API

Public API

The production API origin for SDKs and public verification is https://verify.attesto.eu. Tenant browser workflows live on https://dashboard.attesto.eu.

Choose the right API family

Attesto has multiple public surfaces because evidence work happens in different places. Use the SDK/API from your server to create evidence, webhooks to receive lifecycle notifications, connectors to capture source-system observations, and verifier endpoints when another system needs to check evidence before trusting it.

Origins

Authentication

Server-side event ingest uses a tenant system key in the Authorization: Bearer header. Public verification routes validate supplied proof objects and do not require tenant cookies. Tenant dashboard routes use the existing secure browser session plus CSRF recovery for mutating requests. Do not put system keys or SSO client secrets in frontend bundles.

curl -X POST https://verify.attesto.eu/v1/sdk/events \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $ATTESTO_IDEMPOTENCY_KEY" \
  --data-binary @event.json

Email-first authentication routes

Main tenant users sign in through email discovery on dashboard.attesto.eu. Attesto returns one recommended next step instead of showing every provider at once. Marketplace developer accounts, admin staff auth, and auditor auth remain separate surfaces.

See Tenant SSO for the Entra ID, generic OIDC, and SAML setup guide.

Source time and timezone policy

Attesto records when the source system says an event happened and when Attesto received it. Event APIs require timezone-aware timestamps such as 2026-06-07T12:00:00+02:00 or 2026-06-07T10:00:00Z. Tenant timezone is configurable; systems inherit the tenant timezone by default and can set their own source_timezone when the connected source runs in another jurisdiction.

Idempotency and replay behavior

Write routes accept Idempotency-Key. Repeating the same key with the same canonical request returns the original result. Repeating the same key with a different request fails as a conflict. This protects connector retries and server-side job retries from creating duplicate evidence.

v1 event ingest

Use v1 when you need the stable event audit trail and anchoring path. SDKs set defaults for event type, status, retries, and idempotency.

• POST /v1/sdk/events logs one event.
• POST /v1/sdk/events/batch logs up to 1000 events.
• GET /v1/events/{eventId}/proof returns anchored proof material for an event.
• POST /v1/public/verify verifies a v1 proof object.
• POST /v1/exports/{exportId}/truth-package/verify records a backend-validated truth_package.verified event after a verifier report proves the exported package was cryptographically checked.

Tenant dashboard v1 APIs

These browser APIs power dashboard.attesto.eu. Mutating calls use tenant session cookies and CSRF recovery. Use system keys and SDK routes for server-side ingest; use these routes for tenant operators managing their workspace.

Minimal event body:

{
  "type": "ai.decision",
  "status": "verified",
  "occurred_at": "2026-06-07T12:00:00Z",
  "source_ref": "case-2026-0001",
  "payload": {
    "model": "risk-classifier-v4",
    "decision": "manual_review",
    "policy_id": "policy-2026-01"
  }
}

v2 Proofstream

Proofstream adds append-only streams, signed receipts, windows, checkpoints, witness evidence, anchors, bundles, and offline verification.

• POST /v2/streams creates a stream.
• POST /v2/streams/{streamId}/events appends one event and returns a signed receipt.
• POST /v2/streams/{streamId}/events/batch appends multiple events with receipt results.
• GET /v2/streams/{streamId}/head returns the current append-only stream head.
• GET /v2/receipts/{eventId} returns the stored receipt.
• POST /v2/verify/receipt verifies one receipt object directly.
• GET /v2/windows/{windowId} returns window evidence and inclusion material.
• GET /v2/checkpoints/{checkpointId} returns checkpoint evidence.
• GET /v2/checkpoints/{checkpointId}/consistency?from=... returns consistency evidence.
• GET /v2/witness/policies/{policyId} returns the witness policy used for quorum checks.
• GET /v2/anchors/{anchorEpochId} returns anchor epoch evidence.
• GET /v2/ivc/epochs/{ivcEpochId} returns Proof of Evolution epoch evidence.
• POST /v2/audit/packs creates an offline verifier bundle when the range has the required witness and anchor evidence.
• POST /v2/verify verifies receipt, stream, checkpoint, consistency, anchor, IVC, or bundle objects.

