JFrog

JFrog Evidence API

Create and manage evidence attestations

GitHub OpenAPI

Operations 10

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /v1/evidence Attach signed evidence to an artifact or build · JFrog Create Evidence #
Ask an LLM
“How do I attach a signed in-toto attestation to an artifact or build?”
“Can evidence be attached to a package or a release bundle as well as an artifact?”
Tell an agent
Create evidence of type {predicate_type} on {subject_type} {subject}.
Attach a DSSE-signed attestation to {subject_type} {subject} using key {key_alias}.
POST /v1/evidence/search Search evidence records · JFrog Search Evidence #
Ask an LLM
“Which evidence records were created by a given user in the last month?”
“Can I filter evidence by predicate type and creation date?”
Tell an agent
Search evidence of predicate type {predicate_type} created after {created_from}.
Find evidence created by {created_by} on {subject_type} subjects.
GET /v1/evidence/{evidenceId} Get one evidence record by ID · JFrog Get Evidence #
Ask an LLM
“How do I see the DSSE envelope of one evidence record by its ID?”
“What verification status does a single evidence record show?”
Tell an agent
Show evidence record {evidenceId}.
Get the DSSE envelope for evidence {evidenceId}.
DELETE /v1/evidence/{evidenceId} Delete an evidence record · JFrog Delete Evidence #
Ask an LLM
“How do I remove an evidence record that was attached by mistake?”
“Can I delete a single evidence attestation by its ID?”
Tell an agent destructive · confirm first
Delete evidence record {evidenceId}.
Remove evidence {evidenceId} from the platform.
GET /v1/evidence/subject/artifact List evidence attached to an artifact · JFrog Get Artifact Evidence #
Ask an LLM
“What attestations are attached to a specific artifact in a repository?”
“Can I look up an artifact's evidence by its SHA-256 checksum?”
Tell an agent
List evidence on the artifact at {repo_path}.
Show evidence for artifact {repo_path} with checksum {sha256}.
GET /v1/evidence/subject/build List evidence attached to a build · JFrog Get Build Evidence #
Ask an LLM
“Which attestations were recorded against a particular build run?”
“Can I scope a build's evidence lookup to one project?”
Tell an agent
List evidence for build {build_name} number {build_number}.
Show build {build_name} run {build_number} evidence in project {project}.
GET /v1/evidence/subject/release-bundle List evidence on a release bundle via v1 · JFrog Get Release Bundle Evidence #
Ask an LLM
“How do I query the v1 evidence subject endpoint for a release bundle version?”
“Can the v1 release-bundle evidence lookup be limited to one project?”
Tell an agent
Using the v1 subject lookup, list evidence for release bundle {name} version {version}.
Query v1 release-bundle evidence for {name} {version} in project {project}.
GET /v1/evidence/subject/package List evidence attached to a package · JFrog Get Package Evidence #
Ask an LLM
“What evidence is attached to a specific package version in a repository?”
“Can I check attestations on an npm or Maven package version?”
Tell an agent
List evidence for package {package_name} version {package_version} in repo {repo_key}.
Show attestations on {package_name}@{package_version} stored in {repo_key}.
POST /v2/evidence Add evidence to a release bundle version (v2) · JFrog Create Evidence #
Ask an LLM
“How do I record evidence for a release bundle version tied to an environment?”
“Can I point the v2 evidence endpoint at a DSSE file path?”
Tell an agent
Add v2 evidence to release bundle {release_bundle_name} version {release_bundle_version} for environment {environment}.
Record {evidence_type} evidence on bundle {release_bundle_name} {release_bundle_version} from file {dsse_file_path}.
GET /v2/evidence/{name}/{version} Get v2 evidence for a release bundle version · JFrog Get Evidence #
Ask an LLM
“Where do I fetch all v2 evidence for a release bundle by name and version path?”
“Which evidence records does the v2 endpoint return for one bundle version?”
Tell an agent
Get v2 evidence for release bundle {name} at version {version}.
Fetch the v2 evidence list of bundle {name} {version}.

