Application Research

Application Research Signatures API

Operations for component signing and verification

Documentation GitHub OpenAPI

Operations 3

GET /components/{name}/signatures Application Research List signatures for a component #

POST /components/{name}/signatures Application Research Sign a component #

POST /components/{name}/signatures/{signatureName}/verify Application Research Verify a component signature #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/application-research-signatures-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Application Research Open Component Model Signatures API
  version: 1.0.0
  description: 'API for managing Open Component Model (OCM) component descriptors and configurations.


    The Open Component Model provides a standard for describing software components,

    their resources, sources, and dependencies in a technology-agnostic way.

    '
  contact:
    name: OCM Project
    url: https://ocm.software
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://api.ocm.example.com/v1
  description: Production server
- url: https://staging.ocm.example.com/v1
  description: Staging server
security:
- bearerAuth: []
- apiKey: []
tags:
- name: Signatures
  description: Operations for component signing and verification
paths:
  /components/{name}/signatures:
    parameters:
    - $ref: '#/components/parameters/ComponentNameParam'
    get:
      tags:
      - Signatures
      summary: Application Research List signatures for a component
      operationId: listComponentSignatures
      parameters:
      - $ref: '#/components/parameters/VersionQueryParam'
      responses:
        '200':
          description: List of signatures
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignatureListResponse'
              examples:
                signatureList:
                  $ref: '#/components/examples/SignatureListResponse'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
    post:
      tags:
      - Signatures
      summary: Application Research Sign a component
      operationId: signComponent
      parameters:
      - $ref: '#/components/parameters/VersionQueryParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignatureRequest'
            examples:
              rsaSignature:
                $ref: '#/components/examples/SignatureRequest'
      responses:
        '201':
          description: Component signed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Signature'
              examples:
                signature:
                  $ref: '#/components/examples/Signature'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
  /components/{name}/signatures/{signatureName}/verify:
    post:
      tags:
      - Signatures
      summary: Application Research Verify a component signature
      operationId: verifyComponentSignature
      parameters:
      - $ref: '#/components/parameters/ComponentNameParam'
      - $ref: '#/components/parameters/SignatureNameParam'
      - $ref: '#/components/parameters/VersionQueryParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerificationRequest'
            examples:
              verifyRequest:
                $ref: '#/components/examples/VerificationRequest'
      responses:
        '200':
          description: Verification result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerificationResult'
              examples:
                verified:
                  $ref: '#/components/examples/VerificationResultSuccess'
                failed:
                  $ref: '#/components/examples/VerificationResultFailed'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  examples:
    VerificationResultSuccess:
      summary: Successful Verification
      description: Example successful verification result
      value:
        verified: true
        message: Signature verification successful
        signatureName: acme-signing-authority
        componentName: github.com/acme.org/web-application
        version: 2.5.1
    Signature:
      summary: Component Signature
      description: Example component signature
      value:
        name: acme-signing-authority
        digest:
          hashAlgorithm: SHA-256
          normalisationAlgorithm: jsonNormalisation/v1
          value: 7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
        signature:
          algorithm: RSASSA-PSS-SHA256
          value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
          mediaType: application/vnd.ocm.signature.rsa
    SignatureListResponse:
      summary: Signature list
      description: Example list of signatures
      value:
      - name: acme-signing-authority
        digest:
          hashAlgorithm: SHA-256
          normalisationAlgorithm: jsonNormalisation/v1
          value: 7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
        signature:
          algorithm: RSASSA-PSS-SHA256
          value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
          mediaType: application/vnd.ocm.signature.rsa
    VerificationRequest:
      summary: Verification Request
      description: Example request to verify a signature
      value:
        publicKey: '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhki...'
    ErrorBadRequest:
      summary: Bad Request Error
      description: Example bad request error
      value:
        code: BAD_REQUEST
        message: Invalid component name format
        details:
          field: component.name
          pattern: ^[a-z][-a-z0-9]*([.][a-z][-a-z0-9]*)*[.][a-z]{2,}(/[a-z][-a-z0-9_]*([.][a-z][-a-z0-9_]*)*)+$
    VerificationResultFailed:
      summary: Failed Verification
      description: Example failed verification result
      value:
        verified: false
        message: 'Signature verification failed: digest mismatch'
        signatureName: acme-signing-authority
        componentName: github.com/acme.org/web-application
        version: 2.5.1
    ErrorInternal:
      summary: Internal Error
      description: Example internal server error
      value:
