Try JFrog
Guides
Contact SupportTry JFrog
  1. Integrations
  2. JFrog OneModel GraphQL

Evidence OneModel GraphQL

The JFrog Evidence service provides a comprehensive GraphQL API for querying evidence and Release Bundle information. This API follows the ​OneModel​ GraphQL ​conventions​​ and supports pagination, filtering, ordering, and federated queries.

Key features include:

  • Evidence management: Query, search, and retrieve evidence associated with artifacts and other subject types
  • Release Bundle queries: Access Release Bundle versions, artifacts, builds, and their relationships
  • Entity-type search: Filter evidence by entityType and entityId for application versions, package versions, builds, and more
  • Federation support: Resolve evidence from other OneModel subgraphs (for example, AppTrust application versions)

For field-level schema details and the complete list of operations, use the GraphQL Playground in the JFrog Platform UI under Integrations > GraphQL Playground. For more information, see Explore Schema With GraphQL Playground.

Prerequisites

  • Requires Artifactory 7.104.2 or later
  • Subscription information:
    • The ability to collect internal evidence generated by Artifactory requires a Pro license or above. Internal evidence generated by Xray requires a Pro X license or above.
    • The ability for users to create evidence and upload it to Artifactory requires an Enterprise+ license.
  • Define the scoped token audience as *@*. This definition is required to run cross-service queries.

Subgraph Summary

This subgraph exposes two primary query domains: Evidence and Release Bundle Version. It is designed around Relay-style connections for pagination and supports filtering, ordering, and federated usage with other services.

Query Entry Points

  • Query.evidence -> EvidenceQueries: root for direct evidence retrieval and evidence search
  • Query.releaseBundleVersion -> ReleaseBundleVersionQueries: root for querying Release Bundle v2 versions and traversing their artifacts, builds, and evidence

Main Entities

Evidence Domain

  • Evidence: core record describing attestations attached to a subject; includes metadata (evidenceId, predicateCategory, predicateType, predicateSlug, createdBy, verified, providerId, stageName) and links to related entities
  • EvidenceSubject: logical identity of the entity evidence is attached to (repositoryKey, fullPath, entityType, entityId, and related locator fields)
  • EvidenceAttachment: file attached to an evidence record (for example, legal documents), with checksum and download path
  • EvidenceSigningKey: key metadata used to verify signatures for an evidence record (alias, publicKey)
  • EvidenceConnection/EvidenceEdge: paginated wrapper used when returning lists of evidence

Release Bundle Domain

  • ReleaseBundleVersion: top-level Release Bundle v2 version aggregate
  • ReleaseBundleVersionArtifact: artifact entry inside a release bundle (path, name, hash, package metadata, properties), with its own evidence
  • ReleaseBundleVersionBuild: build entry used to create the release bundle, with its own evidence
  • ReleaseBundleVersionArtifactConnection/ReleaseBundleVersionArtifactEdge: paginated wrapper for release bundle artifacts
  • ReleaseBundleVersionArtifactProperty: key/value properties on a release bundle artifact

Shared Conventions

  • PageInfo and Cursor: standard Relay cursor pagination primitives
  • Common scalars used across entities include Date, Sha256, and JSON

Entity Relationships

  • Evidence -> EvidenceSubject (many-to-one): each evidence record references a subject identity
  • Evidence -> EvidenceSigningKey (optional one-to-one): an evidence record may include the signing key used for verification
  • Evidence -> EvidenceAttachment (one-to-many): an evidence record may include attached files
  • EvidenceSubject -> EvidenceConnection (one-to-many): a subject can have multiple evidence records, with optional filtering and ordering
  • ReleaseBundleVersion -> ReleaseBundleVersionArtifactConnection (one-to-many): a bundle version contains many artifacts
  • ReleaseBundleVersion -> EvidenceConnection (one-to-many): a bundle version can have evidence attached directly at bundle scope
  • ReleaseBundleVersion -> ReleaseBundleVersionBuild (one-to-many): a bundle version is derived from one or more builds
  • ReleaseBundleVersionArtifact -> EvidenceConnection (one-to-many): each artifact can expose associated evidence
  • ReleaseBundleVersionBuild -> EvidenceConnection (one-to-many): each build can expose associated evidence

These relationships are described in the diagram below.

flowchart TD
    subgraph QueryDomain["Query entry points"]
        Query[Query]
        EvidenceQueries[EvidenceQueries]
        ReleaseBundleVersionQueries[ReleaseBundleVersionQueries]
    end

    subgraph EvidenceDomain["Evidence domain"]
        Evidence[Evidence]
        EvidenceSubject["EvidenceSubject<br/>(federated entity)"]
        EvidenceSigningKey[EvidenceSigningKey]
        EvidenceAttachment[EvidenceAttachment]
        EvidenceConnection[EvidenceConnection]
        EvidenceEdge[EvidenceEdge]
    end

    subgraph ReleaseBundleDomain["Release Bundle domain"]
        ReleaseBundleVersion[ReleaseBundleVersion]
        ReleaseBundleVersionArtifactConnection[ReleaseBundleVersionArtifactConnection]
        ReleaseBundleVersionArtifactEdge[ReleaseBundleVersionArtifactEdge]
        ReleaseBundleVersionArtifact[ReleaseBundleVersionArtifact]
        ReleaseBundleVersionArtifactProperty[ReleaseBundleVersionArtifactProperty]
        ReleaseBundleVersionBuild[ReleaseBundleVersionBuild]
    end

