Docker Hub Pinned Tag Platform Digest Watch API

One modern Docker Hub namespace-scoped tag metadata request per exact public tag, at most five. Use a small base-image watchlist to observe manifest and platform descriptor changes. A row contains declared manifest digest and up to eighty sorted image descriptors (OS, architecture, variant, digest and size). Volatile last-pulled counters, user identities and descriptions are deliberately excluded from hashes. Unknown architecture descriptors are retained as unknown, including possible attestations: the Actor does not identify them as runnable platforms. No credentials/private repositories, registry blob pull, image download, signature verification, container execution, build or vulnerability scanning. The namespace/repository comes from the fixed request path; it is not an independently verified image origin. A metadata digest does not establish image trust or reproducible content. Shared-IP Hub API limits apply, and failures are not retried.

Input example

{
  "imageTags": [
    "library/python:3.13-slim",
    "library/python:3.12-slim"
  ],
  "maxResults": 2
}

Results, snapshots and coverage

Each saved observation is a dataset row with itemKey, contentHash, observedAt and sourceUrl. The hash covers selected semantic fields and excludes volatile retrieval times and request URLs. Copy SNAPSHOT.previousHashes into the next input to compare the same watchlist: NO_BASELINE, FIRST_SEEN, UNCHANGED or CHANGED. There is no automatic durable cross-run memory; only the baseline you provide is compared. Unchanged successful rows are still billed. Missing rows never prove deletions. OUTPUT reports rowsEmitted, actual requestCount, source coverage, errors and completion status. The snapshot complete flag is false when any source fails, a provider stops further requests, or the result/budget cap prevents completion.

Pricing and budget protection

Pay per event: $0.005 startup plus $0.001 per saved observation. Startup quantity follows Apify memory rules (minimum one). Default memory256 MB and timeout120 seconds. No browser, proxy, paid external API, credentials or account-wide permissions. The runtime checks the effective result budget before contacting sources and before saving rows; zero affordable rows causes no source work. Provider list limits are reduced to the remaining affordable capacity. The run has a90-second fetch deadline, two-MiB decoded-body limit, no network retries and no pagination. API rate403/429 or Retry-After stops additional sources. All-source failure exits with an error and a preserved OUTPUT; partial successful observations remain available. Public data or its upstream API may be free: the event fee pays for this bounded workflow, data selection, output validation, snapshots and Apify execution. It does not buy exclusive data or imply endorsement by the provider.

Access and limitations

Only constructed official HTTPS API endpoints are contacted. Arbitrary URLs, private addresses, cross-provider redirects and credential-bearing input are rejected. Provider rate limits and shared-IP quotas apply across runs; do not use parallel runs to defeat a provider limit. For large/bulk extraction use the provider's supported bulk service. This is selected metadata, not independent validation of every source declaration. No guarantee of source availability, completeness, commercial return or suitability for high-stakes decisions is made.

Official source documentation

• https://docs.docker.com/reference/api/hub/latest/