# npm Provenance

**Canonical:** https://apis.io/apis/npm/provenance/  
**Provider:** npm — https://apis.io/providers/npm/  
**Documentation:** https://docs.npmjs.com/generating-provenance-statements

npm Provenance is one of 10 APIs that [npm](https://apis.io/providers/npm/) publishes on the [APIs.io](https://apis.io/) network. Tagged areas include Security, Supply Chain, Verification, Sigstore, and Transparency. The published artifact set on APIs.io includes API documentation.

npm Provenance provides supply chain security for JavaScript packages by establishing a verifiable link between a published package and its source code repository and build environment. When a package is published with provenance, it is signed using Sigstore public good servers and the attestation is logged in a public transparency ledger. This allows developers to verify where and how a package was built before downloading it, helping to protect against supply chain attacks and ensuring the integrity of the npm ecosystem.

## Machine-readable artifacts (2)

- **Documentation** — https://docs.npmjs.com/generating-provenance-statements
- **Documentation** — https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/

## Other npm APIs (9)

- [npm Registry API](https://apis.io/apis/npm/registry/)
- [npm Hooks API](https://apis.io/apis/npm/hooks/)
- [npm CLI](https://apis.io/apis/npm/cli/)
- [npm Downloads API](https://apis.io/apis/npm/npm-downloads-api/)
- [npm OIDC API](https://apis.io/apis/npm/npm-oidc-api/)
- [npm Packages API](https://apis.io/apis/npm/npm-packages-api/)
- [npm Search API](https://apis.io/apis/npm/npm-search-api/)
- [npm Tokens API](https://apis.io/apis/npm/npm-tokens-api/)
- [npm Trusted Publishers API](https://apis.io/apis/npm/npm-trusted-publishers-api/)

## Tags

Security, Supply Chain, Verification, Sigstore, Transparency, CI/CD

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/npm/provenance/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/npm/.