Entity type (e.g., gitCommit, languageModel). Allowed characters -_.A-Za-z0-9.

Entity identifier (e.g., git commit SHA). Allowed characters -_.A-Za-z0-9.

Explicit Artifactory repository key. Mutually exclusive with project and application.

Optional project key used to derive {project}-{type}-entity.

Optional application key used to derive {application}-{type}-entity.

Evidence provider identifier

Base64-encoded serialized in-toto Statement. Decoded shape:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "example-binary",
      "digest": { "sha256": "4529c29..." }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v0.2",
  "predicate": { "...": "..." },
  "createdAt": "2026-02-09T11:45:00Z",
  "createdBy": "github-actions-bot",
  "markdown": "### Build Success\nThe binary was compiled using Go 1.22.",
  "attachments": [
    { "name": "build-log.txt", "sha256": "e3b0c44..." }
  ]
}

The attachments field inside the Statement is optional and is part
of the signed payload (the signer commits to exactly that set).

Media type of the DSSE payload (must be application/vnd.in-toto+json).

The same endpoint also accepts two other body shapes (auto-detected by
the service - do not send a DSSE envelope if you use these):

• Sigstore Bundle - top-level mediaType with prefix
  application/vnd.dev.sigstore.bundle (e.g.
  application/vnd.dev.sigstore.bundle.v0.3+json); the bundle embeds
  its own DSSE envelope.
• OCI Evidence Bundle - top-level type: "oci.bundle"; the bundle
  embeds a DSSE envelope plus a public key.