---
title: "Get attestation statements for an image"
method: GET
path: "/images/{name}/attestations"
tags: ["Image"]
---

# Get attestation statements for an image

`GET /images/{name}/attestations`

Return the in-toto attestation statements attached to the image for the
given platform. The daemon locates the attestation manifest(s) that
reference the matching platform image manifest, reads their statement
layers, and returns the verbatim statement JSON together with layer
metadata.

If the image has no attestations an empty array is returned.

## Path parameters

- `name` string, required

## Query parameters

- `platform` string[]
- `type` string[]
- `statement` boolean

## Response `200`

No error

- AttestationStatement[]
  - `Descriptor` OCIDescriptor, required — A descriptor struct containing digest, media type, and size, as defined in the [OCI Content Descriptors Specification](https://github.com/opencontainers/image-spec/blob/v1.0.1/descriptor.md).
    - `mediaType` string — The media type of the object this schema refers to.
    - `digest` string — The digest of the targeted content.
    - `size` integer — The size in bytes of the blob.
    - `urls` string[], nullable — List of URLs from which this object MAY be downloaded.
    - `annotations` object, nullable — Arbitrary metadata relating to the targeted content.
    - `data` string, nullable — Data is an embedding of the targeted content. This is encoded as a base64 string when marshalled to JSON (automatically, by encoding/json). If present, Data can be used directly to avoid fetching the targeted content.
    - `platform` OCIPlatform, nullable — Describes the platform which the image in the manifest runs on, as defined in the [OCI Image Index Specification](https://github.com/opencontainers/image-spec/blob/v1.0.1/image-index.md).
      - `architecture` string — The CPU architecture, for example `amd64` or `ppc64`.
      - `os` string — The operating system, for example `linux` or `windows`.
      - `os.version` string — Optional field specifying the operating system version, for example on Windows `10.0.19041.1165`.
      - `os.features` string[] — Optional field specifying an array of strings, each listing a required OS feature (for example on Windows `win32k`).
      - `variant` string — Optional field specifying a variant of the CPU, for example `v7` to specify ARMv7 when architecture is `arm`.
    - `artifactType` string, nullable — ArtifactType is the IANA media type of this artifact.
  - `PredicateType` string, required — The in-toto predicate type URI of this statement.
  - `Statement` object, nullable — The verbatim in-toto statement JSON. Only included when the caller opts in via the `statement=true` query parameter; otherwise absent.

## Other responses

- `400` — Bad parameter (e.g. malformed `platform` value)
- `404` — No such image, or no manifest found for the requested platform
- `500` — Server error
- `501` — The daemon's image backend does not support attestations. This is returned by the legacy (graphdriver) image store, which does not preserve OCI image indexes.

---

[API](https://skmtc.net/moby/apis/docker-engine-api.md) · [All operations](https://skmtc.net/moby/apis/docker-engine-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/moby/docker-engine-api/versions/4752769870da/schema)