deployment.\n\n* **`physical_environment`** (string)\n  The physical region of the deployment.\n\n* **`cluster`** (string)\n  The deployment cluster.\n\n* **`deployment_name`** (string) (required)\n  The unique identifier for the deployment represented by the new record. To accommodate differing\n  containers and namespaces within a cluster, the following format is recommended:\n  {namespaceName}-{deploymentName}-{containerName}.\n\n* **`tags`** (object)\n  The tags associated with the deployment.\n\n* **`runtime_risks`** (array of strings)\n  A list of runtime risks associated with the deployment.\n  Supported values are: critical-resource, internet-exposed, lateral-movement, sensitive-data\n\n* **`github_repository`** (string)\n  The name of the GitHub repository associated with the artifact. This should be used\n  when there are no provenance attestations available for the artifact. The repository\n  must belong to the organization specified in the path parameter.\n  If a provenance attestation is available for the artifact, the API will use\n  the repository information from the attestation instead of this parameter.\n\n* **`return_records`** (boolean)\n  If true, the endpoint will return the created or updated record in the response body.\n  Default: `true`\n\n### HTTP response status codes\n\n* **200** - Artifact deployment record stored successfully.\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/artifacts/metadata/deployment-record \\\n  -d '{\n  \"name\": \"awesome-image\",\n  \"digest\": \"sha256:1bb1e949e55dcefc6353e7b36c8897d2a107d8e8dca49d4e3c0ea8493fc0bc72\",\n  \"status\": \"deployed\",\n  \"logical_environment\": \"prod\",\n  \"physical_environment\": \"pacific-east\",\n  \"cluster\": \"moda-1\",\n  \"deployment_name\": \"deployment-pod\",\n  \"tags\": {\n    \"data-access\": \"sensitive\"\n  }\n}'\n```\n\n**Response schema (Status: 200):**\n\n* `total_count`: required, integer\n* `deployment_records`: array of `Artifact Deployment Record`:\n  * `id`: integer\n  * `digest`: string\n  * `logical_environment`: string\n  * `physical_environment`: string\n  * `cluster`: string\n  * `deployment_name`: string\n  * `tags`: object, additional properties: string\n  * `runtime_risks`: array of string, enum: `critical-resource`, `internet-exposed`, `lateral-movement`, `sensitive-data`\n  * `created_at`: string\n  * `updated_at`: string\n  * `attestation_id`: integer or null\n\n## Set cluster deployment records\n\n```\nPOST /orgs/{org}/artifacts/metadata/deployment-record/cluster/{cluster}\n```\n\nSet deployment records for a given cluster.\nIf proposed records in the 'deployments' field have identical 'cluster', 'logical\\_environment',\n'physical\\_environment', and 'deployment\\_name' values as existing records, the existing records will be updated.\nIf no existing records match, new records will be created.\nNote: Artifacts are uniquely identified by the combination of their repository and digest fields. If two entries in the deployments\narray resolve to the same repository and have identical digest fields but differing name and version fields, the endpoint will use\nthe artifact name and version from the record processed first, since a single artifact (identified by repository and digest) can\nonly have one name and version.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`cluster`** (string) (required)\n  The cluster name.\n\n#### Body parameters\n\n* **`logical_environment`** (string) (required)\n  The stage of the deployment.\n\n* **`physical_environment`** (string)\n  The physical region of the deployment.\n\n* **`deployments`** (array of objects) (required)\n  The list of deployments to record.\n  * **`name`** (string) (required)\n    The name of the artifact.\n  * **`digest`** (string) (required)\n    The hex encoded digest of the artifact.\n  * **`version`** (string)\n    The artifact version.\n  * **`status`** (string)\n    The deployment status of the artifact.\n    Default: `deployed`\n    Can be one of: `deployed`, `decommissioned`\n  * **`deployment_name`** (string) (required)\n    The unique identifier for the deployment represented by the new record. To accommodate differing\n    containers and namespaces within a record set, the following format is recommended:\n    {namespaceName}-{deploymentName}-{containerName}.