Get Evidence

Description: Returns the requested data for a single, known evidence file as defined by the One Model GraphQL query. Use the getEvidence query when you know the exact location of the evidence file you want to retrieve. This is useful for fetching the details of a specific attestation after you have identified it.

evidence:
  enabled: true

Since: 7.104.2

Security: Requires a valid token; requires Read permissions to the subject repository

Usage: POST /onemodel/api/v1/graphql

Sample query:

query {
  evidence {
    getEvidence(
      repositoryKey: "my-repo-key"
      path: "path/to/artifact/artifact-name.zip"
      name: "security-scan.json"
    ) {
      # Fields to retrieve
      predicateType
      verified
      predicate
    }
  }
}

Detailed Object Types

The object types that you include in the search query determine which data is returned about the evidence file.

Evidence Type

This type represents a single evidence record.

EvidenceSubject Type

This type describes the artifact or build that represents the evidence subject.

EvidenceSigningKey Type

This type represents the key used to sign the evidence.

Status Codes:

Use Cases and Examples

The following examples demonstrate how to use the Get Evidence API effectively.

Example 1: Retrieve the full predicate

This query uses getEvidence to retrieve the predicate JSON so that you can inspect the contents of the specified evidence record.

Query:

query GetEvidencePredicate {
  evidence {
    getEvidence(
      repositoryKey: "generic-local"
      path: ".evidence/path/to/my-artifact.zip/security-scan-123.json"
      name: "security-scan-123.json"
    ) {
      predicateType
      predicate # <-- This contains the full JSON payload
    }
  }
}

cURL Request:

curl -X POST -H "Authorization: Bearer <YOUR_TOKEN>" -H "Content-Type: application/json" \
https://<YOUR_JFROG_URL>/onemodel/api/v1/graphql \
--data '{
    "query": "query GetEvidencePredicate { evidence { getEvidence(repositoryKey: \"generic-local\", path: \".evidence/path/to/my-artifact.zip/security-scan-123.json\", name: \"security-scan-123.json\") { predicateType predicate } } }"
}'

Sample Response:

{
    "data": {
        "evidence": {
            "getEvidence": {
                "predicateType": "https://jfrog.com/evidence/security/scan/v1",
                "predicate": {
                    "scanner": {
                        "name": "JFrog Xray",
                        "version": "4.2.0"
                    },
                    "summary": {
                        "critical": 5,
                        "high": 12,
                        "medium": 3,
                        "low": 0
                    },
                    "issues": [
                        {
                            "cve": "CVE-2023-12345",
                            "severity": "Critical",
                            "component": "log4j:log4j:1.2.17"
                        }
                    ]
                }
            }
        }
    }
}

Example 2: Get evidence and verify signing information

This example fetches a specific evidence record and its signing key details. In a real-world script, you would use the returned publicKey to programmatically verify the evidence signature, which is downloaded separately.

query GetAndVerifySignature {
  evidence {
    getEvidence(
      repositoryKey: "generic-local"
      path: ".evidence/path/to/my-artifact.zip/sbom-456.json"
      name: "sbom-456.json"
    ) {
      name
      verified # <-- Check if JFrog has already verified it
      signingKey {
        alias
        publicKey # <-- Use this key for external verification
      }
    }
  }
}