        code: INTERNAL_ERROR
        message: An unexpected error occurred
        details:
          requestId: req-xyz789
    ErrorNotFound:
      summary: Not Found Error
      description: Example not found error
      value:
        code: NOT_FOUND
        message: Component 'github.com/acme.org/unknown-component' not found
    SignatureRequest:
      summary: Signature Request
      description: Example request to sign a component
      value:
        name: acme-signing-authority
        algorithm: RSASSA-PSS-SHA256
        privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBg...'
  parameters:
    VersionQueryParam:
      name: version
      in: query
      description: Component version (semver)
      schema:
        $ref: '#/components/schemas/Version'
    ComponentNameParam:
      name: name
      in: path
      required: true
      description: Component name (e.g., github.com/acme.org/web-application)
      schema:
        $ref: '#/components/schemas/ComponentName'
    SignatureNameParam:
      name: signatureName
      in: path
      required: true
      description: Signature name
      schema:
        type: string
  schemas:
    SignatureListResponse:
      type: array
      items:
        $ref: '#/components/schemas/Signature'
    Version:
      type: string
      description: Semantic version string
      pattern: ^[v]?(0|[1-9]\d*)(?:\.(0|[1-9]\d*))?(?:\.(0|[1-9]\d*))?(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
      examples:
      - 1.0.0
      - 2.5.1
      - v1.0.0-beta.1
    VerificationResult:
      type: object
      description: Signature verification result
      required:
      - verified
      properties:
        verified:
          type: boolean
          description: Whether verification succeeded
        message:
          type: string
          description: Verification message or error
        signatureName:
          type: string
        componentName:
          $ref: '#/components/schemas/ComponentName'
        version:
          $ref: '#/components/schemas/Version'
    DigestSpec:
      type: object
      description: Cryptographic digest specification
      required:
      - hashAlgorithm
      - normalisationAlgorithm
      - value
      properties:
        hashAlgorithm:
          type: string
          description: Hash algorithm used
          examples:
          - SHA-256
          - SHA-512
        normalisationAlgorithm:
          type: string
          description: Normalisation algorithm used
          examples:
          - jsonNormalisation/v1
          - ociArtifactDigest/v1
        value:
          type: string
          description: The digest value
    ComponentName:
      type: string
      description: Fully qualified component name
      maxLength: 255
      pattern: ^[a-z][-a-z0-9]*([.][a-z][-a-z0-9]*)*[.][a-z]{2,}(/[a-z][-a-z0-9_]*([.][a-z][-a-z0-9_]*)*)+$
      examples:
      - github.com/acme.org/web-application
      - github.com/ailab.org/model-training-pipeline
    SignatureSpec:
      type: object
      description: Signature specification
      required:
      - algorithm
      - value
      - mediaType
      properties:
        algorithm:
          type: string
          description: Signature algorithm
          examples:
          - RSASSA-PSS-SHA256
          - ECDSA-SHA256
        value:
          type: string
          description: The signature value
        mediaType:
          type: string
          description: Media type of the signature
          examples:
          - application/vnd.ocm.signature.rsa
    Signature:
      type: object
      description: Component signature
      required:
      - name
      - signature
      properties:
        name:
          type: string
          description: Signature name/identifier
        digest:
          $ref: '#/components/schemas/DigestSpec'
        signature:
          $ref: '#/components/schemas/SignatureSpec'
    Error:
      type: object
      description: Error response
      required:
      - code
      - message
      properties:
        code:
          type: string
        message:
          type: string
        details:
          type: object
          additionalProperties: true
    VerificationRequest:
      type: object
      description: Request to verify a signature
      required:
      - publicKey
      properties:
        publicKey:
          type: string
          description: Public key (PEM encoded)
        certificate:
          type: string
          description: Certificate for verification
    SignatureRequest:
      type: object
      description: Request to sign a component
      required:
      - name
      - algorithm
      properties:
        name:
          type: string
          description: Signature name
        algorithm:
          type: string
          description: Signing algorithm
          examples:
          - RSASSA-PSS-SHA256
          - ECDSA-SHA256
        privateKey:
          type: string
          description: Private key (PEM encoded)
        certificate:
          type: string
          description: Certificate chain (PEM encoded)
  responses:
    InternalError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            internalError:
              $ref: '#/components/examples/ErrorInternal'
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            notFound:
              $ref: '#/components/examples/ErrorNotFound'
    BadRequest:
      description: Bad request - invalid input
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            badRequest:
              $ref: '#/components/examples/ErrorBadRequest'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT-based authentication
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key authentication
    oidc:
      type: openIdConnect
      openIdConnectUrl: https://auth.ocm.example.com/.well-known/openid-configuration
      description: OpenID Connect authentication

Application Research Signatures API

Operations 3

Documentation

Specifications

Code Examples

Schemas & Data