Social Fetch
Start for freeStart free
npm hub

npm Provenance API

The attestations behind one version, decoded from their sigstore bundles into the repository, workflow, commit and builder that produced it.

GET /v1/npm/package/provenance

1 credit Failed requests are free

Try in playgroundFull API docs

About this endpoint

GET /v1/npm/package/provenance?name=express&version=5.3.0 returns data.attestations, each with kind (publish, slsa-provenance or unknown), predicateType, subject (purl, sha512), source (repositoryUrl, workflowPath, ref, commit, event, repositoryId, ownerId), builder, runUrl and transparencyLog (logIndex, integratedAt).

version accepts an exact version or a dist-tag; a dist-tag is resolved to the version it points to, and data.version is that resolved version. The bundle payload is decoded for those fields. Signatures are not verified, so treat the answer as provenance facts, not as a trust check you can skip. A version that does not exist returns lookupStatus: not_found; an existing version with no attestation is found with attestations: []. Add include=raw to also return each sigstore bundle under attestations[].raw.

npm Provenance API FAQ

Are the signatures verified?

No. The answer contains the attestation facts but signatures are not verified. Signature verification is a separate job for your own trust policy. include=raw gives you the bundle when you want to verify it yourself.

Which versions have provenance?

Only versions published through a supported trusted publisher, such as a CI workflow with an OIDC identity. Older versions and locally published versions usually have none and return found with an empty attestations list. Check package.versions[].hasProvenance on GET /v1/npm/package/details to find candidates.

What is the difference between publish and slsa-provenance?

publish is npm's own attestation that records the publishing identity. slsa-provenance describes the build: repository, workflow, ref, commit, event and builder. A version can carry both, and each appears as its own entry in data.attestations.

How do I get the raw bundle?

Add include=raw. Each attestation then includes raw, the decoded sigstore bundle object. Without include=raw the answer stays small and carries only the mapped fields.

What does the request cost?

Pricing is documented on the operation in the API registry (shown on this page). Confirm on every response with meta.creditsCharged: that field is the billing source of truth.

Other npm endpoints