Subject repository path (e.g., commons-dev-generic-local/commons/1.0.0/file.txt)

Evidence provider identifier

Base64-encoded serialized in-toto Statement. Decoded shape for an
artifact subject:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "example-binary",
      "digest": { "sha256": "4529c29..." }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v0.2",
  "predicate": { "...": "..." },
  "createdAt": "2026-02-09T11:45:00Z",
  "createdBy": "github-actions-bot",
  "markdown": "### Build Success\nThe binary was compiled using Go 1.22.",
  "attachments": [
    { "name": "build-log.txt", "sha256": "e3b0c44..." }
  ]
}

For an non-artifact entity (POST /entity/{type}/{id} with a non-reserved
type), the subject digest key must be the entity type (for example
gitCommit) rather than sha256:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "57bb812f3733b80e270272ba063274e52c34bd23",
      "digest": { "gitCommit": "57bb812f3733b80e270272ba063274e52c34bd23" }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v0.2",
  "predicate": { "...": "..." },
  "createdAt": "2026-02-09T11:45:00Z",
  "createdBy": "github-actions-bot"
}

For artifact-backed reserved entity types (artifact, package-version,
application-version, release-bundle-version, build-version), the subject
digest is { "sha256": "<lead-file-checksum>" } — the same as evidence created
on the resolved lead artifact via the subject API.

The attachments field inside the Statement is optional and is part
of the signed payload (the signer commits to exactly that set).

Media type of the DSSE payload (must be application/vnd.in-toto+json).

The same endpoint also accepts two other body shapes (auto-detected by
the service - do not send a DSSE envelope if you use these):

• Sigstore Bundle - top-level mediaType with prefix
  application/vnd.dev.sigstore.bundle (e.g.
  application/vnd.dev.sigstore.bundle.v0.3+json); the bundle embeds
  its own DSSE envelope.
• OCI Evidence Bundle - top-level type: "oci.bundle"; the bundle
  embeds a DSSE envelope plus a public key.