\n    The deployment\\_name must be unique across all entries in the deployments array.\n  * **`github_repository`** (string)\n    The name of the GitHub repository associated with the artifact. This should be used\n    when there are no provenance attestations available for the artifact. The repository\n    must belong to the organization specified in the path parameter.\n    If a provenance attestation is available for the artifact, the API will use\n    the repository information from the attestation instead of this parameter.\n  * **`tags`** (object)\n    Key-value pairs to tag the deployment record.\n  * **`runtime_risks`** (array of strings)\n    A list of runtime risks associated with the deployment.\n    Supported values are: critical-resource, internet-exposed, lateral-movement, sensitive-data\n\n* **`partial_success`** (boolean)\n  When enabled, deployments associated with repositories the actor can write to are processed\n  while deployments associated with repositories that cannot be resolved or written to by the actor\n  are skipped and reported in the errors array. When false (the default), the endpoint returns\n  an error if any targeted repository cannot be resolved, the actor lacks write access, or no matching attestation can be found.\n  Default: `false`\n\n* **`return_records`** (boolean)\n  If true, the endpoint will return the set records in the response body\n  Default: `true`\n\n### HTTP response status codes\n\n* **200** - Deployment records created or updated successfully.\n\n* **207** - This response format is only returned when partial\\_success is set to true in the request body.\n  Successfully processed deployments are included in the deployment\\_records field. Records that could\n  not be processed and were skipped because of unresolvable repositories, missing actor permissions, or lack of a matching attestation are\n  included in the errors field.\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example 1: Status Code 200\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/artifacts/metadata/deployment-record/cluster/CLUSTER \\\n  -d '{\n  \"logical_environment\": \"prod\",\n  \"physical_environment\": \"pacific-east\",\n  \"deployments\": [\n    {\n      \"name\": \"awesome-image\",\n      \"digest\": \"sha256:1bb1e949e55dcefc6353e7b36c8897d2a107d8e8dca49d4e3c0ea8493fc0bc72\",\n      \"version\": \"2.1.0\",\n      \"status\": \"deployed\",\n      \"deployment_name\": \"deployment-pod\",\n      \"tags\": {\n        \"owning-team\": \"platform\"\n      },\n      \"runtime_risks\": [\n        \"sensitive-data\"\n      ]\n    }\n  ]\n}'\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Create an artifact deployment record](#create-an-artifact-deployment-record).\n\n#### Example 2: Status Code 207\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/artifacts/metadata/deployment-record/cluster/CLUSTER \\\n  -d '{\n  \"logical_environment\": \"prod\",\n  \"physical_environment\": \"pacific-east\",\n  \"deployments\": [\n    {\n      \"name\": \"awesome-image\",\n      \"digest\": \"sha256:1bb1e949e55dcefc6353e7b36c8897d2a107d8e8dca49d4e3c0ea8493fc0bc72\",\n      \"version\": \"2.1.0\",\n      \"status\": \"deployed\",\n      \"deployment_name\": \"deployment-pod\",\n      \"tags\": {\n        \"owning-team\": \"platform\"\n      },\n      \"runtime_risks\": [\n        \"sensitive-data\"\n      ]\n    }\n  ]\n}'\n```\n\n**Response schema (Status: 207):**\n\n* `total_count`: required, integer\n* `deployment_records`: array of `Artifact Deployment Record`:\n  * `id`: integer\n  * `digest`: string\n  * `logical_environment`: string\n  * `physical_environment`: string\n  * `cluster`: string\n  * `deployment_name`: string\n  * `tags`: object, additional properties: string\n  * `runtime_risks`: array of string, enum: `critical-resource`, `internet-exposed`, `lateral-movement`, `sensitive-data`\n  * `created_at`: string\n  * `updated_at`: string\n  * `attestation_id`: integer or null\n* `errors`: array of objects:\n  * `cause`: string, enum: `unauthorized`, `not_found`\n  * `deployment`: object:\n    * `name`: string\n    * `digest`: string\n    * `deployment_name`: string\n    * `version`: string or null\n    * `status`: string\n    * `github_repository`: string or null\n    * `tags`: object, additional properties: string\n    * `runtime_risks`: array of string\n\n## Create a cluster deployment records job\n\n```\nPOST /orgs/{org}/artifacts/metadata/deployment-record/cluster/{cluster}/jobs\n```\n\nCreate a background job to set deployment records for a given cluster.