The Update Framework (TUF) website screenshot

The Update Framework (TUF)

TUF (The Update Framework) is a CNCF graduated framework for securing software update systems. It provides a specification for how software repositories should be structured and how clients should verify updates to protect against key compromise, rollback attacks, and mix-and-match attacks. TUF is used by many package managers and update systems including PyPI, Sigstore, and various Linux distributions. The framework defines a four-role metadata structure (root, targets, snapshot, timestamp) with threshold signing and delegation capabilities for scalable trust management.

The Update Framework (TUF) publishes 7 APIs on the APIs.io network. Tagged areas include CNCF, Cloud Native, Graduated, Security, and Software Supply Chain.

The The Update Framework (TUF) catalog on APIs.io includes 1 JSON-LD context and 1 Spectral governance ruleset.

The Update Framework (TUF)’s developer surface includes documentation, getting-started guide, engineering blog, and 13 more developer resources.

🌐 Visit website 📡 Source on GitHub
40.6/100 thin ▬ flat Agent 3/100 human only Full breakdown ↓
scored 2026-08-05 · rubric v0.9.1
AccessFreemium
7 APIs
CNCFCloud NativeGraduatedSecuritySoftware Supply ChainSoftware UpdatesVerification

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-08-05 · rubric v0.9.1
Composite quality — 40.6/100 · thin
Contract Quality 7.3 / 25
Developer Ergonomics 5.2 / 20
Commercial Clarity 7.9 / 20
Operational Transparency 4.8 / 13
Governance 8.3 / 12
Discoverability 7.2 / 10
Agent readiness — 3/100 · human only
Machine-Readable Contract 0 / 18
Agentic Access Contract 0 / 10
MCP Server 0 / 12
Machine-Readable Auth 0 / 10
Idempotency 0 / 9
Stable Error Semantics 0 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 0 / 6
Agent Skills 0 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/tuf: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 7

Individual APIs this provider publishes, each with its own machine-readable definition.

TUF Repository Specification

The TUF specification defines the structure of update repositories including the root, targets, snapshot, and timestamp metadata files. Each metadata file has a defined schema w...

TUF Python Reference Implementation

The official Python reference implementation of The Update Framework (TUF) specification. Provides a metadata API for reading and writing TUF metadata files, an ngclient API imp...

TUF Go Implementation

A Go implementation of The Update Framework (TUF), heavily influenced by python-tuf's design. Provides metadata, TrustedMetadata, and Updater packages implementing the TUF clien...

TUF Rust Implementation

A Rust implementation of The Update Framework (TUF) specification providing a strongly-typed API for working with TUF metadata, verifying signatures, and implementing the TUF cl...

TUF JavaScript Implementation

A JavaScript/TypeScript implementation of The Update Framework (TUF) for use in Node.js environments and browser-based update systems. Enables TUF-compliant software update veri...

TUF on CI

A TUF repository management and signing tool designed for use in CI/CD pipelines. Enables teams to maintain a TUF repository using GitHub Actions and other CI systems for automa...

TUF Conformance Test Suite

The official TUF client conformance test suite for verifying that TUF client implementations correctly implement the TUF specification, including proper handling of all attack v...

Scroll for all 7

Pricing Plans 1

Published pricing tiers and plan structures.

Tuf Plans Pricing

3 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Tuf Rate Limits

5 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Tuf Finops

FINOPS

Semantic Vocabularies 1

JSON-LD contexts and semantic vocabularies used across these APIs.

Tuf Context

0 classes · 12 properties

JSON-LD

Spectral Rules 1

Spectral governance rulesets for linting and validating these APIs.

The Update Framework (TUF) API Rules

6 rules · 5 warnings 1 info

SPECTRAL

JSON Schema 4

Standalone JSON Schema definitions for this provider's data models.

TUF Root Metadata

2 properties

JSON SCHEMA

TUF Snapshot Metadata

2 properties

JSON SCHEMA

TUF Targets Metadata

2 properties

JSON SCHEMA

TUF Timestamp Metadata

2 properties

JSON SCHEMA

JSON Structure 2

JSON Structure definitions describing this provider's data shapes.

