curl -X POST 'https://api.github.com/orgs/example-org/artifacts/metadata/deployment-record' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "libfoo",
  "digest": "example-digest",
  "status": "deployed",
  "logical_environment": "example-logical-environment",
  "deployment_name": "example-deployment-name"
}'

# POST /orgs/{org}/artifacts/metadata/deployment-record (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Create an artifact deployment record

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/orgs/example-org/artifacts/metadata/deployment-record' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "libfoo",
  "digest": "example-digest",
  "status": "deployed",
  "logical_environment": "example-logical-environment",
  "deployment_name": "example-deployment-name"
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| org | path | string | Yes | The organization name. The name is not case sensitive. |
| name | body | string | Yes | The name of the artifact. |
| digest | body | string | Yes | The hex encoded digest of the artifact. |
| status | body | string | Yes | The status of the artifact. Can be either deployed or decommissioned. |
| logical_environment | body | string | Yes | The stage of the deployment. |
| deployment_name | body | string | Yes | The unique identifier for the deployment represented by the new record. To ac... |
| version | body | string | No | The artifact version. |
| physical_environment | body | string | No | The physical region of the deployment. |
Other params: cluster, tags, runtime_risks, github_repository, return_records

## Response example
{"total_count":0,"deployment_records":[{}]}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /orgs/{org}/artifacts/metadata/deployment-record — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Create an artifact deployment record

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 357 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/orgs/example-org/artifacts/metadata/deployment-record' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "name": "libfoo",  "digest": "example-digest",  "status": "deployed",  "logical_environment": "example-logical-environment",  "deployment_name": "example-deployment-name"}'

Parameters

Name	In	Type	Required	Description
org	path	string	Yes	The organization name. The name is not case sensitive.
name	body	string	Yes	The name of the artifact.
digest	body	string	Yes	The hex encoded digest of the artifact.
version	body	string	No	The artifact version.
status	body	string	Yes	The status of the artifact. Can be either deployed or decommissioned.
logical_environment	body	string	Yes	The stage of the deployment.
physical_environment	body	string	No	The physical region of the deployment.
cluster	body	string	No	The deployment cluster.
deployment_name	body	string	Yes	The unique identifier for the deployment represented by the new record. To accommodate differing containers and namespaces within a cluster, the following format is recommended: {namespaceName}-{deploymentName}-{containerName}.
tags	body	object	No	The tags associated with the deployment.
runtime_risks	body	string[]	No	A list of runtime risks associated with the deployment.
github_repository	body	string	No	The name of the GitHub repository associated with the artifact. This should be used when there are no provenance attestations available for the artifact. The repository must belong to the organization specified in the path parameter. If a provenance attestation is available for the artifact, the API will use the repository information from the attestation instead of this parameter.
return_records	body	boolean	No	If true, the endpoint will return the created or updated record in the response body.

Response 200 OK

{
  "total_count": 0,
  "deployment_records": [
    {
      "id": 0,
      "digest": "string",
      "logical_environment": "string",
      "physical_environment": "string",
      "cluster": "string",
      "deployment_name": "string",
      "tags": {},
      "runtime_risks": [
        "critical-resource"
      ],
      "created_at": "string",
      "updated_at": "string",
      "attestation_id": 0
    }
  ]
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.