\nPerforms validation and permission checks synchronously, returning rejected\ndeployments immediately, then enqueues a background job for the actual\ndeployment updates. Use the companion GET endpoint to poll for job status.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`cluster`** (string) (required)\n  The cluster name.\n\n#### Body parameters\n\n* **`logical_environment`** (string) (required)\n  The stage of the deployment.\n\n* **`physical_environment`** (string)\n  The physical region of the deployment.\n\n* **`deployments`** (array of objects) (required)\n  The list of deployments to record.\n  * **`name`** (string) (required)\n    The name of the artifact.\n  * **`digest`** (string) (required)\n    The hex encoded digest of the artifact.\n  * **`version`** (string)\n    The artifact version.\n  * **`status`** (string)\n    The deployment status of the artifact.\n    Default: `deployed`\n    Can be one of: `deployed`, `decommissioned`\n  * **`deployment_name`** (string) (required)\n    The unique identifier for the deployment represented by the new record.\n  * **`github_repository`** (string)\n    The name of the GitHub repository associated with the artifact.\n  * **`tags`** (object)\n    Key-value pairs to tag the deployment record.\n  * **`runtime_risks`** (array of strings)\n    A list of runtime risks associated with the deployment.\n    Supported values are: critical-resource, internet-exposed, lateral-movement, sensitive-data\n\n### HTTP response status codes\n\n* **202** - Job created successfully. Authorized deployments will be processed in the background.\n\n* **400** - Bad Request\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n* **409** - A job is already in progress for this cluster.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/artifacts/metadata/deployment-record/cluster/CLUSTER/jobs \\\n  -d '{\n  \"logical_environment\": \"prod\",\n  \"physical_environment\": \"pacific-east\",\n  \"deployments\": [\n    {\n      \"name\": \"awesome-image\",\n      \"digest\": \"sha256:1bb1e949e55dcefc6353e7b36c8897d2a107d8e8dca49d4e3c0ea8493fc0bc72\",\n      \"version\": \"2.1.0\",\n      \"status\": \"deployed\",\n      \"deployment_name\": \"deployment-pod\",\n      \"tags\": {\n        \"owning-team\": \"platform\"\n      },\n      \"runtime_risks\": [\n        \"sensitive-data\"\n      ]\n    }\n  ]\n}'\n```\n\n**Response schema (Status: 202):**\n\n* `job_id`: required, integer\n* `errors`: array of object\n\n## Get cluster deployment records job status\n\n```\nGET /orgs/{org}/artifacts/metadata/deployment-record/cluster/{cluster}/jobs/{job_id}\n```\n\nGet the status and results of a previously created cluster deployment records job.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`cluster`** (string) (required)\n  The cluster name.\n\n* **`job_id`** (integer) (required)\n  The ID of the job.\n\n### HTTP response status codes\n\n* **200** - Job status retrieved successfully.\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/artifacts/metadata/deployment-record/cluster/CLUSTER/jobs/JOB_ID\n```\n\n**Response schema (Status: 200):**\n\n* `job_id`: required, integer\n* `status`: required, string, enum: `pending`, `processing`, `completed`, `failed`\n* `started_at`: string, format: date-time\n* `total_count`: integer\n* `errors`: array of object\n\n## Create artifact metadata storage record\n\n```\nPOST /orgs/{org}/artifacts/metadata/storage-record\n```\n\nCreate metadata storage records for artifacts associated with an organization.\nThis endpoint will create a new artifact storage record on behalf of any artifact matching the provided digest and\nassociated with a repository owned by the organization.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n#### Body parameters\n\n* **`name`** (string) (required)\n  The name of the artifact.