Tuf Root Metadata Structure

0 properties

JSON STRUCTURE

Tuf Targets Metadata Structure

0 properties

JSON STRUCTURE

Examples 3

Example request and response payloads for these APIs.

Tuf Python Client Usage Example

4 fields

EXAMPLE

Tuf Root Metadata Example

3 fields

EXAMPLE

Tuf Targets Metadata Example

3 fields

EXAMPLE

Security Posture 1

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Tuf Domain Security

TLSv1.3 · HSTS

SECURITY

Resources

Get Started 1

Portal, sign-up, and the first successful call

GettingStarted
GettingStarted

Documentation 6

Reference material describing how the API behaves

Documentation
Documentation
 Specification
Specification
 JSONSchema
JSONSchema
 JSONSchema
JSONSchema
 JSONSchema
JSONSchema
 JSONSchema
JSONSchema

Design & Contract 2

Pagination, idempotency, versioning, errors, and events

JSONLD
JSONLD
 Vocabulary
Vocabulary

Build 2

SDKs, sample code, and the tooling you integrate with

GitHubOrganization
GitHubOrganization
 GitHubRepository
GitHubRepository

Access & Security 1

Authentication, authorization, and security posture

DomainSecurity
DomainSecurity

Operate 1

Status, limits, changes, and where to get help

Community
Community

Company 2

The organization behind the API

Website
Website
 Blog
Blog

Other 1

Properties that don't map to a standard resource type

CNCF
CNCF

Source (apis.yml)

