> **For coding agents and LLMs:** This is one Social Fetch marketing page (markdown export). For API orientation start with [`/llms.txt`](https://www.socialfetch.dev/llms.txt); for auth and crawl rules use [`/agents.txt`](https://www.socialfetch.dev/agents.txt); for every operation use [`/llms-endpoints.txt`](https://www.socialfetch.dev/llms-endpoints.txt).

## This page

- **On-site (HTML):** <https://www.socialfetch.dev/platforms/npm/package-provenance>
- **Markdown (.mdx) URL:** <https://www.socialfetch.dev/platforms/npm/package-provenance.mdx>

---

# npm Provenance API

The attestations behind one version, decoded from their sigstore bundles into the repository, workflow, commit and builder that produced it.

`GET /v1/npm/package/provenance?name=express&version=5.3.0` returns `data.attestations`, each with `kind` (`publish`, `slsa-provenance` or `unknown`), `predicateType`, `subject` (`purl`, `sha512`), `source` (`repositoryUrl`, `workflowPath`, `ref`, `commit`, `event`, `repositoryId`, `ownerId`), `builder`, `runUrl` and `transparencyLog` (`logIndex`, `integratedAt`).

`version` accepts an exact version or a dist-tag; a dist-tag is resolved to the version it points to, and `data.version` is that resolved version. The bundle payload is decoded for those fields. Signatures are not verified, so treat the answer as provenance facts, not as a trust check you can skip. A version that does not exist returns `lookupStatus: not_found`; an existing version with no attestation is `found` with `attestations: []`. Add `include=raw` to also return each sigstore bundle under `attestations[].raw`.

## Request

- **Endpoint:** `GET /v1/npm/package/provenance`
- **Credits:** 1 credit
Failed requests are free
- **Input:** by package name and version
- **Full reference:** [docs](https://www.socialfetch.dev/docs/api/v1/npm/package/provenance/get)
- **Platform page:** [/platforms/npm](https://www.socialfetch.dev/platforms/npm)

## FAQ

### Are the signatures verified?

No. The answer contains the attestation facts but signatures are not verified. Signature verification is a separate job for your own trust policy. include=raw gives you the bundle when you want to verify it yourself.

### Which versions have provenance?

Only versions published through a supported trusted publisher, such as a CI workflow with an OIDC identity. Older versions and locally published versions usually have none and return found with an empty attestations list. Check package.versions[].hasProvenance on GET /v1/npm/package/details to find candidates.

### What is the difference between publish and slsa-provenance?

publish is npm's own attestation that records the publishing identity. slsa-provenance describes the build: repository, workflow, ref, commit, event and builder. A version can carry both, and each appears as its own entry in data.attestations.

### How do I get the raw bundle?

Add include=raw. Each attestation then includes raw, the decoded sigstore bundle object. Without include=raw the answer stays small and carries only the mapped fields.

### What does the request cost?

Pricing is documented on the operation in the API registry (shown on this page). Confirm on every response with meta.creditsCharged: that field is the billing source of truth.