Signing & Provenance

Get verified install bundle

Returns a published, public skill's version files plus its DSSE signature bundle, canonical content digest, signer identity, signing method, and SLSA level so the CLI can recompute the digest and verify the signature locally. Public. Non-public or unpublished slugs return 404.

get/api/v1/skills/{slug}/install-bundle

Request

  • Base URL: https://api.skills-hub.ai
  • URL: https://api.skills-hub.ai/api/v1/skills/{slug}/install-bundle
  • Auth: one of:
    • HTTP bearer
    • API key in header Authorization

Path parameters

slugstring required

Response

Successful response. The returned fields are described in this endpoint's summary/description; typed per-field response schemas are being added incrementally.

slugstring required
versionstring required
contentDigeststring required
signatureBundleobject nullable required

DSSE envelope from Sigstore, or null if the version is unsigned.

attestationUrlstring nullable required
signerIdentitystring nullable required
signingKeyIdstring nullable required
signingMethod'DISTRIBUTOR' | 'UPSTREAM_PASSTHROUGH' required
slsaLevelinteger required

Changes

No recorded changes to this operation across all 1 revision of this API.