Skip to content
Craftifact

API

Overview-first public API reference with expandable endpoint previews and downloadable OpenAPI artifacts.

Authentication

Use the same token patterns across the public API:

  1. Send the token as Authorization: Bearer <token>.
  2. Or send it through Basic auth with the token as the password.

For Basic auth, use the robot ID as the username when you have one. If your robot account ID is my-robot, use my-robot as the username and the token as the password. The placeholder __token__ also works, but the robot ID is easier to identify later.

Username: my-robot
Password: <token>

For token setup and rotation in the Robot accounts tab, see Create a robot account and use its token.

OpenAPI files

Download the current machine-readable contract directly:

Download YAML Download JSON

Endpoint overview

Expand an endpoint to inspect a minimal request example and open the full contract when you need request and response details.

GET /api/artifacts/search/

Resolve package artifact IDs

curl: resolve by Maven coordinates 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  "https://packages.example.com/api/artifacts/search/?repository=libs-release&format=maven&group_id=com.example&name=demo&version=1.2.3"
Open full reference
POST /api/sbom/upload/

Upload a CycloneDX JSON SBOM

curl: upload and bind to artifact 
curl \
  -X POST \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @dist/example-cyclonedx.json \
  "https://packages.example.com/api/sbom/upload/?artifact_id=ARTIFACT_ID"
Open full reference
GET /api/sbom/vulnerabilities/report/

Read the effective SBOM vulnerability report for one subject

curl: package artifact vulnerability report 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  "https://packages.example.com/api/sbom/vulnerabilities/report/?repository=libs-release&artifact_id=ARTIFACT_ID"
Open full reference
POST /api/evidence/snapshots/

Create an evidence snapshot

curl: create evidence snapshot 
curl \
  -X POST \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Release 1.0 review","subjects":[{"repository":"libs-release","artifact_id":"ARTIFACT_ID"},{"repository":"containers","oci_digest":"sha256:DIGEST"}]}' \
  "https://packages.example.com/api/evidence/snapshots/"
Open full reference
GET /api/evidence/snapshots/

List evidence snapshots

curl: list evidence snapshots 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  "https://packages.example.com/api/evidence/snapshots/"
Open full reference
GET /api/evidence/snapshots/{snapshot_id}/

Read an evidence snapshot

curl: read evidence snapshot 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  "https://packages.example.com/api/evidence/snapshots/SNAPSHOT_ID/"
Open full reference
GET /api/evidence/snapshots/{snapshot_id}/export/

Export an evidence snapshot

curl: export evidence snapshot 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  -o evidence-snapshot.zip \
  "https://packages.example.com/api/evidence/snapshots/SNAPSHOT_ID/export/"
Open full reference