---
title: "Free: find an existing signed verdict by content hash or package identity."
method: GET
path: "/v1/attestations/{subject}"
---

# Free: find an existing signed verdict by content hash or package identity.

`GET /v1/attestations/{subject}`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/v1/attestations/{subject}`
- Auth: none declared

No auth, IP rate-limited. `subject` is a `sha256:<hex>` content hash, or the target ref as it was scanned (for example `chalk@5.6.1`). Returns the newest attestation with its compact JWS, so it can be verified offline against /.well-known/jwks.json without trusting this response. A clear or flagged verdict over a content hash is re-checked against the current known-bad set first, and `contradicted` is non-null when it no longer holds. `stale_rules` is true when it was attested under older rules. The findings and evidence are not in an attestation. When NOBODY has attested the subject and it is an npm package identity, the answer is a free identity check against the OSV / OpenSSF malicious-package corpus, carried in `identity_check` with `found` still false and `answer` set to `identity_check`. An identity check is a different and weaker thing than an attestation: it is unsigned, it looks at the package identity rather than its code, and absence from the corpus is not a verdict.

## Path parameters

- `subject` string, required

## Response `200`

The attestation, its age, and freshness signals; or, with `found` false, a labelled identity check against the advisory corpus.

## Other responses

- `400`: No subject.
- `404`: Nobody has attested this subject and there is no package identity to check either. Absence of an attestation is not a verdict.
- `429`: Rate limited.

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)