Documentation

📖
Documentation
https://www.jfrog.com/confluence/display/JFROG/Artifactory+REST+API
📖
Authentication
https://www.jfrog.com/confluence/display/JFROG/Access+Tokens
📖
GettingStarted
https://jfrog.com/help/r/jfrog-artifactory-documentation/use-the-rest-api
📖
Documentation
https://jfrog.com/help/r/jfrog-rest-apis/artifactory-rest-api-v2
📖
Authentication
https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens
📖
Documentation
https://www.jfrog.com/confluence/display/JFROG/Xray+REST+API
📖
GettingStarted
https://jfrog.com/help/r/xray-rest-apis/introduction-to-the-xray-rest-apis
📖
Documentation
https://www.jfrog.com/confluence/display/JFROG/Distribution+REST+API
📖
Documentation
https://www.jfrog.com/confluence/display/JFROG/Pipelines+REST+API
📖
GettingStarted
https://jfrog.com/help/r/jfrog-rest-apis/introduction-to-the-pipelines-rest-apis
📖
Documentation
https://www.jfrog.com/confluence/display/JFROG/JFrog+Platform+REST+API
📖
GettingStarted
https://jfrog.com/help/r/jfrog-rest-apis/introduction-to-the-jfrog-platform-rest-apis
📖
Documentation
https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-rest-api
📖
GettingStarted
https://jfrog.com/help/r/jfrog-platform-administration-documentation/introduction-to-access-tokens
📖
Documentation
https://jfrog.com/help/r/jfrog-rest-apis/jfrog-curation-rest-apis
📖
Documentation
https://jfrog.com/help/r/jfrog-rest-apis/mission-control-rest-apis
📖
Documentation
https://jfrog.com/help/r/jfrog-rest-apis/release-lifecycle-management
📖
Documentation
https://jfrog.com/help/r/jfrog-rest-apis/workers-rest-apis
📖
Documentation
https://jfrog.com/help/r/jfrog-ml-documentation/jfrog-ml-rest-api
📖
Documentation
https://docs.connect.jfrog.io/rest-api-v2/connect-api-reference
📖
Authentication
https://docs.connect.jfrog.io/developers
📖
Documentation
https://jfrog.com/help/r/jfrog-security-user-guide/products/catalog
📖
Documentation
https://jfrog.com/help/r/jfrog-artifactory-documentation/create-evidence-using-rest-apis

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/jfrog/refs/heads/main/openapi/jfrog-evidence-api-openapi.yml

Other Resources

🔗
Reference
https://jfrog.com/help/r/jfrog-rest-apis/artifactory-rest-apis
🔗
Blog
https://jfrog.com/blog/agent-skills-new-ai-packages/
🔗
Reference
https://jfrog.com/help/r/xray-rest-apis
🔗
Reference
https://jfrog.com/help/r/jfrog-rest-apis/distribution-rest-apis
🔗
Reference
https://jfrog.com/help/r/jfrog-rest-apis/pipelines-rest-apis
🔗
Reference
https://jfrog.com/help/r/jfrog-rest-apis/jfrog-platform-rest-apis

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/jfrog:jfrog-evidence-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

