--- title: "CreateArtifactOperation" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/artifact-operations" tags: ["ArtifactOperationService"] --- # CreateArtifactOperation `POST /v1/namespaces/{tenant_meta.namespace}/artifact-operations` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/artifact-operations` - Auth: none declared Services the artifact operations. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - ArtifactOperationServiceCreateArtifactOperationBody: ArtifactOperation implements the artifacts operations on the server side. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `response` V1ArtifactOperationResponse - `artifact_signature` V1ArtifactSignature: Represents an artifact signature object. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1ArtifactSignatureSpec, required - `artifact_digest` string, required - `artifact_name` string, required: The artifact's name. - `artifact_type` 'ARTIFACT_TYPE_UNSPECIFIED' | 'ARTIFACT_TYPE_CONTAINER' | 'ARTIFACT_TYPE_JAR' | 'ARTIFACT_TYPE_WHEEL' | 'ARTIFACT_TYPE_DLL' | 'ARTIFACT_TYPE_ELF' | 'ARTIFACT_TYPE_SBOM' | 'ARTIFACT_TYPE_BLOB', required - `certificate` string: The certificate obtained for this sign operation. - `provenance` V1CertificateExtensions: CertificateExtensions contains the certificate extensions retrieved from an identity token. - `build_config_digest` string: Immutable reference to the specific version of the top-level/initiating build instructions (workflow SHA). - `build_config_name` string: Name of the top-level/initiating build instructions (workflow). - `certificate_identity` string: Immutable reference to the specific identity expected in a valid certificate. Valid values include email address, DNS names, IP addresses, and URIs. - `certificate_oidc_issuer` string: Immutable reference to the specific OIDC issuer expected in a valid certificate. For example, https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. - `runner_environment` string: Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure. - `source_repository` string: Source repository on which the build was based. - `source_repository_digest` string: Immutable reference to a specific version of the source code on which the build was based. - `source_repository_owner` string: Source repository owner of the source repository on which the build was based. - `source_repository_ref` string: Source Repository Ref on which the build run was based. - `revoked` boolean: Set to true if the signature gets revoked. - `signature` string, required: The signature of the build artifact. - `simple_container_image` V1SimpleContainerImage: SimpleContainerImage describes the structure of a basic container image signature payload, as defined at: https://github.com/containers/image/blob/main/docs/containers-signature.5.md#json-data-format. We don't really need to use these definitions since they are only kept in our database and will not be visible externally. However, if we ever decide to save our signatures as part of the OCI container registries or even be asked to "export" our data for customers that perhaps want to migrate to cosign or notary, then this will make this effort more seamless because it's the standard format used. - `critical` V1Critical - `identity` CriticalIdentity - … - `image` CriticalImage - … - `type` string: Type must be 'atomic container signature'. - `source_repository_ref` string: Source repository ref. This also exists in the certificate but it's also here to quickly look up entries that match. - `timestamp` string, date-time: The timestamp of the signing event. - `tenant_meta` V1TenantMeta, required: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of an artifact signature object. - `result` 'ARTIFACT_OPERATION_RESULT_UNSPECIFIED' | 'ARTIFACT_OPERATION_RESULT_SUCCESS' | 'ARTIFACT_OPERATION_RESULT_NO_ARTIFACT' | 'ARTIFACT_OPERATION_RESULT_NO_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_TIME_MISMATCH' | 'ARTIFACT_OPERATION_RESULT_INVALID_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_UNKNOWN_CA' | 