Add Evidence Document to Application

For a framework control (the rules associated with that control) to be enforced in JFrog AppTrust, valid evidence with the correct document must be attached to the application. For each application, you must create and add the evidence, including a document attachment, to the application using either an API request or a CLI command. This document shows an example API request and CLI command to do this.

Each type of document required by a control requires a different predicate type to be used in the API and CLI command. This document also provides a table for you to map the document type to the correct predicate type.

Example API Request

This is an example of the API request and JSON body for the evidence with predicate type:

https://jfrog.com/evidence/compliance/sdlc-policy-document

The evidence is attached to the application with the application key:

bb-01-app-001

The content of the SDLC policy document is added as an attachment. This builds the DSSE payload and the pre-authentication encoding (PAE) you must sign. The request is as follows:

POST /evidence/api/v1/evidence/prepare?include_pae=true

The following is the body for valid evidence on bb-01-app-001:

{
  "predicate": {
    "start-date": "2026-01-01",
    "expiry-date": "2026-12-31"
  },
  "predicate_type": "https://jfrog.com/evidence/compliance/sdlc-policy-document",
  "subject": {
    "subject_type": "entity",
    "entity_type": "application",
    "entity_id": "bb-01-app-001"
  },
  "application_key": "bb-01-app-001",
  "attachments": [
    {
      "repository": "bb-01-app-001-application-entity",
      "path": "tmp/sdlc-policy.md"
    }
  ]
}

Example CLI Command

This is an example of a CLI command that creates and attaches evidence to the application with application key:

bb-01-app-001

The predicate type is: https://jfrog.com/evidence/compliance/sdlc-policy-document

The SDLC Policy document is included as an attachment.

jf evd create 
--application-key app1 
--key ./evidence.key 
--predicate ./predicate.json 
--predicate-type 'https://jfrog.com/evidence/compliance/sdlc-policy-document' 
--key-alias 'evd-key-20260901-181554'
--attach-local ./sdlc-policy.md \
--attach-artifactory-temp-path bb-01-app-001-application-entity/tmp/

Document Type to Predicate Type Mapping

In AppTrust, each control in a framework is mapped to one or more rules which are checked and enforced. Each rule requires a specific document type as evidence attached to the application. The table below is provided to help you attach the correct document type.

This table provides the mapping of document type to predicate type. Depending on the document type required for the rule you use in AppTrust, use the corresponding predicate type in the API or CLI command. For example, if the rule name is SDLC Policy Document, then use the following Predicate Type in the API or CLI:

https://jfrog.com/evidence/compliance/sdlc-policy-document/v1