jfrog-evidence-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Jfrog Evidence API
  contact:
    name: JFrog
    url: https://jfrog.com
  license:
    name: Proprietary
    url: https://jfrog.com/terms-of-service/
  termsOfService: https://jfrog.com/terms-of-service/
  version: '1.0'
  description: 'Operations tagged Evidence across 2 of this provider''s published API definitions: jfrog-evidence-openapi.yml, jfrog-release-lifecycle-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{server}.jfrog.io/evidence/api
  description: JFrog Cloud
  variables:
    server:
      default: myserver
      description: Your JFrog server name
- url: https://{host}/evidence/api
  description: Self-hosted JFrog instance
  variables:
    host:
      default: localhost:8082
      description: Your self-hosted JFrog server host
- url: https://{server}.jfrog.io/lifecycle/api
  description: JFrog Cloud
  variables:
    server:
      default: myserver
      description: Your JFrog server name
- url: https://{host}/lifecycle/api
  description: Self-hosted JFrog instance
  variables:
    host:
      default: localhost:8082
      description: Your self-hosted JFrog server host
tags:
- name: Evidence
  description: Create and manage evidence attestations
paths:
  /v1/evidence:
    post:
      operationId: createEvidence
      summary: JFrog Create Evidence
      description: Creates a new evidence attestation and attaches it to a subject (artifact, build, package, or release bundle). The evidence is signed as an in-toto statement wrapped in a DSSE envelope, providing cryptographic verification of the attestation. Requires an Enterprise+ subscription and Artifactory 7.104.2 or above.
      tags:
      - Evidence
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEvidenceRequest'
      responses:
        '201':
          description: Evidence created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Evidence'
        '400':
          description: Invalid evidence configuration or missing required fields
        '401':
          description: Unauthorized - access token required (basic auth not supported)
        '404':
          description: Subject not found
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v1/evidence/search:
    post:
      operationId: searchEvidence
      summary: JFrog Search Evidence
      description: Searches for evidence records matching specified criteria. Supports filtering by subject type, subject identifier, evidence type, and time range.
      tags:
      - Evidence
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EvidenceSearchRequest'
      responses:
        '200':
          description: Evidence search results retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  evidence:
                    type: array
                    items:
                      $ref: '#/components/schemas/Evidence'
                  total_count:
                    type: integer
        '400':
          description: Invalid search criteria
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v1/evidence/{evidenceId}:
    get:
      operationId: getEvidence
      summary: JFrog Get Evidence
      description: Returns details for a specific evidence record, including its DSSE envelope and verification status.
      tags:
      - Evidence
      parameters:
      - name: evidenceId
        in: path
        required: true
        schema:
          type: string
        description: Evidence record identifier
      responses:
        '200':
          description: Evidence details retrieved
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Evidence'
        '404':
          description: Evidence not found
      security:
      - bearerAuth: []
    delete:
      operationId: deleteEvidence
      summary: JFrog Delete Evidence
      description: Removes an evidence record from the platform.
      tags:
      - Evidence
      parameters:
      - name: evidenceId
        in: path
        required: true
        schema:
          type: string
        description: Evidence record identifier
      responses:
        '204':
          description: Evidence deleted
        '404':
          description: Evidence not found
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v1/evidence/subject/artifact:
    get:
      operationId: getArtifactEvidence
      summary: JFrog Get Artifact Evidence
      description: Returns all evidence records attached to a specific artifact identified by repository path and SHA-256.
      tags:
      - Evidence
      parameters:
      - name: repo_path
        in: query
        required: true
        schema:
          type: string
        description: Full artifact repository path
      - name: sha256
        in: query
        schema:
          type: string
        description: SHA-256 checksum of the artifact
      responses:
        '200':
          description: Artifact evidence retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  evidence:
                    type: array
                    items:
                      $ref: '#/components/schemas/Evidence'
        '404':
          description: Artifact not found
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v1/evidence/subject/build:
    get:
      operationId: getBuildEvidence
      summary: JFrog Get Build Evidence
      description: Returns all evidence records attached to a specific build.
      tags:
      - Evidence
      parameters:
      - name: build_name
        in: query
        required: true
        schema:
          type: string
        description: Build name
      - name: build_number
        in: query
        required: true
        schema:
          type: string
        description: Build number
      - name: project
        in: query
        schema:
          type: string
        description: Project key (if build is project-scoped)
      responses:
        '200':
          description: Build evidence retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  evidence:
                    type: array
                    items:
                      $ref: '#/components/schemas/Evidence'
        '404':
          description: Build not found
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v1/evidence/subject/release-bundle:
    get:
      operationId: getReleaseBundleEvidence
      summary: JFrog Get Release Bundle Evidence
      description: Returns all evidence records attached to a specific release bundle version.
      tags:
      - Evidence
      parameters:
      - name: name
        in: query
        required: true
        schema:
          type: string
        description: Release bundle name
      - name: version
        in: query
        required: true
        schema:
          type: string
        description: Release bundle version
      - name: project
        in: query
        schema:
          type: string
        description: Project key
      responses:
        '200':
          description: Release bundle evidence retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  evidence:
                    type: array
                    items:
                      $ref: '#/components/schemas/Evidence'
        '404':
          description: Release bundle not found
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v1/evidence/subject/package:
    get:
      operationId: getPackageEvidence
      summary: JFrog Get Package Evidence
      description: Returns all evidence records attached to a specific package.
      tags:
      - Evidence
      parameters:
      - name: package_name
        in: query
        required: true
        schema:
          type: string
        description: Package name
      - name: package_version
        in: query
        required: true
        schema:
          type: string
        description: Package version
      - name: repo_key
        in: query
        required: true
        schema:
          type: string
        description: Repository key containing the package
      responses:
        '200':
          description: Package evidence retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  evidence:
