---
title: "Get verified install bundle"
method: GET
path: "/api/v1/skills/{slug}/install-bundle"
tags: ["Signing & Provenance"]
---

# Get verified install bundle

`GET /api/v1/skills/{slug}/install-bundle`

## Request

- Base URL: `https://api.skills-hub.ai`
- URL: `https://api.skills-hub.ai/api/v1/skills/{slug}/install-bundle`
- Auth: one of:
  - HTTP bearer
  - API key in header `Authorization`

Returns a published, public skill's version files plus its DSSE signature bundle, canonical content digest, signer identity, signing method, and SLSA level so the CLI can recompute the digest and verify the signature locally. Public. Non-public or unpublished slugs return `404`.

## Path parameters

- `slug` string, required

## Response `200`

Successful response. The returned fields are described in this endpoint's summary/description; typed per-field response schemas are being added incrementally.

- object
  - `slug` string, required
  - `version` string, required
  - `contentDigest` string, required
  - `files` object[], required
    - `path` string, required
    - `sha256` string, required
    - `contents` string, required
  - `signatureBundle` object, nullable, required: DSSE envelope from Sigstore, or null if the version is unsigned.
  - `attestationUrl` string, nullable, required
  - `signerIdentity` string, nullable, required
  - `signingKeyId` string, nullable, required
  - `signingMethod` 'DISTRIBUTOR' | 'UPSTREAM_PASSTHROUGH', required
  - `slsaLevel` integer, required

---

[API](https://skmtc.dev/skills-hub/apis/skills-hub-ai-api.md) · [All operations](https://skmtc.dev/skills-hub/apis/skills-hub-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skills-hub/apis/skills-hub-ai-api/revisions/cb5d46d80300?raw)