GET/provider-submissions/{submission_id}

Get a provider submission

get_provider_submission

provider_publishing:read
A token needs the provider_publishing:read scope: View provider submissionsGranted by read_api, write_api.Every operation this scope unlocks

The submission's state, its manifest, who submitted it and when, the outcome of the checks on its images, and the reviewer's decision and notes once it has been reviewed. Only the publisher that made it and platform administrators may read it.

Parameters

Path

submission_idProviderSubmissionId (string · uuid)Submission id

Responses

200application/json

auth_schemaobject
manifestProviderVersionManifestThe provider version as submitted. Image locations and digests, signing and lifecycle are filled in by the platform when the version is published.
- The ProviderVersionManifest schema
- capabilitiesarray of CapabilityDescriptor
  - The CapabilityDescriptor schema
  - cache_enabledboolean
  - capability_idCapabilityId (string)
  - config_schemaobjectThe JSON Schema a step's config must satisfy to use this capability.
  - default_timeout_secondsinteger · int320–∞
  - descriptionstring
  - image_uristringThe container image that runs the capability, with an immutable version tag.
  - inputsarray of PortDescriptor
  - namestring
  - outputsarray of PortDescriptor
  - requires_dockerboolean
  - stage_typeStageTypesourcebuildtestpublishdeploynotifycustomThe pipeline stage a capability belongs to. Maps verbatim to the stage_type field of a capability in gitmoap-provider.yaml.
  - bindablearray of PortName (string)optionalConfig keys that can take their value from an earlier step. Each has an optional value input port of the same name: connect it and read it with {"$from": "<key>"}, or leave it unconnected and write the value yourself.
  - image_digeststring or nulloptionalThe exact build of the capability's container image, when the catalog records one. Pinned so a run cannot pick up a different build behind the same tag.
  - input_groupsarray of PortGroupoptionalRules about which inputs are alternatives to each other. Empty for most capabilities.
  - source_image_refstring or nulloptionalFor a verified provider, the image's location in its publisher's registry before gitmoap copied it. Absent for providers gitmoap builds itself.
- contract_versioninteger · int320–∞
- manifest_digeststringThe SHA-256 digest of the version's gitmoap-provider.yaml. May be empty.
- provider_idProviderId (string)
- published_atstring
- published_bystring"platform" for platform-authored providers; a publisher id otherwise.
- versionProviderVersion (string)
- changelogMarkdownDoc (string) or nulloptionalThe version's release notes, in Markdown, up to 64 KB. They cannot be changed once published. Absent when the version has none.
- cosign_signature_refstring or nulloptionalWhere the cosign signature is stored in the registry, when the images are signed.
- lifecycle_stateVersionLifecycleactivedeprecatedsunsetoptionalWhere the version is in its life: active, deprecated or sunset. Checked whenever a run starts.
- signedbooleanoptionalWhether the version's images are signed with gitmoap's cosign key, as verified and platform providers' are.
- sunset_atstring or nulloptionalWhen the version was sunset. Set only for a sunset version.
- sunset_enforced_atstring or nulloptionalWhen the sunset's grace period ends. After it, a run that uses the version fails to start.
manifest_digeststring
provider_descriptionstring
provider_idProviderId (string)
provider_namestringThe provider's name, as the catalog shows it.
publisher_idPublisherId (string · uuid)
source_image_refsobjectEach capability's image in your registry, by capability id.
stateSubmissionStatesubmittedin_reviewchanges_requestedapprovedmirroringsigningpublishedrejectedmirror_failedwithdrawnverifyingverification_failedWhere a provider submission stands, from review through to publication or refusal.
submission_idProviderSubmissionId (string · uuid)
submitted_atstring
submitted_byActorSummaryWho submitted the version.
- The ActorSummary schema
- emailstring
- idstring
- usernamestring
- avatar_urlstring or nulloptional
target_tierProviderTierplatformverifiedcommunityprivateThe tier the version was submitted for: verified goes to review by gitmoap; community and private are checked automatically, without review.
versionProviderVersion (string)
attest_resultAttestResult or nulloptionalThe result of checking a community or private provider's images.
- The AttestResult schema
- attested_atstring
- capabilitiesobject
mirror_resultMirrorResult or nulloptional
- The MirrorResult schema
- capabilitiesobject
- mirrored_atstring
- sbom_refstring or nulloptional
owning_group_idGroupId (string · uuid) or nulloptionalThe organization the provider is private to. Set only when target_tier is private.
published_atstring or nulloptional
registry_pull_secret_refSsmParameterPath (string) or nulloptionalA reference to the stored credential for pulling images from a private registry, for a private provider that uses one. Never the credential itself.
review_notesstring or nulloptional
reviewed_atstring or nulloptional
reviewerActorSummary or nulloptionalThe gitmoap administrator who reviewed the submission, once reviewed.
- The ActorSummary schema
- emailstring
- idstring
- usernamestring
- avatar_urlstring or nulloptional

200 exampleSynthesized example

400Bad request — a path parameter is not a well-formed value of its typeapplication/json

Error codes

BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

400 exampleSynthesized example

401application/json

Error codes

UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

401 exampleSynthesized example

403application/json

Error codes

FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

403 exampleSynthesized example

404application/json

Error codes

NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

404 exampleSynthesized example

CLI

gitmoap provider-publishing get

--submission-ididSubmission id

Used in these guides

Publishing a provider

Request

curl "https://api.gitmoap.com/provider-submissions/" \
  -H "Authorization: Bearer $GITMOAP_TOKEN"

gitmoap provider-publishing get \
  --submission-id

import { createApiClient } from "@gitmoap/backend-types";

const client = createApiClient({
  baseUrl: "https://api.gitmoap.com",
  headers: { Authorization: `Bearer ${process.env.GITMOAP_TOKEN}` },
});

const { data, error } = await client.GET("/provider-submissions/{submission_id}", {
  params: {
    path: { submission_id: "" },
  },
});

GET /provider-submissions/ HTTP/1.1
Host: api.gitmoap.com
Authorization: Bearer $GITMOAP_TOKEN

⌘↵

Send to see the sandbox's answer. Nothing leaves your browser.