apis.yml Raw ↑ 
aid: tuf
name: The Update Framework (TUF)
description: TUF (The Update Framework) is a CNCF graduated framework for securing software update systems. It provides a
  specification for how software repositories should be structured and how clients should verify updates to protect against
  key compromise, rollback attacks, and mix-and-match attacks. TUF is used by many package managers and update systems including
  PyPI, Sigstore, and various Linux distributions. The framework defines a four-role metadata structure (root, targets, snapshot,
  timestamp) with threshold signing and delegation capabilities for scalable trust management.
url: https://theupdateframework.io
accessModel:
  pricing: freemium
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Freemium
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/tuf.png
tags:
- CNCF
- Cloud Native
- Graduated
- Security
- Software Supply Chain
- Software Updates
- Verification
created: '2026-03-16'
modified: '2026-05-03'
specificationVersion: '0.19'
type: Index
apis:
- aid: tuf:tuf-spec
  name: TUF Repository Specification
  description: The TUF specification defines the structure of update repositories including the root, targets, snapshot, and
    timestamp metadata files. Each metadata file has a defined schema with signatures, expiration dates, and delegation rules.
    Clients follow a defined verification workflow to securely resolve and download updates while protecting against various
    attack vectors including key compromise, rollback attacks, freeze attacks, and mix-and-match attacks. The specification
    is version 1.0.31.
  humanURL: https://theupdateframework.github.io/specification/latest/
  properties:
  - type: Documentation
    url: https://theupdateframework.github.io/specification/latest/
  - type: GitHubRepository
    url: https://github.com/theupdateframework/specification
  - type: JSONSchema
    url: json-schema/tuf-root-metadata-schema.json
  - type: JSONSchema
    url: json-schema/tuf-targets-metadata-schema.json
  - type: JSONSchema
    url: json-schema/tuf-snapshot-metadata-schema.json
  - type: JSONSchema
    url: json-schema/tuf-timestamp-metadata-schema.json
  tags:
  - Metadata
  - Repository Metadata
  - Specification
  - Verification
- aid: tuf:python-tuf
  name: TUF Python Reference Implementation
  description: The official Python reference implementation of The Update Framework (TUF) specification. Provides a metadata
    API for reading and writing TUF metadata files, an ngclient API implementing the TUF client update workflow, and a repository
    library for building TUF-compliant software repositories. Available on PyPI as the 'tuf' package.
  humanURL: https://theupdateframework.readthedocs.io/en/stable/
  properties:
  - type: Documentation
    url: https://theupdateframework.readthedocs.io/en/stable/
  - type: GitHubRepository
    url: https://github.com/theupdateframework/python-tuf
  - type: PackageRegistry
    url: https://pypi.org/project/tuf/
  tags:
  - Client Library
  - Python
  - Security
  - Software Updates
  - Supply Chain
- aid: tuf:go-tuf
  name: TUF Go Implementation
  description: A Go implementation of The Update Framework (TUF), heavily influenced by python-tuf's design. Provides metadata,
    TrustedMetadata, and Updater packages implementing the TUF client workflow and specification-compliant metadata handling,
    as well as multi-repository support via TAP 4.
  humanURL: https://github.com/theupdateframework/go-tuf
  properties:
  - type: Documentation
    url: https://github.com/theupdateframework/go-tuf
  - type: GitHubRepository
    url: https://github.com/theupdateframework/go-tuf
  tags:
  - Client Library
  - Go
  - Security
  - Software Updates
  - Supply Chain
- aid: tuf:rust-tuf
  name: TUF Rust Implementation
  description: A Rust implementation of The Update Framework (TUF) specification providing a strongly-typed API for working
    with TUF metadata, verifying signatures, and implementing the TUF client update workflow.
  humanURL: https://github.com/theupdateframework/rust-tuf
  properties:
  - type: GitHubRepository
    url: https://github.com/theupdateframework/rust-tuf
  tags:
  - Client Library
  - Rust
  - Security
  - Software Updates
- aid: tuf:tuf-js
  name: TUF JavaScript Implementation
  description: A JavaScript/TypeScript implementation of The Update Framework (TUF) for use in Node.js environments and browser-based
    update systems. Enables TUF-compliant software update verification in the JavaScript ecosystem.
  humanURL: https://github.com/theupdateframework/tuf-js
  properties:
  - type: GitHubRepository
    url: https://github.com/theupdateframework/tuf-js
  tags:
  - Client Library
  - JavaScript
  - Security
  - Software Updates
  - TypeScript
- aid: tuf:tuf-on-ci
  name: TUF on CI
  description: A TUF repository management and signing tool designed for use in CI/CD pipelines. Enables teams to maintain
    a TUF repository using GitHub Actions and other CI systems for automated, policy-driven key management and metadata signing
    workflows.
  humanURL: https://github.com/theupdateframework/tuf-on-ci
  properties:
  - type: GitHubRepository
    url: https://github.com/theupdateframework/tuf-on-ci
  tags:
  - CI/CD
  - Key Management
  - Repository Management
  - Security
- aid: tuf:tuf-conformance
  name: TUF Conformance Test Suite
  description: The official TUF client conformance test suite for verifying that TUF client implementations correctly implement
    the TUF specification, including proper handling of all attack vectors and edge cases.
  humanURL: https://github.com/theupdateframework/tuf-conformance
  properties:
  - type: GitHubRepository
    url: https://github.com/theupdateframework/tuf-conformance
  tags:
  - Compliance
  - Conformance Testing
  - Security
  - Testing
common:
- type: DomainSecurity
  url: security/tuf-domain-security.yml
- type: Website
  url: https://theupdateframework.io/
- type: Documentation
  url: https://theupdateframework.io/docs/
- type: GettingStarted
  url: https://theupdateframework.io/docs/getting-started/
- type: GitHubOrganization
  url: https://github.com/theupdateframework
- type: GitHubRepository
  url: https://github.com/theupdateframework/python-tuf
- type: Specification
  url: https://theupdateframework.github.io/specification/latest/
- type: Blog
  url: https://theupdateframework.io/resources/news/
- type: CNCF
  url: https://www.cncf.io/projects/the-update-framework-tuf/
- type: Community
  url: https://github.com/theupdateframework/community
- type: JSONLD
  url: json-ld/tuf-context.jsonld
- type: JSONSchema
  url: json-schema/tuf-root-metadata-schema.json
- type: JSONSchema
  url: json-schema/tuf-targets-metadata-schema.json
- type: JSONSchema
  url: json-schema/tuf-snapshot-metadata-schema.json
- type: JSONSchema
  url: json-schema/tuf-timestamp-metadata-schema.json
- type: Vocabulary
  url: vocabulary/tuf-vocabulary.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com