Where the data, the artifact, or the API description actually came from — who or what produced it, from which source, through which activity, and when. Provenance is the difference between an artifact being present and an artifact being trustworthy, and it is the property most often missing when an API description, a dataset, or a generated answer is reused downstream. Two distinct families are in play, and an API program usually needs both — data provenance, described by the W3C PROV family, and build or supply-chain provenance, described by in-toto, SLSA, and SPDX.

Also known as: Lineage, Data Provenance, Attestation, PROV, Chain of Custody

Example

- type: Provenance
  url: https://developers.example.com/provenance

Standards

• W3C Recommendation PROV-DM — The PROV Data Model
• W3C Recommendation PROV-O — The PROV Ontology
• W3C Recommendation PROV-N — The Provenance Notation
• W3C Note PROV Model Primer / Overview
• W3C Member Submission (not a Recommendation) PROV-JSONLD — A JSON-LD Representation for the PROV Data Model
• W3C Member Submission (not a Recommendation) PROV-JSON — A JSON Representation for PROV
• W3C Recommendation JSON-LD 1.1
• CNCF / Linux Foundation in-toto — supply chain attestation framework
• OpenSSF SLSA — Supply-chain Levels for Software Artifacts
• Linux Foundation / ISO 5962 SPDX — Software Package Data Exchange
• OpenSSF Sigstore
• C2PA / Linux Foundation C2PA — Content Credentials

Media Types

• application/ld+json — JSON-LD 1.1 — The serialization PROV-JSONLD rides on, so provenance can be processed as linked data.
• application/json — PROV-JSON — Plain-JSON PROV encoding for consumers that do not process linked data.
• text/provenance-notation — PROV-N — Human-readable PROV notation.

OpenAPI Expression

• info.x-provenance (Vendor extension) — No standard OpenAPI field carries provenance; providers commonly declare source and generator as an extension.
• info.description (OpenAPI 3.x) — Where hand-authored descriptions usually state whether the document was generated from code or written by hand.
• externalDocs (OpenAPI 3.x) — Can point at the provenance record or attestation for the description itself.

Link Relations

• via — RFC 8288 / IANA Link Relations
• describedby — IANA Link Relations
• canonical — RFC 6596

Governance Rules

• oas-info-contact (Spectral built-in) — An artifact with no accountable owner cannot carry credible provenance.
• oas-info-license (Spectral built-in) — License is the minimum provenance claim on a reusable description.
• oas3-server-not-example.com (Spectral built-in) — Placeholder servers are the clearest signal a description was scaffolded rather than derived from a running API.

Risk & Compliance

Compliance:

• EU AI Act Art. 10 — data governance and traceability of training data
• GDPR Art. 30 — records of processing activities
• US EO 14028 / NIST SP 800-218 (SSDF) — provenance and SBOM for software supply chains
• FDA / 21 CFR Part 11 — audit trails for regulated records
• SOC 2 CC7.2 — evidence that monitored artifacts are what they claim to be

Security: Provenance is what makes an artifact checkable rather than merely present. Without it, a scaffolded or fabricated OpenAPI is indistinguishable from one derived from a running API, an SBOM cannot be tied to the build that produced it, and a dataset cannot be traced to a source with a compatible license. Provenance records are also a disclosure surface in their own right — build hosts, internal repository paths, and contributor identities routinely leak through attestations. Publish provenance signed and scoped, verify signatures rather than trusting the presence of a record, and treat an unsigned attestation as an unverified claim.

Tools

• Sigstore cosign — Signing and verification (Apache-2.0)
• in-toto attestation framework — Supply-chain attestation (Apache-2.0)
• SLSA verifier — Build provenance verification
• SPDX tools — SBOM (Apache-2.0)

Suggested Metrics

• artifacts_with_provenance — Share of published artifacts (descriptions, datasets, packages) carrying a provenance record.
• provenance_verification_rate — Fraction of provenance records that verify against a signature rather than merely existing.
• source_traceable_fields — Share of fields in a published dataset traceable to a named originating source.
• unattested_dependency_count — Dependencies in the estate with no build attestation.

Example Implementations

• GitHub — Artifact attestations bind a build to its source and workflow, verifiable with the GitHub CLI.
• npm — Publishes signed provenance statements linking a package version to the repository and CI run that built it.

Related Properties

• Json ld
• Json ld context
• Interface license
• Governance rules
• Lifecycle
• Change log

Tags

• Provenance
• Trust
• Lineage
• Attestation

All Common Properties