'ARTIFACT_OPERATION_RESULT_REVOKED_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_CLAIMS_MISMATCH' | 'ARTIFACT_OPERATION_RESULT_BAD_CERTIFICATE' | 'ARTIFACT_OPERATION_RESULT_INVALID_KEY_TYPE' | 'ARTIFACT_OPERATION_RESULT_CORRUPTED_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_KEY_GEN_FAILURE' | 'ARTIFACT_OPERATION_RESULT_CSR_GEN_FAILURE' | 'ARTIFACT_OPERATION_RESULT_SIGN_FAILURE' | 'ARTIFACT_OPERATION_RESULT_INVALID_ARTIFACT_NAME': The result of an artifact operation. - ARTIFACT_OPERATION_RESULT_UNSPECIFIED: No validator. - ARTIFACT_OPERATION_RESULT_SUCCESS: Success in the artifact operation. - ARTIFACT_OPERATION_RESULT_NO_ARTIFACT: Couldn't find any signatures for the given artifact name. - ARTIFACT_OPERATION_RESULT_NO_SIGNATURE: No signature found for the given digest of the artifact. - ARTIFACT_OPERATION_RESULT_TIME_MISMATCH: The timestamp associated with the signature is outside the time window of the validity of the certificate. - ARTIFACT_OPERATION_RESULT_INVALID_SIGNATURE: The stored signature is invalid. - ARTIFACT_OPERATION_RESULT_UNKNOWN_CA: Unable to verify with a known CA. - ARTIFACT_OPERATION_RESULT_REVOKED_SIGNATURE: Signature has been revoked. - ARTIFACT_OPERATION_RESULT_CLAIMS_MISMATCH: Claims/attestations in the signature don't match input. - ARTIFACT_OPERATION_RESULT_BAD_CERTIFICATE: Empty or corrupted certificate. - ARTIFACT_OPERATION_RESULT_INVALID_KEY_TYPE: Could not find the right type of key in the certificate. - ARTIFACT_OPERATION_RESULT_CORRUPTED_SIGNATURE: Could not decode signature. - ARTIFACT_OPERATION_RESULT_KEY_GEN_FAILURE: Failed to generate private key. - ARTIFACT_OPERATION_RESULT_CSR_GEN_FAILURE: Failed to generate certificate request. - ARTIFACT_OPERATION_RESULT_SIGN_FAILURE: Failed to sign. - ARTIFACT_OPERATION_RESULT_INVALID_ARTIFACT_NAME: Invalid artifact name. - `spec` V1ArtifactOperationSpec - `artifact_name` string, required: The name of the artifact being signed or verified. - `artifact_type` 'ARTIFACT_TYPE_UNSPECIFIED' | 'ARTIFACT_TYPE_CONTAINER' | 'ARTIFACT_TYPE_JAR' | 'ARTIFACT_TYPE_WHEEL' | 'ARTIFACT_TYPE_DLL' | 'ARTIFACT_TYPE_ELF' | 'ARTIFACT_TYPE_SBOM' | 'ARTIFACT_TYPE_BLOB', required - `command` 'ARTIFACT_OPERATION_COMMAND_UNSPECIFIED' | 'ARTIFACT_OPERATION_COMMAND_SIGN' | 'ARTIFACT_OPERATION_COMMAND_VERIFY' | 'ARTIFACT_OPERATION_COMMAND_REVOKE_SIGNATURE', required: - ARTIFACT_OPERATION_COMMAND_SIGN: ARTIFACT_OPERATION_COMMAND_SIGN is used to sign an artifact. - ARTIFACT_OPERATION_COMMAND_VERIFY: ARTIFACT_OPERATION_COMMAND_VERIFY is used to verify an artifact. - ARTIFACT_OPERATION_COMMAND_REVOKE_SIGNATURE: ARTIFACT_OPERATION_COMMAND_REVOKE_SIGNATURE is used to revoke an artifact signature. - `digest` string: Used only for the REVOKE command and is the source repository digest for the signature to be revoked. The artifact name has to be provided as well. - `extensions` V1CertificateExtensions: CertificateExtensions contains the certificate extensions retrieved from an identity token. - `build_config_digest` string: Immutable reference to the specific version of the top-level/initiating build instructions (workflow SHA). - `build_config_name` string: Name of the top-level/initiating build instructions (workflow). - `certificate_identity` string: Immutable reference to the specific identity expected in a valid certificate. Valid values include email address, DNS names, IP addresses, and URIs. - `certificate_oidc_issuer` string: Immutable reference to the specific OIDC issuer expected in a valid certificate. For example, https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. - `runner_environment` string: Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure. - `source_repository` string: Source repository on which the build was based. - `source_repository_digest` string: Immutable reference to a specific version of the source code on which the build was based. - `source_repository_owner` string: Source repository owner of the source repository on which the build was based. - `source_repository_ref` string: Source Repository Ref on which the build run was based. - `tenant_meta` object, required: The tenant metadata restrict access to a specific tenant. - `uuid` string: The UUID of the artifact operation. ## Response `200` A successful response. - V1ArtifactOperation: ArtifactOperation implements the artifacts operations on the server side. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `response` V1ArtifactOperationResponse - `artifact_signature` V1ArtifactSignature: Represents an artifact signature object. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1ArtifactSignatureSpec, required - `artifact_digest` string, required - `artifact_name` string, required: The artifact's name. - `artifact_type` 'ARTIFACT_TYPE_UNSPECIFIED' | 'ARTIFACT_TYPE_CONTAINER' | 'ARTIFACT_TYPE_JAR' | 'ARTIFACT_TYPE_WHEEL' | 'ARTIFACT_TYPE_DLL' | 'ARTIFACT_TYPE_ELF' | 'ARTIFACT_TYPE_SBOM' | 'ARTIFACT_TYPE_BLOB', required - `certificate` string: The certificate obtained for this sign operation. - `provenance` V1CertificateExtensions: CertificateExtensions contains the certificate extensions retrieved from an identity token. - `build_config_digest` string: Immutable reference to the specific version of the top-level/initiating build instructions (workflow SHA). - `build_config_name` string: Name of the top-level/initiating build instructions (workflow). - `certificate_identity` string: Immutable reference to the specific identity expected in a valid certificate. Valid values include email address, DNS names, IP addresses, and URIs. - `certificate_oidc_issuer` string: Immutable reference to the specific OIDC issuer expected in a valid certificate. For example, https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. - `runner_environment` string: Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure. - `source_repository` string: Source repository on which the build was based. - `source_repository_digest` string: Immutable reference to a specific version of the source code on which the build was based. - `source_repository_owner` string: Source repository owner of the source repository on which the build was based. - `source_repository_ref` string: Source Repository Ref on which the build run was based. - `revoked` boolean: Set to true if the signature gets revoked. - `signature` string, required: The signature of the build artifact. - `simple_container_image` V1SimpleContainerImage: SimpleContainerImage describes the structure of a basic container image signature payload, as defined at: https://github.com/containers/image/blob/main/docs/containers-signature.5.md#json-data-format. We don't really need to use these definitions since they are only kept in our database and will not be visible externally. However, if we ever decide to save our signatures as part of the OCI container registries or even be asked to "export" our data for customers that perhaps want to migrate to cosign or notary, then this will make this effort more seamless because it's the standard format used. - `critical` V1Critical - `identity` CriticalIdentity - … - `image` CriticalImage - … - `type` string: Type must be 'atomic container signature'. - `source_repository_ref` string: Source repository ref. This also exists in the certificate but it's also here to quickly look up entries that match. - `timestamp` string, date-time: The timestamp of the signing event. - `tenant_meta` V1TenantMeta, required: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of an artifact signature object. - `result` 'ARTIFACT_OPERATION_RESULT_UNSPECIFIED' | 'ARTIFACT_OPERATION_RESULT_SUCCESS' | 'ARTIFACT_OPERATION_RESULT_NO_ARTIFACT' | 'ARTIFACT_OPERATION_RESULT_NO_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_TIME_MISMATCH' | 'ARTIFACT_OPERATION_RESULT_INVALID_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_UNKNOWN_CA' | 'ARTIFACT_OPERATION_RESULT_REVOKED_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_CLAIMS_MISMATCH' | 'ARTIFACT_OPERATION_RESULT_BAD_CERTIFICATE' | 'ARTIFACT_OPERATION_RESULT_INVALID_KEY_TYPE' | 'ARTIFACT_OPERATION_RESULT_CORRUPTED_SIGNATURE' | 