Sigstore

Sigstore is a set of free-to-use open source tools for signing, verifying, and protecting software supply chain artifacts. It provides a transparent and auditable signing infrastructure that eliminates the need for managing signing keys, making software supply chain security more accessible. The Sigstore ecosystem includes Cosign for artifact signing, Fulcio as the certificate authority, and Rekor as the cryptographically secure transparency log.

Sigstore publishes 5 APIs on the APIs.io network, including CA API, entries API, index API, and 2 more. Tagged areas include Certificate Authority, Code Signing, Containers, Cryptography, and Open Source.

The Sigstore catalog on APIs.io includes 1 JSON-LD context and 2 Spectral governance rulesets.

Sigstore’s developer surface includes documentation, getting-started guide, engineering blog, and 9 more developer resources.

🌐 Visit website 📡 Source on GitHub

41.8/100 thin ▼ -6.4 Agent 22/100 agent aware Full breakdown ↓
scored 2026-07-28 · rubric v0.6

AccessPaid

6 APIs

Certificate AuthorityCode SigningContainersCryptographyOpen SourcePKISecuritySoftware Supply ChainTransparency Log

Kin Score

Kin Score How this is scored →
scored 2026-07-28 · rubric v0.6

Composite quality — 41.8/100 · thin

Contract Quality 11.3 / 25

Developer Ergonomics 5.2 / 20

Commercial Clarity 5.8 / 20

Operational Transparency 4.8 / 13

Governance 8.3 / 12

Discoverability 6.5 / 10

Agent readiness — 22/100 · agent aware

Machine-Readable Contract 18 / 18

Agentic Access Contract 10 / 10

MCP Server 0 / 12

Machine-Readable Auth 0 / 10

Idempotency 0 / 9

Stable Error Semantics 0 / 8

Request/Response Examples 0 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 0 / 6

Agent Skills 0 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 0 / 8

Dry-Run / Simulate Mode 0 / 4

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/sigstore: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 6

Individual APIs this provider publishes, each with its own machine-readable definition.

Rate Limits 1

Documented rate limits and quota policies.

Sigstore Rate Limits

1 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

JSON Schema 2

Standalone JSON Schema definitions for this provider's data models.

Examples 3

Example request and response payloads for these APIs.

Get Started 1

Portal, sign-up, and the first successful call

GettingStarted

GettingStarted

Documentation 1

Reference material describing how the API behaves

Documentation

Documentation

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

AgenticAccess

AgenticAccess

Design & Contract 1

Pagination, idempotency, versioning, errors, and events

Vocabulary

Vocabulary

Build 1

SDKs, sample code, and the tooling you integrate with

GitHubOrganization

GitHubOrganization

Access & Security 2

Authentication, authorization, and security posture

DomainSecurity

DomainSecurity

Security

Security

Operate 1

Status, limits, changes, and where to get help

Community

Community

Company 3

The organization behind the API

LinkedIn

Website

Website

Blog

Blog

Other 1

Properties that don't map to a standard resource type

Policy Controller

Policy Controller

Source (apis.yml)

