Developer Documentation
Build with Attesto APIs, SDKs and verifier tools.
docs.attesto.eu is the developer portal for SDK/API/connectors, Proofstream, offline verification, MCP, Gateway, OTel, n8n, Local Vault, webhooks, and verifier workflows.
Looking for dashboard instructions, billing, tenant SSO, audit portal workflows, or end-user guides? Use manual.attesto.eu. Admin control-plane procedures and private operations remain unpublished.
Find the right guide
Search by task, surface, or integration. Results stay local to this static site.
Choose Your Path
Filter guides by the way you want to adopt Attesto.
Showing all guides.
5 Minute Quickstart
Log a first event, inspect the receipt, and verify it from production API defaults.
Implementation recipes
Choose the right path for SDKs, API, Proofstream, webhooks, connectors, Local Vault, and verifier workflows.
Proofstream and fork defense
Understand streams, windows, checkpoints, witness quorum, fork evidence, and bundles.
Lifecycle readiness
Use canaries, assurance reports, readiness gates, and production evidence without exposing admin runbooks.
Evidence support maps
Map Attesto evidence to AI Act, NIS2, CRA, ISO 27001, SOC 2, and eIDAS support areas.
Nova and Proof of Evolution
Review the IVC lane, state roots, claim boundaries, and external crypto review posture.
Getting Started
What is Attesto?
Evidence streams, verifier-first compliance, trust boundaries, and what Attesto does not claim.
Why Attesto exists
Learn why AI and compliance teams need evidence streams that are independently verifiable.
5 Minute Quickstart
Move from tenant login to a server-side event and a verified receipt.
Tenant SSO and Identity Discovery
Understand email-first login, organization SSO, invite activation, and safe provider setup.
Get started
Register a system, reveal the system key once, log an event, and verify the first receipt.
Build the integration
Server-side events, streams, bundles, webhook receivers, connector sources, and production rollout steps.
Glossary
Evidence stream, receipt, window, checkpoint, witness, quorum, fork evidence, anchor, and bundle.
Attesto 1.0: Evidence Primitives
Events, receipts, anchors
Use the stable control plane for event capture, receipts, verification, anchoring, exports, and auditors.
Events
What to log, how idempotency works, and how event payloads should be shaped.
Receipts
Signed event acknowledgements and the first verification layer.
Verification
How v1 proofs are checked and where v1 verification differs from Proofstream.
Anchoring
How batch commitments are externally anchored and exposed in evidence exports.
Attesto 2.0: Proofstream
Proofstream lifecycle
Understand event -> receipt -> window -> checkpoint -> witness -> anchor -> bundle -> offline verify.
Windows
Closed event ranges, inclusion proofs, and window commitments.
Checkpoints
Stream-head commitments, consistency, and checkpoint history.
Consistency
Why inclusion alone is not enough and how stale or rewritten history is rejected.
Bundles
Portable verifier packs with receipts, windows, checkpoints, witness statements, and anchors.
Witness Plane
Witness Plane
Independent checkpoint witnesses, signed statements, policy, and fork detection.
Witnesses
Attesto-operated, customer-operated, assurance, and partner witness roles.
Quorum
How 1-of-1 and 2-of-3 policies change what a verifier can rely on.
Fork evidence
How conflicting histories become machine-readable evidence instead of hidden disagreement.
Verifier System
Verifier-first evidence
How external parties verify receipts, bundles, witnesses, anchors, and fork evidence independently.
Service status
Check customer-facing health, latency, incidents, and 90-day uptime bars without exposing tenant data.
Offline verifier
Run local checks without backend access and inspect deterministic verification reports.
Verifier matrix
What changes are detected: payload, sequence, deletion, insertion, stale checkpoint, signature, anchor.
Trust boundaries
What Attesto proves, what remains the customer responsibility, and where external review applies.
ISO/IEC 27001 readiness
How Attesto manages scope, risk, assets, suppliers, incidents, internal review, and audit evidence.
