Attestor API Reference

Operations

GET /anchors

Responses:

POST /anchors

Responses:

GET /anchors/{anchorId}

Parameters:

Responses:

DELETE /anchors/{anchorId}

Parameters:

Responses:

PATCH /anchors/{anchorId}

Parameters:

Responses:

POST /anchors/{anchorId}/revoke-key

Parameters:

Responses:

GET /api/v1/attestations

Lists attestation entries from the repository with optional filters. Returns a paginated result with continuation token for incremental sync. Requires attestor:read scope.

Responses:

GET /api/v1/attestations/{uuid}

Retrieves an attestation entry by UUID, including inclusion proof, checkpoint, artifact metadata, and optional mirror status. Equivalent to the Rekor entry endpoint but accessed by attestor UUID alias. Requires attestor:read scope.

Parameters:

Responses:

POST /api/v1/attestations:export

Exports attestations as a portable bundle package with optional filters by artifact digest, date range, and predicate type. Used for offline transfer and air-gap synchronization. Requires attestor:read scope.

Responses:

POST /api/v1/attestations:export-build

Exports the supported build type/ID, invocation, configuration-source, environment, parameter, and timestamp fields as an unsigned SPDX 3.0.1 Build Profile document. The supported request is format=Spdx3 with sign=false. DSSE/signing, Both, builder, and material requests fail closed with 501 feature_not_implemented rather than returning an incomplete document. The authorization policy name is attestor:write; the required canonical scope claim is attest:create.

Responses:

POST /api/v1/attestations:import

Imports a portable attestation bundle package into the attestor store. All entries within the bundle are validated before persistence. Returns a summary of imported and skipped entries. Requires attestor:write scope.

Responses:

POST /api/v1/attestations:sign

Signs an attestation payload using the configured key and DSSE envelope format. Requires an authenticated principal or configured StellaOps service-to-service bypass. Returns the signed bundle with key metadata and optional Rekor submission details. Requires attestor:write scope.

Responses:

POST /api/v1/attestor/links

Creates and signs an in-toto link metadata object for a named step, including materials, products, command, environment, and return value. Returns the signed DSSE envelope with optional Rekor entry. Requires attestor:write scope.

Responses:

GET /api/v1/attestor/predicates

List all registered predicate types

Returns a paginated list of registered in-toto predicate type schemas from the registry, with optional filters by category and active status. Used to discover supported predicate URIs for attestation creation.

Parameters:

Responses:

GET /api/v1/attestor/predicates/{uri}

Get predicate type schema by URI

Retrieves the full schema definition for a predicate type identified by its URI. The URI must be URL-encoded when passed as a path segment. Returns 404 if the predicate type is not registered.

Parameters:

Responses:

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

GET /api/v1/bundles

Parameters:

Responses:

POST /api/v1/bundles

Responses:

GET /api/v1/bundles/{bundleId}

Parameters:

Responses:

GET /api/v1/bundles/{bundleId}/attestations/{entryId}

Parameters:

Responses:

POST /api/v1/bundles/{bundleId}/verify

Parameters:

Responses:

Runtime status (2026-07-17): The five /api/v1/chains/* shapes below belong to the excluded ChainController prototype. They are not registered in the production host and therefore return 404. The response tables document the prototype contract, not a live API.

Prototype: GET /api/v1/chains/artifact/{artifactDigest}

Parameters:

Responses:

Prototype: GET /api/v1/chains/{attestationId}

Parameters:

Responses:

Prototype: GET /api/v1/chains/{attestationId}/downstream

Parameters:

Responses:

Prototype: GET /api/v1/chains/{attestationId}/graph

Parameters:

Responses:

Prototype: GET /api/v1/chains/{attestationId}/upstream

Parameters:

Responses:

Runtime status (2026-07-20): The four /api/v1/proofs/* shapes below are active. Non-testing runtime uses an Attestor-owned tenant-partitioned PostgreSQL projection; authenticated tenant context is mandatory. The chain route returns deterministic ProofChainResponse JSON or RFC 7807 404 with title No proof chain found. for an honest empty subject. Subject routes require a strict 64-hex SHA-256 digest.

GET /api/v1/proofs/id/{proofId}

Parameters:

Responses:

GET /api/v1/proofs/id/{proofId}/verify

Parameters:

Responses:

GET /api/v1/proofs/{subjectDigest}

Parameters:

Responses:

GET /api/v1/proofs/{subjectDigest}/chain

Parameters:

Responses:

POST /api/v1/rekor/entries

Submits an attestation entry to the configured transparency log. Requires an authenticated principal or configured StellaOps service-to-service bypass. Returns the entry details including UUID, log index, and inclusion proof. Requires attestor:write scope.

Responses:

Tenant requirement (internal / bypass submissions) — SPRINT_20260721_004. Every submission MUST resolve to a tenant; the Attestor hard-rejects a tenantless submission with 400 ProblemDetails code = "tenant_required" (no silent default tenant is ever injected). The tenant is resolved as: the caller’s tenant claim (authenticated principals) or, for an internal tokenless bypass submission (authorized via Authority:ResourceServer:BypassNetworks, no bearer token, hence an anonymous principal), the caller-supplied X-StellaOps-TenantIdheader. The header is honored only for anonymous bypass callers — for an authenticated principal the tenant always comes from its claim and the header is ignored, so it cannot be used to spoof a tenant. Internal producers (Scanner scan-result, Findings.Ledger VEX-override, ReleaseOrchestrator deployment, Excititor VEX-observation) send this header; if it is absent the submission 400s and the caller degrades the evidence to self-signed/unsigned rather than anchoring.

