---
title: "Create an attestation"
method: POST
path: "/repos/{owner}/{repo}/attestations"
tags: ["repos"]
---

# Create an attestation

`POST /repos/{owner}/{repo}/attestations`

Store an artifact attestation and associate it with a repository.

The authenticated user must have write permission to the repository and, if using a fine-grained access token, the `attestations:write` permission is required.

Artifact attestations are meant to be created using the [attest action](https://github.com/actions/attest). For more information, see our guide on [using artifact attestations to establish a build's provenance](https://docs.github.com/enterprise-cloud@latest/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).

## Path parameters

- `owner` string, required
- `repo` string, required

## Request body

- object
  - `bundle` object, required — The attestation's Sigstore Bundle. Refer to the [Sigstore Bundle Specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto) for more information.
    - `mediaType` string
    - `verificationMaterial` object
    - `dsseEnvelope` object

## Response `201`

response

- object
  - `id` integer — The ID of the attestation.

## Other responses

- `403` — Forbidden
- `422` — Validation failed, or the endpoint has been spammed.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-2.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-2/versions/8ae6d0c8716e/schema)