---
title: "Attester indépendamment un run Codex avec GitHub Actions OIDC"
method: POST
path: "/api/v1/runs/attest/external-execution"
tags: ["AI Workforce", "Runs externes"]
---

# Attester indépendamment un run Codex avec GitHub Actions OIDC

`POST /api/v1/runs/attest/external-execution`

## Request

- Base URL: `https://arcadeops.leadalpes.fr`
- URL: `https://arcadeops.leadalpes.fr/api/v1/runs/attest/external-execution`
- Auth: HTTP bearer

Vérifie le jeton OIDC, le runner hébergé, le workflow épinglé, le dépôt, la branche, le commit et le challenge du run avant de chaîner un nouveau Evidence Pack.

## Headers

- `Idempotency-Key` string, required

## Request body

- GithubActionsAttestationRequest
  - `schemaVersion` 'arcadeops.github-actions-attestation.v1', required
  - `challenge` string, uuid, required
  - `externalExecutionId` string, required
  - `runId` string, required
  - `taskId` string, required
  - `projectId` string, required
  - `githubRunId` string, required
  - `githubRunAttempt` string, required
  - `verifyResult` 'success', required
  - `baseCommit` string, required
  - `commitSha` string, required
  - `evidenceArtifactId` string, required
  - `evidenceArtifactSha256` string, required
  - `changedPaths` string[], required
  - `evidence` object[], required
    - `key` string, required
    - `status` 'PASS' | 'FAIL', required
    - `sha256` string, required
    - `summary` string, required
  - `artifacts` object[], required
    - `name` string, required
    - `sha256` string, required
  - `completedAt` string, date-time, required

## Response `200`

Attestation vérifiée et Evidence Pack chaîné

- GithubActionsAttestationResponse
  - `externalExecutionId` string, required
  - `runId` string, required
  - `replayed` boolean, required
  - `releaseDecision` 'READY' | 'BLOCKED' | 'NEEDS_REVIEW' | 'REJECTED', required
  - `evidencePackId` string, required
  - `certificateId` string, nullable, required
  - `missingEvidence` string[], required
  - `attestationStatus` 'VERIFIED', required

## Other responses

- `400`: Attestation ou Idempotency-Key invalide
- `401`: Jeton OIDC ou challenge absent, invalide ou expiré
- `403`: Autorisation du run révoquée
- `409`: Run non attestable, challenge consommé ou état en conflit
- `413`: Corps supérieur à 256 Ko
- `415`: Content-Type application/json requis
- `429`: Limite de requêtes atteinte

---

[API](https://skmtc.dev/leadalpes/apis/arcadeops-api.md) · [All operations](https://skmtc.dev/leadalpes/apis/arcadeops-api/llms.txt) · [OpenAPI document](https://skmtc.dev/leadalpes/apis/arcadeops-api/revisions/f10422ec7412?raw)