GitLab CI/CD attestations API

swagger: '2.0'
info:
  title: GitLab access_requests attestations API
  version: v4
  description: Operations related to access requests
host: gitlab.com
produces:
- application/json
tags:
- name: attestations
  description: Operations about attestations
paths:
  /api/v4/projects/{id}/attestations/{subject_digest}:
    get:
      summary: Fetch the list of all attestations for a specific project and artifact hash
      description: This feature was introduced in GitLab 18.7
      produces:
      - application/json
      parameters:
      - in: path
        name: id
        description: The ID or URL-encoded path of the project
        type: string
        required: true
      - in: path
        name: subject_digest
        description: The SHA-256 hash of the artifact
        type: string
        required: true
      responses:
        '200':
          description: Fetch the list of all attestations for a specific project and artifact hash
          schema:
            $ref: '#/definitions/API_Entities_SupplyChain_Attestation'
        '404':
          description: Artifact SHA-256 not found
      tags:
      - attestations
      operationId: getApiV4ProjectsIdAttestationsSubjectDigest
  /api/v4/projects/{id}/attestations/{attestation_iid}/download:
    get:
      summary: Fetch a specific bundle by iid
      description: This feature was introduced in GitLab 18.7
      produces:
      - application/json
      parameters:
      - in: path
        name: id
        description: The ID or URL-encoded path of the project
        type: string
        required: true
      - in: path
        name: attestation_iid
        description: The iid of the attestation
        type: string
        required: true
      responses:
        '200':
          description: Fetch a specific bundle by iid
        '404':
          description: Artifact SHA-256 not found
      tags:
      - attestations
      operationId: getApiV4ProjectsIdAttestationsAttestationIidDownload
definitions:
  API_Entities_SupplyChain_Attestation:
    type: object
    properties:
      id:
        type: integer
        format: int32
        example: 1
      iid:
        type: integer
        format: int32
        example: 14
      created_at:
        type: string
        format: date-time
        example: '2025-09-17T02:26:10.898Z'
      updated_at:
        type: string
        format: date-time
        example: '2025-09-17T02:26:10.898Z'
      expire_at:
        type: string
        format: date-time
        example: '2025-09-17T02:26:10.898Z'
      project_id:
        type: integer
        format: int32
      build_id:
        type: integer
        format: int32
      status:
        type: string
        example: success
      predicate_kind:
        type: string
        example: provenance
      predicate_type:
        type: string
        example: https://slsa.dev/provenance/v1
      subject_digest:
        type: string
        example: 5db1fee4b5703808c48078a76768b155b421b210c0761cd6a5d223f4d99f1eaa
      download_url:
        type: string
    required:
    - id
    - iid
    - created_at
    - updated_at
    - expire_at
    - project_id
    - build_id
    - status
    - predicate_kind
    - predicate_type
    - subject_digest
    - download_url
    description: API_Entities_SupplyChain_Attestation model
securityDefinitions:
  access_token_header:
    type: apiKey
    name: PRIVATE-TOKEN
    in: header
  access_token_query:
    type: apiKey
    name: private_token
    in: query