---
title: "List attestations"
method: GET
path: "/users/{username}/attestations/{subject_digest}"
tags: ["users"]
---

# List attestations

`GET /users/{username}/attestations/{subject_digest}`

List a collection of artifact attestations with a given subject digest that are associated with repositories owned by a user.

The collection of attestations returned by this endpoint is filtered according to the authenticated user's permissions; if the authenticated user cannot read a repository, the attestations associated with that repository will not be included in the response. In addition, when using a fine-grained access token the `attestations:read` permission is required.

**Please note:** in order to offer meaningful security benefits, an attestation's signature and timestamps **must** be cryptographically verified, and the identity of the attestation signer **must** be validated. Attestations can be verified using the [GitHub CLI `attestation verify` command](https://cli.github.com/manual/gh_attestation_verify). For more information, see [our guide on how to use artifact attestations to establish a build's provenance](https://docs.github.com/enterprise-cloud@latest/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).

## Path parameters

- `username` string, required
- `subject_digest` string, required

## Query parameters

- `per_page` integer
- `before` string
- `after` string
- `predicate_type` string

## Response `200`

Response

- object
  - `attestations` object[]
    - `bundle` object — The attestation's Sigstore Bundle. Refer to the [Sigstore Bundle Specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto) for more information.
      - `mediaType` string
      - `verificationMaterial` object
      - `dsseEnvelope` object
    - `repository_id` integer
    - `bundle_url` string
    - `initiator` string

## Other responses

- `201` — Response
- `204` — Response
- `404` — Resource not found

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-3.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-3/versions/dc0584ac4e13/schema)