                    type: array
                    items:
                      $ref: '#/components/schemas/Evidence'
        '404':
          description: Package not found
      security:
      - bearerAuth: []
    servers:
    - url: https://{server}.jfrog.io/evidence/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/evidence/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v2/evidence:
    post:
      operationId: postV2Evidence
      summary: JFrog Create Evidence
      description: Creates a new evidence record attached to a release bundle.
      tags:
      - Evidence
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EvidenceRequest'
      responses:
        '201':
          description: Evidence created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Evidence_2'
      security:
      - bearerAuth: []
      - basicAuth: []
      x-operation-id-source: normalized
      x-operation-id-original: createEvidence
    servers:
    - url: https://{server}.jfrog.io/lifecycle/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/lifecycle/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
  /v2/evidence/{name}/{version}:
    get:
      operationId: getV2EvidenceByNameByVersion
      summary: JFrog Get Evidence
      description: Returns all evidence records for a release bundle version.
      tags:
      - Evidence
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
        description: Release bundle name
      - name: version
        in: path
        required: true
        schema:
          type: string
        description: Release bundle version
      responses:
        '200':
          description: Evidence records retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  evidence:
                    type: array
                    items:
                      $ref: '#/components/schemas/Evidence_2'
      security:
      - bearerAuth: []
      - basicAuth: []
      x-operation-id-source: normalized
      x-operation-id-original: getEvidence
    servers:
    - url: https://{server}.jfrog.io/lifecycle/api
      description: JFrog Cloud
      variables:
        server:
          default: myserver
          description: Your JFrog server name
    - url: https://{host}/lifecycle/api
      description: Self-hosted JFrog instance
      variables:
        host:
          default: localhost:8082
          description: Your self-hosted JFrog server host
components:
  schemas:
    Evidence:
      type: object
      properties:
        id:
          type: string
          description: Unique evidence record identifier
        subject_type:
          type: string
          enum:
          - artifact
          - build
          - package
          - release_bundle
        subject:
          type: object
          additionalProperties: true
          description: Subject identification details
        predicate_type:
          type: string
          format: uri
          description: URI of the predicate type
        predicate:
          type: object
          additionalProperties: true
          description: Evidence predicate content
        dsse_envelope_path:
          type: string
          description: Path to the DSSE envelope file in Artifactory
        signature_algorithm:
          type: string
          description: Cryptographic algorithm used for signing
          enum:
          - ECDSA
          - RSA
          - ED25519
        key_alias:
          type: string
          description: Alias of the signing key
        verified:
          type: boolean
          description: Whether the evidence signature has been verified
        created:
          type: string
          format: date-time
        created_by:
          type: string
    EvidenceSearchRequest:
      type: object
      properties:
        subject_type:
          type: string
          enum:
          - artifact
          - build
          - package
          - release_bundle
        predicate_type:
          type: string
          format: uri
        created_from:
          type: string
          format: date-time
        created_to:
          type: string
          format: date-time
        created_by:
          type: string
        limit:
          type: integer
          default: 25
        offset:
          type: integer
    CreateEvidenceRequest:
      type: object
      properties:
        subject_type:
          type: string
          description: Type of the subject to attach evidence to
          enum:
          - artifact
          - build
          - package
          - release_bundle
        subject:
          type: object
          description: Subject identifier (fields depend on subject_type)
          properties:
            repo_path:
              type: string
              description: Artifact repository path (for artifact subject)
            sha256:
              type: string
              description: Artifact SHA-256 checksum (for artifact subject)
            build_name:
              type: string
              description: Build name (for build subject)
            build_number:
              type: string
              description: Build number (for build subject)
            package_name:
              type: string
              description: Package name (for package subject)
            package_version:
              type: string
              description: Package version (for package subject)
            repo_key:
              type: string
              description: Repository key (for package subject)
            release_bundle_name:
              type: string
              description: Release bundle name (for release_bundle subject)
            release_bundle_version:
              type: string
              description: Release bundle version (for release_bundle subject)
            project:
              type: string
              description: Project key for project-scoped subjects
        predicate:
          type: object
          additionalProperties: true
          description: The evidence predicate content (in-toto statement predicate)
        predicate_type:
          type: string
          format: uri
          description: URI identifying the predicate type (e.g., https://in-toto.io/attestation/vulns)
        key_alias:
          type: string
          description: Alias of the public key registered for signature verification
        dsse_envelope:
          type: string
          description: Pre-signed DSSE envelope (alternative to providing predicate and key)
      required:
      - subject_type
      - subject
    Evidence_2:
      type: object
      properties:
        id:
          type: string
        release_bundle_name:
          type: string
        release_bundle_version:
          type: string
        environment:
          type: string
        evidence_type:
          type: string
        description:
          type: string
        created:
          type: string
          format: date-time
        created_by:
          type: string
        dsse_file_path:
          type: string
    EvidenceRequest:
      type: object
      properties:
        release_bundle_name:
          type: string
        release_bundle_version:
          type: string
        environment:
          type: string
        evidence_type:
          type: string
          enum:
          - test_results
          - approval
          - scan_results
          - build_info
          - custom
        description:
          type: string
        dsse_file_path:
          type: string
          description: Path to a DSSE signed envelope file in Artifactory
      required:
      - release_bundle_name
      - release_bundle_version
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Access token authentication. Note that basic authentication (username and password) is not supported for the Evidence API.
    basicAuth:
      type: http
      scheme: basic
      description: Basic username/password authentication
x-refined-from:
- jfrog-evidence-openapi.yml
- jfrog-release-lifecycle-openapi.yml