    PageInfo[PageInfo]
    OtherSubgraphs["Other subgraphs<br/>(e.g. AppTrust)"]

    Query -->|evidence| EvidenceQueries
    Query -->|releaseBundleVersion| ReleaseBundleVersionQueries

    EvidenceQueries -->|"getEvidenceById / getEvidence"| Evidence
    EvidenceQueries -->|searchEvidence| EvidenceConnection

    EvidenceConnection -->|edges| EvidenceEdge
    EvidenceEdge -->|node| Evidence
    EvidenceConnection -->|pageInfo| PageInfo

    Evidence -->|subject| EvidenceSubject
    Evidence -->|signingKey| EvidenceSigningKey
    Evidence -->|attachments| EvidenceAttachment

    EvidenceSubject -->|evidenceConnection| EvidenceConnection
    OtherSubgraphs -.->|"federation keys<br/>(fullPath, entityType/entityId)"| EvidenceSubject

    ReleaseBundleVersionQueries -->|getVersion| ReleaseBundleVersion
    ReleaseBundleVersion -->|artifactsConnection| ReleaseBundleVersionArtifactConnection
    ReleaseBundleVersion -->|evidenceConnection| EvidenceConnection
    ReleaseBundleVersion -->|fromBuilds| ReleaseBundleVersionBuild

    ReleaseBundleVersionArtifactConnection -->|edges| ReleaseBundleVersionArtifactEdge
    ReleaseBundleVersionArtifactConnection -->|pageInfo| PageInfo
    ReleaseBundleVersionArtifactEdge -->|node| ReleaseBundleVersionArtifact

    ReleaseBundleVersionArtifact -->|properties| ReleaseBundleVersionArtifactProperty
    ReleaseBundleVersionArtifact -->|evidenceConnection| EvidenceConnection
    ReleaseBundleVersionBuild -->|evidenceConnection| EvidenceConnection

Traversal Patterns

The patterns that follow describe how data is typically queried within this subgraph.

  • Direct lookup: use getEvidenceById to fetch a single record by ID, or getEvidence to fetch by repository location and optional SHA-256
  • Evidence-centric search: filter by EvidenceSubjectWhereInput (repository locator fields, entityType/entityId, or project/application keys) and page through searchEvidence
  • Subject-centric: resolve an EvidenceSubject (directly or via federation) and traverse evidenceConnection with where and orderBy filters
  • Bundle-centric: fetch a release bundle version with getVersion, then traverse:
    • artifactsConnection for artifacts (optionally filtered with hasEvidence)
    • artifact-level evidenceConnection
    • bundle-level evidenceConnection
    • fromBuilds and build-level evidenceConnection
  • Connections consistently return totalCount, edges.node, and pageInfo, enabling uniform pagination behavior across entity lists

Federation

EvidenceSubject is a federated entity. Other subgraphs can resolve evidence by referencing a subject using one of these key combinations:

  • fullPath
  • repositoryKey, entityType, entityId
  • projectKey, entityType, entityId
  • applicationKey, entityType, entityId

Notes

  • Evidence.repositoryKey is deprecated in favor of Evidence.subject.repositoryKey
  • Evidence.path is deprecated. To locate evidence for an artifact (for example, for deletion), concatenate subject.path + '/' + subject.name + '/' + evidence.name
  • Some fields are marked experimental (for example, Evidence.subject) and may change
  • EvidenceSubject.evidenceConnection returns a non-null EvidenceConnection!. Release bundle evidenceConnection fields return a nullable EvidenceConnection

Common Use Cases

Get Evidence by ID

query GetEvidenceById {
  evidence {
    getEvidenceById(id: "evidence-123") {
      evidenceId
      name
      predicateType
      predicateCategory
      verified
      createdBy
      createdAt
      subject {
        fullPath
        entityType
        entityId
      }
      attachments {
        name
        sha256
        type
        downloadPath
      }
    }
  }
}

Get Evidence by Repository Location

query GetEvidenceByLocation {
  evidence {
    getEvidence(
      repositoryKey: "my-repo-key"
      path: "artifacts/path"
      name: "evidence.json"
    ) {
      evidenceId
      predicateType
      verified
      downloadPath
    }
  }
}

Find All Evidence for an Artifact

This query finds all attestations (cryptographically signed metadata records) for a given artifact.

