Build attachments
Logs, reports and other files attached to an artifact, with their history.
Operations of this group with their access rule, retry rule, parameters and answers. Every request carries a key: Authorization: Bearer <key> (see Authentication).
Operations
Get the attachments of a build
GET HEAD /api/v1/repositories/{repository}/artifacts/{id}/attachments
Access: Repository permission: annotation.read; file keys: read · Retry: Safe to repeat (read)
Returns the current attachment revision of an artifact: up to 32 entries, each naming another published artifact of the repository with a name, a kind (manifest, sbom, signature, report, file) and a description, plus the actor and time of the change. Revision 0 with no items means nothing was ever attached. Download an attached file by its artifactId.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
repository | path | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
id | path | string (uuid) | yes | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
revision | integer | yes | 0–2147483647 |
items | array of object | yes | up to 32 items |
items[].name | string | yes | 1–240 characters |
items[].kind | string | yes | one of manifest, sbom, signature, report, file |
items[].artifactId | string (uuid) | yes | — |
items[].description | string | yes | up to 512 characters |
actor | string | yes | may be null |
createdAt | string (date-time) | yes | may be null |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/repositories/$REPOSITORY/artifacts/$ID/attachments" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Replace the attachments of a build
PUT /api/v1/repositories/{repository}/artifacts/{id}/attachments
Access: Repository permission: annotation.write, artifact.read; file keys: read, write · Retry: Repeat only with the expected revision (compare-and-swap)
Replaces the whole attachment list of an artifact (up to 32 entries; an empty list removes them all) and returns the new revision. Each target must be another artifact already published in the same repository (upload it first), names are unique ignoring case and descriptions have up to 512 characters. expectedRevision must be the current revision (0 for the first list), otherwise 409 revision_mismatch; artifacts named in any revision stay protected from deletion.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
repository | path | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
id | path | string (uuid) | yes | — |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
expectedRevision | integer | yes | 0–2147483646 |
items | array of object | yes | up to 32 items |
items[].name | string | yes | 1–240 characters |
items[].kind | string | yes | one of manifest, sbom, signature, report, file |
items[].artifactId | string (uuid) | yes | — |
items[].description | string | yes | up to 512 characters |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
revision | integer | yes | 0–2147483647 |
items | array of object | yes | up to 32 items |
items[].name | string | yes | 1–240 characters |
items[].kind | string | yes | one of manifest, sbom, signature, report, file |
items[].artifactId | string (uuid) | yes | — |
items[].description | string | yes | up to 512 characters |
actor | string | yes | may be null |
createdAt | string (date-time) | yes | may be null |
Responses: 200, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X PUT "$ARKVORY_URL/api/v1/repositories/$REPOSITORY/artifacts/$ID/attachments" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"expectedRevision":0,"items":[]}'List the attachment history of a build
GET HEAD /api/v1/repositories/{repository}/artifacts/{id}/attachments/history
Access: Repository permission: annotation.read; file keys: read · Retry: Safe to repeat (read)
Returns the earlier and current attachment revisions of an artifact, newest first, 20 per page, each with its entries, actor and time; continue with before set to next. The attached artifacts of every revision remain downloadable, because they are protected from deletion.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
repository | path | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
id | path | string (uuid) | yes | — |
before | query | integer | no | 1–2147483647 |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
items | array of object | yes | up to 20 items |
items[].revision | integer | yes | 0–2147483647 |
items[].items | array of object | yes | up to 32 items |
items[].items[].name | string | yes | 1–240 characters |
items[].items[].kind | string | yes | one of manifest, sbom, signature, report, file |
items[].items[].artifactId | string (uuid) | yes | — |
items[].items[].description | string | yes | up to 512 characters |
items[].actor | string | yes | may be null |
items[].createdAt | string (date-time) | yes | may be null |
next | integer | yes | 1–2147483647; may be null |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/repositories/$REPOSITORY/artifacts/$ID/attachments/history" \
-H "Authorization: Bearer $ARKVORY_TOKEN"