DevGuard In-toto API
in-toto records what actually happened while your software was built. Every step in the pipeline emits a signed link describing its inputs and outputs, and a layout declares the sequence those steps were supposed to follow. Verification checks the links against the layout, which catches a build that skipped a step or ran somewhere it should not have.
This API covers all four parts of that loop: submitting a link as a pipeline step completes, fetching the root layout that defines the expected chain, downloading the collected links for one supply chain run, and verifying a supply chain end to end.
Most link creation happens automatically from CI through the DevGuard scanner, so these endpoints matter most when integrating a build system the scanner does not cover, or when verifying an artifact outside the pipeline that produced it.
Related Documentation
- in-toto Framework — the model these endpoints implement
- Supply Chain Security — a full walkthrough
- Supply Chain Verification — what verification proves
- Provenance Tracking — how build history is retained
- SLSA Framework — the levels this supports
- Attestations API — the related attestation surface
- Use the DevGuard API — authentication and conventions
- DevGuard API Reference