List all attestations for a project

GET

/api/v4/projects/{id}/attestations/{subject_digest}

• GitLab REST API

Lists all attestations for a specified project and artifact hash. This feature was introduced in GitLab 18.7.

Authorizations

• http
• oauth2

Parameters

Path Parameters

id

required

One of:

string

string

integer

integer

The ID or URL-encoded path of the project

subject_digest

required

string

The SHA-256 hash of the artifact

Responses

200

OK

Media type application/json

object

id

integer format: int64

iid

integer

created_at

string format: date-time

updated_at

string format: date-time

expire_at

string format: date-time

project_id

integer format: int64

build_id

integer format: int64

status

string

predicate_kind

string

predicate_type

string

subject_digest

string

download_url

string

Example

{
  "id": 1,
  "iid": 14,
  "created_at": "2025-09-17T02:26:10.898Z",
  "updated_at": "2025-09-17T02:26:10.898Z",
  "expire_at": "2025-09-17T02:26:10.898Z",
  "status": "success",
  "predicate_kind": "provenance",
  "predicate_type": "https://slsa.dev/provenance/v1",
  "subject_digest": "5db1fee4b5703808c48078a76768b155b421b210c0761cd6a5d223f4d99f1eaa"
}

400

Bad Request

404

Artifact SHA-256 not found