aid: sigstore
name: Sigstore
description: Sigstore is a set of free-to-use open source tools for signing, verifying, and protecting software supply chain
  artifacts. It provides a transparent and auditable signing infrastructure that eliminates the need for managing signing
  keys, making software supply chain security more accessible. The Sigstore ecosystem includes Cosign for artifact signing,
  Fulcio as the certificate authority, and Rekor as the cryptographically secure transparency log.
type: Index
accessModel:
  pricing: paid
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Paid
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/sigstore.png
tags:
- Certificate Authority
- Code Signing
- Containers
- Cryptography
- Open Source
- PKI
- Security
- Software Supply Chain
- Transparency Log
url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/apis.yml
created: '2026-03-26'
modified: '2026-05-19'
specificationVersion: '0.19'
apis:
- aid: sigstore:cosign
  name: Cosign
  description: Cosign is the Sigstore tool for signing and verifying container images and other OCI artifacts. It enables
    keyless signing using OIDC identity, hardware token signing, and policy enforcement for container supply chain security.
  humanURL: https://docs.sigstore.dev/cosign/signing/overview/
  tags:
  - Code Signing
  - Containers
  - OCI
  - Security
  - Software Supply Chain
  properties:
  - type: Documentation
    url: https://docs.sigstore.dev/cosign/signing/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/cosign
- aid: sigstore:sigstore-ca-api
  name: Sigstore CA API
  description: The CA API from Sigstore — 3 operation(s) for ca.
  humanURL: https://docs.sigstore.dev/logging/overview/
  baseURL: https://rekor.sigstore.dev
  tags:
  - CA
  properties:
  - type: OpenAPI
    url: openapi/sigstore-ca-api-openapi.yml
  - type: Documentation
    url: https://docs.sigstore.dev/logging/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/rekor
  - type: Rules
    url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/rules/sigstore-rules.yml
  - type: Documentation
    url: https://docs.sigstore.dev/certificate_authority/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/fulcio
- aid: sigstore:sigstore-entries-api
  name: Sigstore entries API
  description: The entries API from Sigstore — 3 operation(s) for entries.
  humanURL: https://docs.sigstore.dev/logging/overview/
  baseURL: https://rekor.sigstore.dev
  tags:
  - entries
  properties:
  - type: OpenAPI
    url: openapi/sigstore-entries-api-openapi.yml
  - type: Documentation
    url: https://docs.sigstore.dev/logging/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/rekor
  - type: Rules
    url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/rules/sigstore-rules.yml
  - type: Documentation
    url: https://docs.sigstore.dev/certificate_authority/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/fulcio
- aid: sigstore:sigstore-index-api
  name: Sigstore index API
  description: The index API from Sigstore — 1 operation(s) for index.
  humanURL: https://docs.sigstore.dev/logging/overview/
  baseURL: https://rekor.sigstore.dev
  tags:
  - index
  properties:
  - type: OpenAPI
    url: openapi/sigstore-index-api-openapi.yml
  - type: Documentation
    url: https://docs.sigstore.dev/logging/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/rekor
  - type: Rules
    url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/rules/sigstore-rules.yml
  - type: Documentation
    url: https://docs.sigstore.dev/certificate_authority/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/fulcio
- aid: sigstore:sigstore-pubkey-api
  name: Sigstore pubkey API
  description: The pubkey API from Sigstore — 1 operation(s) for pubkey.
  humanURL: https://docs.sigstore.dev/logging/overview/
  baseURL: https://rekor.sigstore.dev
  tags:
  - pubkey
  properties:
  - type: OpenAPI
    url: openapi/sigstore-pubkey-api-openapi.yml
  - type: Documentation
    url: https://docs.sigstore.dev/logging/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/rekor
  - type: Rules
    url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/rules/sigstore-rules.yml
  - type: Documentation
    url: https://docs.sigstore.dev/certificate_authority/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/fulcio
- aid: sigstore:sigstore-tlog-api
  name: Sigstore tlog API
  description: The tlog API from Sigstore — 2 operation(s) for tlog.
  humanURL: https://docs.sigstore.dev/logging/overview/
  baseURL: https://rekor.sigstore.dev
  tags:
  - tlog
  properties:
  - type: OpenAPI
    url: openapi/sigstore-tlog-api-openapi.yml
  - type: Documentation
    url: https://docs.sigstore.dev/logging/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/rekor
  - type: Rules
    url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/rules/sigstore-rules.yml
  - type: Documentation
    url: https://docs.sigstore.dev/certificate_authority/overview/
  - type: GitHubRepository
    url: https://github.com/sigstore/fulcio
common:
- type: AgenticAccess
  url: agentic-access/sigstore-agentic-access.yml
- type: DomainSecurity
  url: security/sigstore-domain-security.yml
- type: LinkedIn
  url: https://www.linkedin.com/company/sigstore
- type: Website
  url: https://www.sigstore.dev/
- type: Documentation
  url: https://docs.sigstore.dev/
- type: GettingStarted
  url: https://docs.sigstore.dev/quickstart/quickstart-cosign/
- type: GitHubOrganization
  url: https://github.com/sigstore
- type: Blog
  url: https://blog.sigstore.dev/
- type: Community
  url: https://sigstore.dev/community/
- type: Policy Controller
  url: https://docs.sigstore.dev/policy-controller/overview/
- type: Security
  url: https://docs.sigstore.dev/about/security/
- type: Vocabulary
  url: https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/vocabulary/sigstore-vocabulary.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Sigstore

APIs 6

Open Collections 1

Pricing Plans 1