---
title: "List attestations by bulk subject digests"
method: POST
path: "/users/{username}/attestations/bulk-list"
tags: ["users"]
---

# List attestations by bulk subject digests

`POST /users/{username}/attestations/bulk-list`

List a collection of artifact attestations associated with any entry in a list of subject digests owned by a user.

The collection of attestations returned by this endpoint is filtered according to the authenticated user's permissions; if the authenticated user cannot read a repository, the attestations associated with that repository will not be included in the response. In addition, when using a fine-grained access token the `attestations:read` permission is required.

**Please note:** in order to offer meaningful security benefits, an attestation's signature and timestamps **must** be cryptographically verified, and the identity of the attestation signer **must** be validated. Attestations can be verified using the [GitHub CLI `attestation verify` command](https://cli.github.com/manual/gh_attestation_verify). For more information, see [our guide on how to use artifact attestations to establish a build's provenance](https://docs.github.com/enterprise-cloud@latest/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).

## Path parameters

- `username` string, required

## Query parameters

- `per_page` integer
- `before` string
- `after` string

## Request body

- object
  - `subject_digests` string[], required — List of subject digests to fetch attestations for.
  - `predicate_type` string — Optional filter for fetching attestations with a given predicate type. This option accepts `provenance`, `sbom`, `release`, or freeform text for custom predicate types.

## Response `200`

Response

- object
  - `attestations_subject_digests` object — Mapping of subject digest to bundles.
  - `page_info` object — Information about the current page.
    - `has_next` boolean — Indicates whether there is a next page.
    - `has_previous` boolean — Indicates whether there is a previous page.
    - `next` string — The cursor to the next page.
    - `previous` string — The cursor to the previous page.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-3.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-3/versions/dc0584ac4e13/schema)