GET /api/v1/rekor/entries/{uuid}

Retrieves a Rekor transparency log entry by UUID, including inclusion proof, checkpoint, and artifact metadata. Set refresh=true to bypass cache and fetch the latest state from Rekor. Requires attestor:read scope.

Parameters:

Responses:

POST /api/v1/rekor/verify

Verifies an attestation against the Rekor transparency log, checking inclusion proof, checkpoint consistency, and signature validity. Returns a structured verification result with per-check diagnostics. Requires attestor:verify scope.

Responses:

POST /api/v1/rekor/verify:bulk

Enqueues a bulk attestation verification job for processing multiple entries asynchronously. Returns 202 Accepted with the job ID and a polling URL. Queue depth is enforced by quota configuration. Requires attestor:write scope.

Responses:

GET /api/v1/rekor/verify:bulk/{jobId}

Returns the current status and results of a bulk attestation verification job by job ID. The job is only visible to the principal that submitted it. Returns 404 for unknown or unauthorized job IDs. Requires attestor:write scope.

Parameters:

Responses:

GET /api/v1/transparency/exchange/batches

Lists manual schedule/import and connected-sync batch status metadata without returning package bytes. Requires attestor:read scope.

Parameters:

Responses:

GET /api/v1/transparency/exchange/batches/{batchId}

Gets manual schedule/import or connected-sync batch status metadata by batch id. Requires attestor:read scope.

Parameters:

Responses:

POST /api/v1/transparency/exchange/imports:apply

Validates and applies a returned external transparency import file, attaching mirror receipts only to matching local entries. Requires attestor:write scope.

Responses:

POST /api/v1/transparency/exchange/imports:validate

Validates a returned external transparency import file before sealed-site apply. Requires attestor:write scope.

Responses:

POST /api/v1/transparency/exchange/relay-imports

Validates a schedule file and produces a deterministic signed import file containing external mirror receipts. Requires attestor:write scope.

Responses:

POST /api/v1/transparency/exchange/schedules

Creates a deterministic manual schedule file for sealed-site external transparency mirror exchange. Requires attestor:write scope.

Responses:

GET /api/v1/transparency/external-sync/reports

Lists connected-window external transparency sync reports for CLI/UI readback. Requires attestor:read scope.

Parameters:

Responses:

GET /api/v1/transparency/external-sync/reports/{batchId}

Gets one connected-window external transparency sync report by batch id. Requires attestor:read scope.

Parameters:

Responses:

POST /api/v1/transparency/external-sync:run

Runs a bounded connected-window sync from Stella local transparency receipts to configured external Rekor-compatible mirror targets. The worker remains separately disabled unless explicitly enabled. Requires attestor:write scope.

Responses:

GET /api/v1/transparency/targets

Lists operator-approved external transparency mirror targets with per-target status. Requires attestor:read scope.

Parameters:

Responses:

POST /api/v1/transparency/targets

Creates or updates an operator-approved external transparency target. The API stores only endpoint metadata and secret references, never raw credentials. Requires attestor:write scope.

Responses:

GET /api/v1/transparency/targets/{targetId}

Gets one external transparency mirror target with status counters and last error metadata. Requires attestor:read scope.

Parameters:

Responses:

POST /api/v1/transparency/targets/{targetId}:disable

Disables an existing external transparency target. Existing local transparency receipts remain authoritative. Requires attestor:write scope.

Parameters:

Responses:

POST /api/v1/transparency/targets/{targetId}:enable

Enables an existing external transparency target for connected sync or manual exchange selection. Requires attestor:write scope.

Parameters:

Responses:

GET /api/v1/verdicts/{verdictId}

Parameters:

Responses:

GET /api/v1/watchlist

List watchlist entries

Returns all watchlist entries for the tenant, optionally including global entries.

Parameters:

Responses:

POST /api/v1/watchlist

Create watchlist entry

Creates a new watchlist entry for monitoring identity appearances.

Responses:

GET /api/v1/watchlist/alerts

List recent alerts

Returns recent alerts generated by watchlist matches.

Parameters:

Responses:

GET /api/v1/watchlist/{id}

Get watchlist entry

Returns a single watchlist entry by ID.

Parameters:

Responses:

PUT /api/v1/watchlist/{id}

Update watchlist entry

Updates an existing watchlist entry.

Parameters:

Responses:

DELETE /api/v1/watchlist/{id}

Delete watchlist entry

Deletes a watchlist entry.

Parameters:

Responses:

POST /api/v1/watchlist/{id}/test

Test watchlist pattern

Tests if a sample identity matches the watchlist entry pattern.

Parameters:

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

POST /internal/api/v1/attestations/verdict

Responses:

POST /internal/api/v1/exceptions/recheck-status

Responses:

POST /internal/api/v1/exceptions/renew

Responses:

POST /internal/api/v1/exceptions/sign

Responses:

POST /internal/api/v1/exceptions/verify

Responses:

Runtime status (2026-07-17): The bare /proofs/{entry}/* routes are retained as fail-closed retirement diagnostics. Valid authorized requests return 501 application/problem+json with code=feature_not_implemented; malformed mutations can return 400, and missing write authority returns 403. The historical success rows below are not implemented.

GET /proofs/{entry}/receipt

Parameters:

Responses:

GET /proofs/{entry}/spine

Parameters:

Responses:

POST /proofs/{entry}/spine

Parameters:

Responses:

GET /proofs/{entry}/vex

Parameters:

Responses:

GET /verify/envelope/{envelopeHash}

Parameters:

Responses:

GET /verify/rekor/{envelopeHash}

Parameters:

Responses:

POST /verify/{proofBundleId}

Parameters:

Responses: