DOCSEARCHbyAlgolia
Submit Docs

Chainloop API Reference

website·Indexed 33 days ago

https://docs.chainloop.dev/

API documentation for Chainloop, featuring services for security assessments, compliance evaluation, software component (SBOM) management, artifact tracking, and environment deployment recording. Includes endpoints for AI-powered evidence analysis, auto-assessments, and content-addressable storage (CAS) artifact downloads.

Tokens
231.8K
Snippets
932
Records
1.5K
Agent score
67%

What's inside Chainloop

  1. Overview of Chainloop Attestations

    An attestation is a signed and verifiable unit of data sent to Chainloop to build a trusted evidence store. Attestations act as nodes in a graph, connected by the SHA256 content digests of the materials (evidence) they reference. This allows users to traverse from an artifact to all associated attestations (e.g., build and security scan attestations for the same container image).

    Attestations are signed end-to-end as Sigstore bundles. The signed attestation metadata is stored in the control plane, while the actual evidence payloads are uploaded to a configured CAS backend (such as an OCI registry, S3 bucket, or Azure Blob container) and stored under their SHA256 digest.

  2. Overview of Control and Quality Gates in Chainloop

    Control gates are checkpoints in the software supply chain that enforce policies and security checks (e.g., vulnerability scans, license compliance, code quality). In Chainloop, these are implemented via policies evaluated against materials, attestation documents, or compliance data. If a control gate policy fails, the chainloop attestation push command returns a non-zero exit code to block the pipeline, but the attestation is still recorded in Chainloop as 'not compliant' for auditability.

  3. Overview of CI/CD Runner Context gathering

    Chainloop allows the collection of optional runner context from CI/CD environments to be added to a workflow contract. This feature is available only on paid plans. Using the Chainloop CLI Enterprise Edition (CLI EE), the system automatically collects detailed security configuration data, including:

    • Branch protection settings (push restrictions, history, and deletion controls)
    • Pull request protection settings (review requirements, dismissal rules, conversation resolution policies)
    • Commit protection settings (signing requirements)
    • Repository access settings (teams, members, collaborators, and custom roles)

    This data provides auditable evidence of security controls during build and deployment and integrates with branch protection policies.

  4. Overview of AI Coding Sessions

    An AI coding session is a unit of work performed by an AI agent against a repository. Chainloop automatically captures the models used, tools invoked, messages exchanged, and the exact lines of code produced. This data is converted into a signed CHAINLOOP_AI_CODING_SESSION attestation. These attestations allow security and engineering teams to track AI contributions, evaluate them against policies, and monitor them via a dashboard.

  5. Overview of Content Addressable Storage (CAS) backend

    Chainloop provides a Content Addressable Storage (CAS) API proxy to collect and store evidence (such as SBOMs, test results, and runner logs) for in-toto attestations. The CAS proxy ensures evidence is tamper-proof by naming files after their SHA256 content digest, which is calculated by the client and verified by the server. This architecture allows the attestation to store a small digest reference instead of the full large artifact.

  6. Overview of Chainloop Integration Capabilities

    Chainloop allows operators to extend functionality by integrating third-party providers to act on attestation metadata and workflow events. Key capabilities include:

    • Keyless Attestation: Use OIDC tokens from CI/CD environments to attest without managing API keys.
    • Repository Integration: Link source code repositories to projects for scoped and validated attestations.
    • Fan-Out: Distribute attestations, SBOMs, and artifacts to external systems after workflow runs.
    • Notifications: Send alerts regarding system status, product updates, and workflow events.
    • Issue Tracking: Create issues in external trackers (e.g., Linear) based on security assessments.
    • Chainloop Ask: A natural language assistant for querying supply chain data in the web UI and Slack.
    • Evidence AI Prompt: Use AI-driven natural-language policies to evaluate attestation evidence.

  7. Overview of Chainloop Repository Integration

    Repository Integration allows a Chainloop organization to connect to GitHub or GitLab. This enables Chainloop to list repositories, onboard projects and workflows, and interact with pull requests (PRs) or merge requests (MRs). This feature is available only on paid plans. Currently, only GitHub and GitLab are supported; other providers like Bitbucket are not available.

  8. Overview of Vulnerability Management setup in Chainloop

    Vulnerability Management in Chainloop works by attesting a vulnerability report via a workflow. A policy then converts this report into findings, which are displayed in the Security tab. This tab provides a centralized view of deduplicated findings, components, artifacts, risk assessments, VEX feeds, and PDF reports.

  9. Overview of Artifact Deployment Tracking

    Artifact Deployment Tracking allows you to record which artifacts are running in specific Environments and Logical Environments. This creates a live view of software distribution across an organization. Because deployment records are linked to the Chainloop evidence store, users can trace running artifacts back to the Workflows that built them, their associated Projects and Versions, and the Attestations capturing their provenance.

  10. Overview of Chainloop WASM Policy Engine

    Chainloop offers an experimental WASM policy engine as an alternative to the default Rego-based engine. It currently supports policies written in Go and JavaScript. Because it is in experimental preview, APIs may change in future releases.

  11. Overview of SCM Protection Policies

    SCM Protection Policies allow users of the Chainloop CLI Enterprise Edition to define and verify security configurations and best practices within their CI/CD environment. This feature is exclusively available on Chainloop's platform paid plans. Most policies rely on extended runner context data to evaluate the state of the SCM.

  12. Overview of EU Cyber Resilience Act (CRA) compliance for software producers

    The EU Cyber Resilience Act (Regulation (EU) 2024/2847) requires software producers to ensure cybersecurity throughout the product lifecycle, from design and development to post-market activities. Key obligations for producers include:

    • Integrating security measures based on risk assessments (Annex I, Part I).
    • Addressing vulnerabilities and providing timely security updates (Annex I, Part II).
    • Reporting actively exploited vulnerabilities and significant incidents to ENISA (Article 14).
    • Communicating cybersecurity features, update policies, and support periods to users (Annex II).
    • Maintaining up-to-date technical documentation (Article 31 and Annex VII).
    • Affixing the CE marking (Article 19) and issuing a written EU Declaration of Conformity (Article 20 and Annex VI), which must be retained for 10 years or the support period, whichever is longer.