'ARTIFACT_OPERATION_RESULT_KEY_GEN_FAILURE' | 'ARTIFACT_OPERATION_RESULT_CSR_GEN_FAILURE' | 'ARTIFACT_OPERATION_RESULT_SIGN_FAILURE' | 'ARTIFACT_OPERATION_RESULT_INVALID_ARTIFACT_NAME': The result of an artifact operation. - ARTIFACT_OPERATION_RESULT_UNSPECIFIED: No validator. - ARTIFACT_OPERATION_RESULT_SUCCESS: Success in the artifact operation. - ARTIFACT_OPERATION_RESULT_NO_ARTIFACT: Couldn't find any signatures for the given artifact name. - ARTIFACT_OPERATION_RESULT_NO_SIGNATURE: No signature found for the given digest of the artifact. - ARTIFACT_OPERATION_RESULT_TIME_MISMATCH: The timestamp associated with the signature is outside the time window of the validity of the certificate. - ARTIFACT_OPERATION_RESULT_INVALID_SIGNATURE: The stored signature is invalid. - ARTIFACT_OPERATION_RESULT_UNKNOWN_CA: Unable to verify with a known CA. - ARTIFACT_OPERATION_RESULT_REVOKED_SIGNATURE: Signature has been revoked. - ARTIFACT_OPERATION_RESULT_CLAIMS_MISMATCH: Claims/attestations in the signature don't match input. - ARTIFACT_OPERATION_RESULT_BAD_CERTIFICATE: Empty or corrupted certificate. - ARTIFACT_OPERATION_RESULT_INVALID_KEY_TYPE: Could not find the right type of key in the certificate. - ARTIFACT_OPERATION_RESULT_CORRUPTED_SIGNATURE: Could not decode signature. - ARTIFACT_OPERATION_RESULT_KEY_GEN_FAILURE: Failed to generate private key. - ARTIFACT_OPERATION_RESULT_CSR_GEN_FAILURE: Failed to generate certificate request. - ARTIFACT_OPERATION_RESULT_SIGN_FAILURE: Failed to sign. - ARTIFACT_OPERATION_RESULT_INVALID_ARTIFACT_NAME: Invalid artifact name. - `spec` V1ArtifactOperationSpec - `artifact_name` string, required: The name of the artifact being signed or verified. - `artifact_type` 'ARTIFACT_TYPE_UNSPECIFIED' | 'ARTIFACT_TYPE_CONTAINER' | 'ARTIFACT_TYPE_JAR' | 'ARTIFACT_TYPE_WHEEL' | 'ARTIFACT_TYPE_DLL' | 'ARTIFACT_TYPE_ELF' | 'ARTIFACT_TYPE_SBOM' | 'ARTIFACT_TYPE_BLOB', required - `command` 'ARTIFACT_OPERATION_COMMAND_UNSPECIFIED' | 'ARTIFACT_OPERATION_COMMAND_SIGN' | 'ARTIFACT_OPERATION_COMMAND_VERIFY' | 'ARTIFACT_OPERATION_COMMAND_REVOKE_SIGNATURE', required: - ARTIFACT_OPERATION_COMMAND_SIGN: ARTIFACT_OPERATION_COMMAND_SIGN is used to sign an artifact. - ARTIFACT_OPERATION_COMMAND_VERIFY: ARTIFACT_OPERATION_COMMAND_VERIFY is used to verify an artifact. - ARTIFACT_OPERATION_COMMAND_REVOKE_SIGNATURE: ARTIFACT_OPERATION_COMMAND_REVOKE_SIGNATURE is used to revoke an artifact signature. - `digest` string: Used only for the REVOKE command and is the source repository digest for the signature to be revoked. The artifact name has to be provided as well. - `extensions` V1CertificateExtensions: CertificateExtensions contains the certificate extensions retrieved from an identity token. - `build_config_digest` string: Immutable reference to the specific version of the top-level/initiating build instructions (workflow SHA). - `build_config_name` string: Name of the top-level/initiating build instructions (workflow). - `certificate_identity` string: Immutable reference to the specific identity expected in a valid certificate. Valid values include email address, DNS names, IP addresses, and URIs. - `certificate_oidc_issuer` string: Immutable reference to the specific OIDC issuer expected in a valid certificate. For example, https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. - `runner_environment` string: Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure. - `source_repository` string: Source repository on which the build was based. - `source_repository_digest` string: Immutable reference to a specific version of the source code on which the build was based. - `source_repository_owner` string: Source repository owner of the source repository on which the build was based. - `source_repository_ref` string: Source Repository Ref on which the build run was based. - `tenant_meta` V1TenantMeta, required: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the artifact operation. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/artifact-operations/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)