Get npm package provenance
Get the publish and SLSA provenance attestations attached to an npm version, decoded from their sigstore bundles.
Headers
Get your API keyAPI key (`sfk_...`)
npm package name, e.g. `express`, `lodash.merge`, `@types/node` or `--file--1`. Names are case-sensitive (`Express` is a different package) and keep legacy punctuation such as a leading `-`.
max 214 chars
Exact version or dist-tag. A dist-tag is resolved to the version it points to. Default: `latest`.
max 128 chars
`raw` also returns each sigstore bundle. Signatures are decoded, not verified.
one of: raw
Endpoint-specific response payload.
Whether the item exists. Every outcome is HTTP 200; branch on this field.
one of: found, not_found
Package name.
Version the answer is about. A dist-tag is replaced by the version it points to.
Attestations attached to the version. Empty when npm has none; signatures are decoded, not verified.
`publish` for npm's publish attestation, `slsa-provenance` for SLSA, `unknown` for a future predicate type.
one of: publish, slsa-provenance, unknown
The predicate type from the bundle.
What the attestation is about.
Package URL from the attestation subject.
SHA-512 digest in the subject.
Source and workflow facts decoded from SLSA provenance.
Source repository.
Workflow file path.
Git ref the build ran from.
Git commit the build resolved.
GitHub event that started the build.
GitHub repository id.
GitHub owner id.
Builder identity.
CI run URL.
The public transparency-log entry that recorded the attestation; null when there is none.
Rekor log index.
≥ 0
When the entry was integrated into the log.
The sigstore bundle, only with `include=raw`.
Metadata describing the request and billing outcome.
Unique request identifier for tracing this API call.
min 1 chars
Credits charged for this request.
≥ 0
Public API version that served the response.
one of: v1
Code example
curl "https://api.socialfetch.dev/v1/npm/package/provenance?name=express" \
-H "x-api-key: YOUR_API_KEY"Responses
npm provenance.