{"uid":"cap_H5jWOW1x8OURt5syuViRu","slug":"sigstore-rekor-provenance-verifier-a513873f","name":"Sigstore Rekor Provenance Verifier","description":"Searches the Sigstore Rekor log for entries matching an artefact hash and returns what a provenance claim is actually worth: the log index and inclusion time, the signing identity from the certificate, and where available the source repository and workflow reference that produced it. Several entries for one hash are all returned, because a rebuild or a second signer is a fact worth seeing rather than collapsing.","url":"https://sicher.halowerk.com/v1/provenance-verify?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"email":{"type":"string","maxLength":200,"description":"Search by signer email instead of by hash."},"limit":{"type":"integer","default":5,"maximum":20,"minimum":1,"description":"How many entries to detail."},"sha256":{"type":"string","maxLength":71,"minLength":64,"description":"Artefact SHA-256, with or without the sha256: prefix."},"log_index":{"type":"integer","minimum":0,"description":"Fetch one specific log entry instead of searching."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_aQLekF61XtdvfGPIQbynP","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Searches the Sigstore Rekor transparency log for entries matching an artifact hash and returns signing identity, inclusion time, source repository, and workflow provenance for all matching entries.","exampleAgentPrompt":"Can you check the Sigstore Rekor log for this artifact hash sha256:abc123def456... and tell me who signed it, when it was included, and which GitHub Actions workflow produced it?","exampleUseCases":[{"title":"CI pipeline artifact verification","prompt":"We just pulled a binary from our release bucket with hash sha256:deadbeef1234abcd — can you check the Rekor transparency log and confirm it was signed by our GitHub Actions workflow and when it was included?"},{"title":"Third-party dependency audit","prompt":"I have this npm package tarball with SHA-256 hash sha256:f00ba4cafe9876 — look it up in the Sigstore Rekor log and tell me who signed it, what repository it came from, and whether there are multiple signers I should know about."},{"title":"Suspicious rebuild detection","prompt":"Check the Rekor log for artifact hash sha256:1a2b3c4d5e6f7890 — I want to see if there are multiple entries, which would mean it was signed more than once or rebuilt, and get the full signing details for each entry."}],"resultDescription":"Returns one or more Rekor log entries matching the artifact hash, each containing: the log index, the UTC inclusion timestamp, the signing certificate identity (subject, issuer), and where available the source repository URL and workflow/job reference that produced the artifact. Multiple entries are returned if the artifact was signed by more than one identity or rebuilt.","failureModes":["Hash not found in Rekor log — no entries returned, artifact may be unsigned or hash incorrect","Malformed hash input — 400 error if hash is not a valid SHA-256 or supported digest format","Rekor API unavailable — upstream timeout or 5xx if Sigstore infrastructure is unreachable","Partial provenance — entry exists but certificate lacks source repository or workflow fields (older signers or keyless vs key-based signing)","Rate limiting — repeated rapid calls may be throttled by upstream Rekor API"],"whenToPreferThis":"Choose this endpoint when you need to verify software supply chain provenance against the Sigstore Rekor public transparency log — especially for SLSA compliance checks, CI/CD artifact auditing, or confirming that a binary matches a known signed build. Prefer this over generic hash lookups when you need signing identity and workflow attribution, not just malware detection. It is particularly valuable when multiple signers or rebuilds are possible and you need to see all entries rather than just one.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T06:35:40.086Z","isFirstParty":false,"canonicalSlug":"sigstore-rekor-provenance-verifier-a513873f"}