ISO, SOC 2, eIDAS preparation
How Attesto prepares for ISO 27001, SOC 2 Type II, ISO 27701, Cyber Essentials Plus, NEN 7510, ENSIA/BIO, and eIDAS 2.0 alignment.
Failure modes
What to do when verification fails, quorum is missing, fork evidence appears, or a bundle is incomplete.
Local Vault, APIs, SDKs, and Connectors
Python, TypeScript, Go, and CLI
Use production defaults, idempotency, retries, offline verifier helpers, and server-side key handling across all four public developer surfaces. Release family 0.5.0.
Provenance verification
Verify disclosure presentations, bundle provenance inclusion, key revocation and effective assurance offline in Python, TypeScript and Go, with the non-claims every report carries.
Public API
Authentication, idempotency, v1 event ingest, v2 Proofstream endpoints, Attesto 3 provenance routes, and verifier responses.
Gateway, MCP, OTel, and n8n
Use production evidence surfaces for model proxying, agent tools, observability traces, and workflow automation.
Implementation recipes
Use the right API, SDK, webhook, connector, Local Vault, or verifier pattern for your evidence workflow.
Relay, spool, witness, provenance
Outbound-only relay, encrypted spooling, online/offline behavior, customer witness mode, and Local Vault 2.x provenance mode with its L0 to L3 assurance ladder.
AttestoMark Image
Keyed image marking and detection inside the Local Vault, with the measured robustness corpus and what a detection does not establish.
AttestoMark Audio
Keyed audio marking over FFT bands, measured against codec conversion, resampling and normalisation — and against the attacks that remove it.
AttestoMark Video
Frame-burst marking composed from the image provider, and why no temporal attack removes it.
Production connectors
Signed webhook, repository webhook, and S3/R2 object commitment connector contracts.
Connector marketplace
Browse validated connector manifests, acquire and install with a tenant session, and publish first-party assets through validation.
Tenant webhooks
Signed lifecycle delivery, retry behavior, and dedupe guidance for your endpoint.
Tenant operator UI
Use dashboard.attesto.eu for systems, streams, exports, billing, and evidence review.
Proof of Evolution
Nova, IVC, state roots
Understand the async lifecycle proof lane, evolution chain, and review-gated claim boundaries.
Nova and IVC
How lifecycle proofing is designed on top of committed checkpoint metadata.
State roots
Previous root, checkpoint root, policy digest, incident state, and next root.
Claim boundaries
What is proven today, what is production evidence, and what stays review-gated.
Regulatory Evidence
AI Act, NIS2, CRA, SOC 2
Map Attesto evidence packs to compliance-support areas without claiming legal certification.
Control mapping method
How evidence packs support control work while legal compliance remains the customer responsibility.
EU AI Act support
Logging, traceability, technical documentation, monitoring, and incident evidence.
NIS2 and CRA support
Cybersecurity evidence, supply-chain assurance, vulnerability handling, and secure update support.
ISO 27001, SOC 2, eIDAS
Logging, access control, processing integrity, timestamps, ledger integrity, and non-repudiation support.
Security management
Attesto's own audit-readiness operating model for security governance and evidence review.
Operators and Production
Readiness and assurance
Lifecycle readiness, assurance reports, production evidence health, and what green means.
Canaries
Lifecycle, fork defense, quorum, connector, Local Vault, multi-tenant witness, and Nova evidence canaries.
Readiness
How to read production readiness, assurance, and release evidence reports.
Public operator runbooks
Tenant-facing response guidance without exposing internal control-plane operations.
Changelog
Track user-facing documentation, SDK, API, connector, verifier, and Proofstream changes.
Languages
Public documentation is maintained in English, Dutch, German, French, Spanish, Polish, and Italian. English is the canonical developer contract; translated guides keep the same API names and production endpoints so code stays unambiguous.