query FindAllEvidenceForArtifact {
  evidence {
    searchEvidence(
      first: 20
      where: {
        hasSubjectWith: {
          repositoryKey: "docker-local"
          path: "my-app/latest"
          name: "manifest.json"
        }
      }
    ) {
      totalCount
      edges {
        node {
          evidenceId
          name
          predicateType
          verified
          createdBy
        }
      }
    }
  }
}

Search Evidence by Subject

The query shown below searches for evidence associated with a specific artifact as defined by its repository key, path, and name.

query SearchEvidenceBySubject {
  evidence {
    searchEvidence(
      where: {
        hasSubjectWith: {
          repositoryKey: "my-docker-repo"
          path: "images"
          name: "my-app"
        }
      }
      first: 20
    ) {
      totalCount
      pageInfo { hasNextPage endCursor }
      edges {
        node {
          evidenceId
          name
          predicateType
          createdAt
          verified
          predicate
        }
      }
    }
  }
}

Search Evidence by Entity Type

Search for evidence attached to an application version or other typed subject.

query SearchEvidenceByEntityType {
  evidence {
    searchEvidence(
      first: 20
      where: {
        hasSubjectWith: {
          entityType: "application-version"
          entityId: "orders-app/2.4.0"
        }
      }
    ) {
      totalCount
      edges {
        node {
          evidenceId
          predicateType
          predicateCategory
          verified
          stageName
        }
      }
    }
  }
}

Filter and Order Evidence on a Subject

When resolving an EvidenceSubject, use evidenceConnection with where and orderBy to filter and sort results.

query FilteredSubjectEvidence {
  evidence {
    searchEvidence(
      where: {
        hasSubjectWith: {
          repositoryKey: "docker-local"
          path: "my-app/latest"
          name: "manifest.json"
        }
      }
      first: 1
    ) {
      edges {
        node {
          subject {
            fullPath
            evidenceConnection(
              where: { verified: true }
              orderBy: { field: CREATED_AT, direction: DESC }
              first: 10
            ) {
              totalCount
              edges {
                node {
                  evidenceId
                  predicateType
                  verified
                  createdAt
                }
              }
            }
          }
        }
      }
    }
  }
}

Get Release Bundle with Artifacts and Evidence

Use this query to retrieve a specific Release Bundle v2 version, its associated artifacts (filtered for those with evidence), builds, and evidence at bundle, artifact, and build scope.

query GetReleaseBundleWithDetails {
  releaseBundleVersion {
    getVersion(
      name: "my-release-bundle"
      version: "1.0.0"
    ) {
      createdBy
      createdAt

      artifactsConnection(
        where: { hasEvidence: true }
        first: 50
      ) {
        edges {
          node {
            name
            sha256
            sourceRepositoryPath
            evidenceConnection(first: 10) {
              totalCount
              edges {
                node {
                  evidenceId
                  predicateType
                  verified
                }
              }
            }
          }
        }
      }

      evidenceConnection(first: 10) {
        edges {
          node {
            evidenceId
            predicateType
            verified
          }
        }
      }

      fromBuilds {
        name
        number
        startedAt
        evidenceConnection(first: 10) {
          edges {
            node {
              evidenceId
              predicateType
              verified
            }
          }
        }
      }
    }
  }
}

Application Version Query

The following example fetches an application version from the AppTrust service and retrieves its associated evidence. Evidence fields are resolved by the Evidence service via federation.

query GetApplicationVersionWithEvidence {
  applications {
    getApplicationVersion(
      applicationKey: "my-app"
      version: "1.0.0"
    ) {
      application {
        key
        displayName
      }
      version
      tag
      createdAt
      createdBy
      status
      releaseStatus

      evidence(first: 10, verified: true) {
        evidenceId
        name
        predicateType
        predicateCategory
        verified
        createdAt
        createdBy
        subject {
          fullPath
          repositoryKey
          path
          name
          entityType
          entityId
        }
      }
    }
  }
}

Response:

{
  "data": {
    "applications": {
      "getApplicationVersion": {
        "application": {
          "key": "my-app",
          "displayName": "My Application"
        },
        "version": "1.0.0",
        "tag": "release-v1.0.0",
        "createdAt": "2024-11-20T10:00:00Z",
        "createdBy": "ci-system",
        "status": "COMPLETED",
        "releaseStatus": "RELEASED",
        "evidence": [
          {
            "evidenceId": "evidence-123",
            "name": "build-attestation",
            "predicateType": "https://slsa.dev/provenance/v1",
            "predicateCategory": "BUILD",
            "verified": true,
            "createdAt": "2024-11-20T10:15:00Z",
            "createdBy": "ci-system",
            "subject": {
              "fullPath": "npm-local/artifacts/my-app/1.0.0",
              "repositoryKey": "npm-local",
              "path": "artifacts/my-app",
              "name": "1.0.0",
              "entityType": "application-version",
              "entityId": "my-app/1.0.0"
            }
          }
        ]
      }
    }
  }
}

Updated 21 days ago

Did this page help you?