Release Lifecycle Management GraphQL

Get Release Bundle v2 Version (GraphQL)

Description: Returns the requested data for the Release Bundle v2 version defined by the One Model GraphQL query.

❗️

Important

When operating in a Self-Hosted environment, you must enable the Evidence service in the system.yaml file as a prerequisite to using this endpoint. Add the following:

evidence:
  enabled: true

Security: Requires a valid token; requires Read permissions for the specified Release Bundle

Usage: POST /onemodel/api/v1/graphql

👍

Tip

To jump directly to common use cases & examples, click here.

Query a Release Bundle Version

Use the getVersion query to fetch a specific Release Bundle version. This is the primary entry point for all Release Bundle version data.

getVersion

Fetches a single Release Bundle version identified by its name, version, and location (repository or project).

query {
  releaseBundleVersion {
    getVersion(name: "my-release-bundle", version: "1.0.0") {
      # Fields to retrieve
      createdBy
      createdAt
    }
  }
}

Repository Selection Logic

This API uses a specific order of preference to determine which repository to query:

1. repositoryKey is provided: The query targets the specified repository directly. The projectKey is ignored, if provided.
2. projectKey is provided alone: The query targets the default Release Bundle repository within the specified project.
3. Neither is provided: The query targets the default global repository, release-bundles-v2.

ReleaseBundleVersion Type

This type represents a specific Release Bundle version and contains all its associated data.

📘

Note

Fields such as ReleaseBundleVersionArtifact and EvidenceConnection use a cursor-based pagination model, which is a standard GraphQL pattern for handling large data sets efficiently.

EvidenceConnection requires the following format:

GraphQL

evidenceConnection { totalCount edges { node { predicateSlug predicateType...}}}

ReleaseBundleVersionArtifact requires the following format:

GraphQL

artifactConnection { totalCount edges { node { path name ...}}}

For more information, see One Model GraphQL Common Patterns and Conventions.

Detailed Object Types

ReleaseBundleVersionArtifact

This type represents a single artifact within the Release Bundle version.

ReleaseBundleVersionBuild

This type represents a build used as a source for the Release Bundle version.

ReleaseBundleVersionArtifactProperty

This type represents the key-value pairs defined as properties of the artifact.

Status Codes

Get Release Bundle v2 Version (GraphQL) Use Cases & Examples

This section contains practical examples that demonstrate how to solve common tasks with the Get Release Bundle v2 Version GraphQL API:

• Example 1: Fetching basic details
• Example 2: Retrieving all artifacts and their properties
• Example 3: Inspecting source builds
• Example 4: Paginating through a large set of artifacts
• Example 5: Full traceability from release to build evidence
• Example 6: Find all Docker images with evidence

Example 1: Fetching basic details

This GraphQL query retrieves the creator and creation date for a specific Release Bundle v2 version.

query GetVersionDetails {
  releaseBundleVersion {
    getVersion(name: "my-app", version: "2.1.0", projectKey: "my-proj") {
      createdBy
      createdAt
    }
  }
}

cURL Request & Response

Request:

curl -X POST -H "Authorization: Bearer <YOUR_TOKEN>" -H "Content-Type: application/json" \
https://<YOUR_JFROG_URL>/onemodel/api/v1/graphql \
--data '{
    "query": "query GetVersionDetails { releaseBundleVersion { getVersion(name: \"my-app\", version: \"2.1.0\", projectKey: \"my-proj\") { createdBy createdAt } } }"
}'

Response:

{
    "data": {
        "releaseBundleVersion": {
            "getVersion": {
                "createdBy": "admin",
                "createdAt": "2025-08-05T06:53:00.123Z"
            }
        }
    }
}

Example 2: Retrieving all artifacts and their properties

This query fetches all artifacts in a Release Bundle version and lists its associated properties. This is useful for auditing or generating a complete Software Bill of Materials (SBOM).

query GetAllArtifactsAndProperties {
  releaseBundleVersion {
    getVersion(name: "my-app", version: "3.0.0-GA") {
      artifactsConnection(first: 50) { # Adjust 'first' as needed
        edges {
          node {
            name
            path
            sha256
            properties {
              key
              values
            }
          }
        }
      }
    }
  }
}

Example 3: Inspecting source builds

You can query from the fromBuilds field to help understand the CI/CD origins of a Release Bundle version. This example retrieves the build name, number, and start time for all source builds.

query GetSourceBuilds {
  releaseBundleVersion {
    getVersion(name: "my-app", version: "3.0.0-GA", projectKey: "my-proj") {
      fromBuilds {
        name
        number
        startedAt
        repositoryKey
      }
    }
  }
}

Example 4: Paginating through a large set of artifacts

If a Release Bundle version contains more artifacts than can be fetched in one request, you must paginate.

Step 1: Fetch the first page

This query returns the first 100 artifacts.

query GetFirstArtifactPage {
  releaseBundleVersion {
    getVersion(name: "large-bundle", version: "10.5.0") {
      artifactsConnection(first: 100) {
        totalCount
        edges {
          node {
            name
          }
        }
        pageInfo {
          hasNextPage
          endCursor # <-- Save this cursor!
        }
      }
    }
  }
}

Step 2: Fetch the next page

Use the endCursor from the previous response in the after argument to get the next set of 100 results.

query GetNextArtifactPage {
  releaseBundleVersion {
    getVersion(name: "large-bundle", version: "10.5.0") {
      artifactsConnection(first: 100, after: "YXJ0aWZhY3Q6Mg==") {
        edges {
          node {
            name
          }
        }
        pageInfo {
          hasNextPage
          endCursor
        }
      }
    }
  }
}

📘

Tip

To fetch all artifacts, repeat step 2 for as long as hasNextPage is true.

Example 5: Full traceability from release to build evidence

This query provides end-to-end traceability. It starts with a Release Bundle, drills down into its source builds, and retrieves the evidence associated with each of those builds. This is critical for compliance and auditing.

query FullTraceabilityAudit {
  releaseBundleVersion {
    getVersion(name: "mission-critical-app", version: "1.2.3") {
      fromBuilds {
        name
        number
        evidenceConnection(first: 10) {
          edges {
            node {
              # Fields from the Evidence type
              evidenceType
              sha256
              issuedBy
              issuedAt
            }
          }
        }
      }
    }
  }
}

Example 6: Find all Docker images with evidence

This query demonstrates a powerful workflow. It retrieves all artifacts, but you would filter them programmatically on the client side to find specific packageTypes (such as docker). It then fetches the associated evidence for each matching artifact. This enables you to find all Docker images that have a Security Scan evidence report.

query FindDockerImagesWithEvidence {
  releaseBundleVersion {
    getVersion(name: "webapp-release", version: "4.5.1") {
      # Filter artifacts that have evidence on the server
      artifactsConnection(first: 50, where: { hasEvidence: true }) {
        edges {
          node {
            # Retrieve fields needed for client-side filtering
            name
            packageType
            # And get the evidence for each one
            evidenceConnection(first: 5) {
              edges {
                node {
                  evidenceType
                  sha256
                }
              }
            }
          }
        }
      }
    }
  }
}

📘

Note

In a real application, you would iterate through the query results If node.packageType is docker, you would then process its evidenceConnection.