curl -X GET 'https://api.github.com/users/example-username/attestations/example-subject-digest?per_page=30&before=example-before&after=example-after&predicate_type=example-predicate-type' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10'

# GET /users/{username}/attestations/{subject_digest} (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Last verified: 2026-10-20

> List attestations

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X GET 'https://api.github.com/users/example-username/attestations/example-subject-digest?per_page=30&before=example-before&after=example-after&predicate_type=example-predicate-type' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| username | path | string | Yes | The handle for the GitHub user account. |
| subject_digest | path | string | Yes | Subject Digest |
| per_page | query | integer | No | The number of results per page (max 100). For more information, see "[Using p... |
| before | query | string | No | A cursor, as given in the [Link header](https://docs.github.com/rest/guides/u... |
| after | query | string | No | A cursor, as given in the [Link header](https://docs.github.com/rest/guides/u... |
| predicate_type | query | string | No | Optional filter for fetching attestations with a given predicate type. This o... |

## Response example
{"attestations":[{"repository_id":0,"bundle_url":"string","initiator":"string"}]}

---
Need an API key? Get one at https://github.com/settings/tokens

GET

GET /users/{username}/attestations/{subject_digest} — GitHub API

GitHub token (required); https://api.github.com

GitHub API

List attestations

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 280 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X GET 'https://api.github.com/users/example-username/attestations/example-subject-digest?per_page=30&before=example-before&after=example-after&predicate_type=example-predicate-type' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10'

Parameters

Name	In	Type	Required	Description
per_page	query	integer	No	The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
before	query	string	No	A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results before this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
after	query	string	No	A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results after this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
username	path	string	Yes	The handle for the GitHub user account.
subject_digest	path	string	Yes	Subject Digest
predicate_type	query	string	No	Optional filter for fetching attestations with a given predicate type. This option accepts `provenance`, `sbom`, `release`, or freeform text for custom predicate types.

Response 200 OK

{
  "attestations": [
    {
      "repository_id": 0,
      "bundle_url": "string",
      "initiator": "string"
    }
  ]
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.