# GUAC (Graph for Understanding Artifact Composition)

**Canonical:** https://apis.io/apis/openssf/guac-api/  
**Provider:** OpenSSF — https://apis.io/providers/openssf/  
**Base URL:** https://guac.sh  
**Documentation:** https://guac.sh/

GUAC (Graph for Understanding Artifact Composition) is one of 7 APIs that [OpenSSF](https://apis.io/providers/openssf/) publishes on the [APIs.io](https://apis.io/) network. Tagged areas include SBOM, Supply Chain, and GraphQL. The published artifact set on APIs.io includes API documentation and a GitHub repository.

GUAC aggregates software supply-chain security metadata (SBOMs, attestations, vulnerabilities, signatures) into a queryable graph. GUAC exposes a GraphQL API for supply-chain queries when self-hosted.

## Machine-readable artifacts (3)

- **Documentation** — https://docs.guac.sh/
- **GitHubRepository** — https://github.com/guacsec/guac
- **GraphQL** — https://raw.githubusercontent.com/api-evangelist/openssf/refs/heads/main/graphql/openssf-graphql.md

## Other OpenSSF APIs (6)

- [Sigstore Public Good APIs](https://apis.io/apis/openssf/sigstore-api/)
- [OpenSSF Projects API](https://apis.io/apis/openssf/openssf-projects-api/)
- [OpenSSF Query API](https://apis.io/apis/openssf/openssf-query-api/)
- [OpenSSF Querybatch API](https://apis.io/apis/openssf/openssf-querybatch-api/)
- [OpenSSF V1experimental API](https://apis.io/apis/openssf/openssf-v1experimental-api/)
- [OpenSSF Vulns API](https://apis.io/apis/openssf/openssf-vulns-api/)

## Tags

SBOM, Supply Chain, GraphQL

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/openssf/guac-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/openssf/.