---
title: "List attestations"
method: GET
path: "/repos/{owner}/{repo}/attestations/{subject_digest}"
tags: ["repos"]
---

# List attestations

`GET /repos/{owner}/{repo}/attestations/{subject_digest}`

List a collection of artifact attestations with a given subject digest that are associated with a repository.

The authenticated user making the request must have read access to the repository. In addition, when using a fine-grained access token the `attestations:read` permission is required.

**Please note:** in order to offer meaningful security benefits, an attestation's signature and timestamps **must** be cryptographically verified, and the identity of the attestation signer **must** be validated. Attestations can be verified using the [GitHub CLI `attestation verify` command](https://cli.github.com/manual/gh_attestation_verify). For more information, see [our guide on how to use artifact attestations to establish a build's provenance](https://docs.github.com/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).

## Path parameters

- `owner` string, required
- `repo` string, required
- `subject_digest` string, required

## Query parameters

- `per_page` integer
- `before` string
- `after` string
- `predicate_type` string

## Response `200`

Response

- object
  - `attestations` object[]
    - `bundle` object — The attestation's Sigstore Bundle. Refer to the [Sigstore Bundle Specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto) for more information.
      - `mediaType` string
      - `verificationMaterial` object
      - `dsseEnvelope` object
    - `repository_id` integer
    - `bundle_url` string
    - `initiator` string

---

[API](https://skmtc.net/github/apis/github-v3-rest-api.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api/versions/a367f7028301/schema)