{"openapi":"3.1.0","info":{"title":"GitHub Supply Chain (BYOK) API","version":"0.1.0","description":"GitHub Supply Chain (BYOK) lets an AI assistant read your own GitHub Supply Chain data through the GitHub Supply Chain API with a key you supply (personal access token). Read-only: 7 tools (list_attestation_repositories, list_org_attestations, list_repo_attestations, list_artifact_storage_records, list_artifact_deployment_records, get_immutable_releases_settings,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-github-supply-chain.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-github-supply-chain/docs"},"termsOfService":"https://connectorbay.com/byok-github-supply-chain/terms"},"servers":[{"url":"https://byok-github-supply-chain.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-github-supply-chain/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_attestation_repositories":{"post":{"operationId":"list_attestation_repositories","summary":"List the repositories of an organization that have artifact attestations, optionally for one predicate type. Use for \"Wh","description":"List the repositories of an organization that have artifact attestations, optionally for one predicate type. Use for \"Which octo-org repositories publish artifact attestations\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Organization login, for example 'octo-org'.","maxLength":200,"title":"Org","type":"string"},"predicate_type":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only attestations of this predicate type: provenance, sbom, release, or a custom type name.","title":"Predicate Type"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":30,"description":"How many items to return (1 to 100).","title":"Per Page"},"before":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Cursor from the previous response's Link header to page backwards.","title":"Before"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Cursor from the previous response's Link header to page forwards.","title":"After"}},"required":["org"],"title":"list_attestation_repositoriesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_org_attestations":{"post":{"operationId":"list_org_attestations","summary":"List an organization's attestations for one artifact digest (bundle contents are not returned; only the repository, bund","description":"List an organization's attestations for one artifact digest (bundle contents are not returned; only the repository, bundle URL and initiator). Use for \"Which attestations exist for this image digest in octo-org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Organization login, for example 'octo-org'.","maxLength":200,"title":"Org","type":"string"},"subject_digest":{"description":"Artifact digest in the form 'sha256:' followed by the hex digest, for example from a container image or release asset.","maxLength":100,"title":"Subject Digest","type":"string"},"predicate_type":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only attestations of this predicate type: provenance, sbom, release, or a custom type name.","title":"Predicate Type"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":30,"description":"How many items to return (1 to 100).","title":"Per Page"},"before":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Cursor from the previous response's Link header to page backwards.","title":"Before"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Cursor from the previous response's Link header to page forwards.","title":"After"}},"required":["org","subject_digest"],"title":"list_org_attestationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_repo_attestations":{"post":{"operationId":"list_repo_attestations","summary":"List a repository's attestations for one artifact digest (bundle contents are not returned). Use for \"Which attestations","description":"List a repository's attestations for one artifact digest (bundle contents are not returned). Use for \"Which attestations does octocat/Hello-World have for this digest\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"owner":{"description":"Account that owns the repository (user or organization login), for example 'octocat'.","maxLength":200,"title":"Owner","type":"string"},"repo":{"description":"Repository name without the owner, for example 'Hello-World'.","maxLength":200,"title":"Repo","type":"string"},"subject_digest":{"description":"Artifact digest in the form 'sha256:' followed by the hex digest, for example from a container image or release asset.","maxLength":100,"title":"Subject Digest","type":"string"},"predicate_type":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only attestations of this predicate type: provenance, sbom, release, or a custom type name.","title":"Predicate Type"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":30,"description":"How many items to return (1 to 100).","title":"Per Page"},"before":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Cursor from the previous response's Link header to page backwards.","title":"Before"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Cursor from the previous response's Link header to page forwards.","title":"After"}},"required":["owner","repo","subject_digest"],"title":"list_repo_attestationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_artifact_storage_records":{"post":{"operationId":"list_artifact_storage_records","summary":"List where an artifact digest is stored (registry, repository, status) according to the organization's artifact metadata","description":"List where an artifact digest is stored (registry, repository, status) according to the organization's artifact metadata. Use for \"Where is this container image digest stored for octo-org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Organization login, for example 'octo-org'.","maxLength":200,"title":"Org","type":"string"},"subject_digest":{"description":"Artifact digest in the form 'sha256:' followed by the hex digest, for example from a container image or release asset.","maxLength":100,"title":"Subject Digest","type":"string"}},"required":["org","subject_digest"],"title":"list_artifact_storage_recordsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_artifact_deployment_records":{"post":{"operationId":"list_artifact_deployment_records","summary":"List where an artifact digest is deployed (environment, cluster, deployment name, runtime risks) according to the organi","description":"List where an artifact digest is deployed (environment, cluster, deployment name, runtime risks) according to the organization's artifact metadata. Use for \"Where is this image digest deployed for octo-org and does it carry runtime risks\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Organization login, for example 'octo-org'.","maxLength":200,"title":"Org","type":"string"},"subject_digest":{"description":"Artifact digest in the form 'sha256:' followed by the hex digest, for example from a container image or release asset.","maxLength":100,"title":"Subject Digest","type":"string"}},"required":["org","subject_digest"],"title":"list_artifact_deployment_recordsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_immutable_releases_settings":{"post":{"operationId":"get_immutable_releases_settings","summary":"Get whether an organization enforces immutable releases and for which repositories. Use for \"Does octo-org enforce immut","description":"Get whether an organization enforces immutable releases and for which repositories. Use for \"Does octo-org enforce immutable releases\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Organization login, for example 'octo-org'.","maxLength":200,"title":"Org","type":"string"}},"required":["org"],"title":"get_immutable_releases_settingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_immutable_releases_repositories":{"post":{"operationId":"list_immutable_releases_repositories","summary":"List the repositories selected for immutable releases enforcement in an organization. Use for \"Which octo-org repositori","description":"List the repositories selected for immutable releases enforcement in an organization. Use for \"Which octo-org repositories enforce immutable releases\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Organization login, for example 'octo-org'.","maxLength":200,"title":"Org","type":"string"},"page":{"anyOf":[{"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":30,"description":"How many items to return (1 to 100).","title":"Per Page"}},"required":["org"],"title":"list_immutable_releases_repositoriesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}