curl --request GET \
--url https://api.app.chainloop.dev/v1/artifacts \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.app.chainloop.dev/v1/artifacts"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.app.chainloop.dev/v1/artifacts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.app.chainloop.dev/v1/artifacts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.app.chainloop.dev/v1/artifacts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.app.chainloop.dev/v1/artifacts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.app.chainloop.dev/v1/artifacts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"pagination": {
"next_cursor": "next_cursor"
},
"results": [
{
"kind": "kind",
"name": "name",
"digest": "digest",
"created_at": "2000-01-23T04:56:07.000Z",
"id": "id",
"version": "version"
},
{
"kind": "kind",
"name": "name",
"digest": "digest",
"created_at": "2000-01-23T04:56:07.000Z",
"id": "id",
"version": "version"
}
]
}{
"code": 0,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 6,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 1,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 5,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 5,
"details": [
{
"@type": "@type"
},
{
"@type": "@type"
}
],
"message": "message"
}List artifacts
List artifacts stored in the organization, optionally filtered by project, product, kind, or search term.
curl --request GET \
--url https://api.app.chainloop.dev/v1/artifacts \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.app.chainloop.dev/v1/artifacts"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.app.chainloop.dev/v1/artifacts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.app.chainloop.dev/v1/artifacts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.app.chainloop.dev/v1/artifacts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.app.chainloop.dev/v1/artifacts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.app.chainloop.dev/v1/artifacts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"pagination": {
"next_cursor": "next_cursor"
},
"results": [
{
"kind": "kind",
"name": "name",
"digest": "digest",
"created_at": "2000-01-23T04:56:07.000Z",
"id": "id",
"version": "version"
},
{
"kind": "kind",
"name": "name",
"digest": "digest",
"created_at": "2000-01-23T04:56:07.000Z",
"id": "id",
"version": "version"
}
]
}{
"code": 0,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 6,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 1,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 5,
"details": [
"details",
"details"
],
"message": "message"
}{
"code": 5,
"details": [
{
"@type": "@type"
},
{
"@type": "@type"
}
],
"message": "message"
}Authorizations
Bearer token for authentication
Query Parameters
ProjectName is the name of the project to filter artifacts by
ProjectVersionName is the name of the project version to filter artifacts by
Kind is the type of artifact to filter by
The type of artifact to filter by (e.g., CONTAINER_IMAGE, HELM_CHART)
- CHAINLOOP_AI_AGENT_CONFIG: AI agent configuration collected automatically during attestation
- UNKNOWN_KIND: Artifact kind is unknown — created from SBOM metadata when no matching attested artifact exists
- CHAINLOOP_AI_CODING_SESSION: AI coding session evidence (e.g., Claude Code session traces)
- OPENAPI_SPEC: OpenAPI specification (v3.0, v3.1) https://spec.openapis.org/oas/latest.html
- ASYNCAPI_SPEC: AsyncAPI specification (v2.6, v3.0) https://www.asyncapi.com/docs/reference/specification/latest
- GRAPHQL_SPEC: GraphQL SDL schema https://spec.graphql.org/
- YELP_DETECT_SECRETS_BASELINE: detect-secrets baseline file https://github.com/Yelp/detect-secrets
- SYSINTERNALS_SIGCHECK: Sysinternals sigcheck output in CSV format https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck
- SYSINTERNALS_ACCESSCHK: Sysinternals AccessChk text output https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk
- CERTCC_DRANZER: CERT/CC dranzer ActiveX/COM control test report, a single report or an archive holding the per-mode reports of one run https://github.com/CERTCC/dranzer
- OSSF_SCORECARD_JSON: OpenSSF Scorecard result in JSON format https://github.com/ossf/scorecard
- RADAMSA_REPORT: radamsa -M metadata log, one record per generated iteration https://gitlab.com/akihe/radamsa
- RADAMSA_CRASHES: radamsa crashing inputs, a single file or a crashes/ archive
- TRUFFLEHOG_JSON: TruffleHog secret scanning report in JSONL format https://github.com/trufflesecurity/trufflehog
- COBERTURA_XML: Cobertura code coverage report in XML format https://github.com/cobertura/cobertura
- CHECKMARX_JSON: Checkmarx One native JSON report (ScanResultsCollection)
- OVERSECURED_JSON: Oversecured mobile (Android/iOS) scan report, whole-scan JSON export
- PITEST_XML: PIT mutation testing report in its native XML format (mutations.xml) https://pitest.org/
- CHAINLOOP_AI_SECURITY_CONTEXT: Chainloop AI security context: vulnerability fingerprints mined from a repository's fix history, the attack surfaces they share, ranked risks, and byte-verifiable evidence anchors backing each claim
MATERIAL_TYPE_UNSPECIFIED, STRING, CONTAINER_IMAGE, ARTIFACT, SBOM_CYCLONEDX_JSON, SBOM_SPDX_JSON, JUNIT_XML, OPENVEX, HELM_CHART, SARIF, EVIDENCE, ATTESTATION, CSAF_VEX, CSAF_INFORMATIONAL_ADVISORY, CSAF_SECURITY_ADVISORY, CSAF_SECURITY_INCIDENT_RESPONSE, GITLAB_SECURITY_REPORT, ZAP_DAST_ZIP, BLACKDUCK_SCA_JSON, TWISTCLI_SCAN_JSON, GHAS_CODE_SCAN, GHAS_SECRET_SCAN, GHAS_DEPENDENCY_SCAN, JACOCO_XML, SLSA_PROVENANCE, CHAINLOOP_RUNNER_CONTEXT, CHAINLOOP_PR_INFO, GITLEAKS_JSON, CHAINLOOP_AI_AGENT_CONFIG, UNKNOWN_KIND, CHAINLOOP_AI_CODING_SESSION, OPENAPI_SPEC, ASYNCAPI_SPEC, GRAPHQL_SPEC, YELP_DETECT_SECRETS_BASELINE, SYSINTERNALS_SIGCHECK, SYSINTERNALS_ACCESSCHK, CERTCC_DRANZER, OSSF_SCORECARD_JSON, RADAMSA_REPORT, RADAMSA_CRASHES, TRUFFLEHOG_JSON, COBERTURA_XML, CHECKMARX_JSON, OVERSECURED_JSON, PITEST_XML, CHAINLOOP_AI_SECURITY_CONTEXT The cursor to start pagination from
The cursor to start pagination from
The limit of the number of entries to return
The maximum number of entries to return
Search provides a way to search artifacts by name, version, or digest
Search term to filter artifacts by name, version, or digest
ProductID is the ID of the product to filter artifacts by
ID of the product to filter artifacts by
ProductVersionID is the ID of the product version to filter artifacts by
ID of the product version to filter artifacts by. Must be provided with product_id
Filter by presence of actionable vulnerability findings, i.e. OPEN or IN_PROGRESS (true = has vulnerabilities, false = no vulnerabilities, unset = no filter). Findings resolved via assessment are excluded.