\n\n* **`digest`** (string) (required)\n  The digest of the artifact (algorithm:hex-encoded-digest).\n\n* **`version`** (string)\n  The artifact version.\n\n* **`artifact_url`** (string)\n  The URL where the artifact is stored.\n\n* **`path`** (string)\n  The path of the artifact.\n\n* **`registry_url`** (string) (required)\n  The base URL of the artifact registry.\n\n* **`repository`** (string)\n  The repository name within the registry.\n\n* **`status`** (string)\n  The status of the artifact (e.g., active, inactive).\n  Default: `active`\n  Can be one of: `active`, `eol`, `deleted`\n\n* **`github_repository`** (string)\n  The name of the GitHub repository associated with the artifact. This should be used\n  when there are no provenance attestations available for the artifact. The repository\n  must belong to the organization specified in the path parameter.\n  If a provenance attestation is available for the artifact, the API will use\n  the repository information from the attestation instead of this parameter.\n\n* **`return_records`** (boolean)\n  If true, the endpoint will return the created record in the response body.\n  Default: `true`\n\n### HTTP response status codes\n\n* **200** - Artifact metadata storage record stored successfully.\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/artifacts/metadata/storage-record \\\n  -d '{\n  \"name\": \"libfoo\",\n  \"version\": \"1.2.3\",\n  \"digest\": \"sha256:1bb1e949e55dcefc6353e7b36c8897d2a107d8e8dca49d4e3c0ea8493fc0bc72\",\n  \"artifact_url\": \"https://reg.example.com/artifactory/bar/libfoo-1.2.3\",\n  \"registry_url\": \"https://reg.example.com/artifactory/\",\n  \"repository\": \"bar\",\n  \"status\": \"active\"\n}'\n```\n\n**Response schema (Status: 200):**\n\n* `total_count`: required, integer\n* `storage_records`: array of objects:\n  * `id`: integer\n  * `name`: string\n  * `digest`: string\n  * `artifact_url`: string or null\n  * `registry_url`: string\n  * `repository`: string or null\n  * `status`: string\n  * `created_at`: string\n  * `updated_at`: string\n\n## List artifact deployment records\n\n```\nGET /orgs/{org}/artifacts/{subject_digest}/metadata/deployment-records\n```\n\nList deployment records for an artifact metadata associated with an organization.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`subject_digest`** (string) (required)\n  The SHA256 digest of the artifact, in the form sha256:HEX\\_DIGEST.\n\n### HTTP response status codes\n\n* **200** - Successful response\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/artifacts/SUBJECT_DIGEST/metadata/deployment-records\n```\n\n**Response schema (Status: 200):**\n\n* `total_count`: integer\n* `deployment_records`: array of `Artifact Deployment Record`:\n  * `id`: integer\n  * `digest`: string\n  * `logical_environment`: string\n  * `physical_environment`: string\n  * `cluster`: string\n  * `deployment_name`: string\n  * `tags`: object, additional properties: string\n  * `runtime_risks`: array of string, enum: `critical-resource`, `internet-exposed`, `lateral-movement`, `sensitive-data`\n  * `created_at`: string\n  * `updated_at`: string\n  * `attestation_id`: integer or null\n\n## List artifact storage records\n\n```\nGET /orgs/{org}/artifacts/{subject_digest}/metadata/storage-records\n```\n\nList artifact storage records with a given subject digest for repositories owned by an organization.\nResults are filtered by the authenticated user's permissions; records for repositories the user cannot read are omitted. Fine-grained access tokens require the artifact-metadata:read permission.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`subject_digest`** (string) (required)\n  The parameter should be set to the attestation's subject's SHA256 digest, in the form sha256:HEX\\_DIGEST.\n\n### HTTP response status codes\n\n* **200** - OK\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/artifacts/SUBJECT_DIGEST/metadata/storage-records\n```\n\n**Response schema (Status: 200):**\n\n* `total_count`: integer\n* `storage_records`: array of objects:\n  * `id`: integer\n  * `name`: string\n  * `digest`: string\n  * `artifact_url`: string\n  * `registry_url`: string\n  * `repository`: string\n  * `status`: string\n  * `created_at`: string\n  * `updated_at`: string"}