Create a stream:

curl -X POST https://verify.attesto.eu/v2/streams \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @- <<JSON
{
  "system_id": "sys_...",
  "use_case": "ai-decision-history",
  "policy_id": "policy-2026-01",
  "metadata": {
    "owner": "risk-platform",
    "environment": "production"
  }
}
JSON

Append an event:

curl -X POST https://verify.attesto.eu/v2/streams/$STREAM_ID/events \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Idempotency-Key: $ATTESTO_IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @- <<JSON
{
  "source_ref": "case-2026-0001:decision-1",
  "event_type": "ai.decision",
  "occurred_at": "2026-06-07T12:00:00+02:00",
  "payload": {
    "decision": "manual_review",
    "score": 91,
    "policy_id": "policy-2026-01"
  }
}
JSON

Receipt response shape:

{
  "stream_event_id": "sev_...",
  "stream_id": "str_...",
  "seq_no": 1,
  "event_hash": "sha256-hex",
  "stream_head_hash": "sha256-hex",
  "receipt": {
    "protocol": "ATTESTO-PROOFSTREAM-001",
    "alg": "Ed25519",
    "kid": "proofstream-receipt-key",
    "signature": "hex-encoded-signature"
  }
}

Tenant Proofstream and dashboard APIs

Tenant browser APIs expose the same evidence model inside the dashboard without requiring frontend access to server-side system keys. Mutating dashboard calls use browser cookies and CSRF recovery.

Tenant settings and SSO APIs

Tenant settings are only available to authenticated tenant users with the required role. Provider secrets are encrypted server-side and are never returned to the browser after save.

Connector and Local Vault APIs

Connectors are production evidence sources. Tenant users configure connector records in the dashboard, while source systems post events through provider-specific signed envelopes or Local Vault relay. Every connector event must include source system, source object, source event type, source timestamp with timezone, idempotency reference, and a normalized payload commitment.

Provenance APIs (Attesto 3)

The provenance lane is live on https://verify.attesto.eu. A provenance-class stream receives commitment-only envelopes from a Local Vault in provenance mode: randomized commitments, proof material and allowlisted public metadata. Raw content, prompts, file names and provider output never reach the platform, and there is no API to retrieve a capsule because Attesto does not hold one. Routes answer 404 on a deployment whose provenance lane is disabled; errors carry a {"code", "message"} detail.

Create a provenance stream:

curl -X POST https://verify.attesto.eu/v2/provenance/streams \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @- <<JSON
{
  "useCase": "ai-image-provenance",
  "policyId": "policy-2026-01"
}
JSON

Rollout state: Phase A of the controlled rollout ran on production on 2026-08-23 with a first-party tenant, and the lane-based rollback was rehearsed against production; Phases B to D have not started. The offline verifiers for disclosures, bundle provenance, key revocation and effective assurance are documented in the SDK guide; the vault side is in the Local Vault guide.

Marketplace APIs

Marketplace APIs power marketplace.attesto.eu. The public catalog is read-only. Tenant acquisition, installation, artifact download, and revocation require an authenticated tenant session plus CSRF. Publisher signup, profile management, developer checkout, payout onboarding, and asset submission use a separate marketplace-only developer account. Public docs intentionally omit private Attesto review and publication endpoints.

Public status API

status.attesto.eu exposes customer-safe health for public services. It includes component status, latency, uptime bars, incident summaries, generated time, and timezone metadata. It does not expose private admin status, tenant identifiers, logs, secrets, provider payloads, or raw database details.

• GET https://status.attesto.eu/health returns status-service health.
• GET https://status.attesto.eu/api/status returns the public status payload used by the page.
• GET https://status.attesto.eu/v1/status is the versioned status payload alias.

See Public status page for the public visibility model and component list.

Verification behavior

Verification fails closed on malformed objects, changed payloads, changed sequence numbers, removed or inserted events, stale checkpoints, wrong witness signatures, wrong anchors, and ambiguous fork evidence.

Truth Package downloads and verification are separate lifecycle events. A download records truth_package.accessed, proving that the package was served. A successful verifier report submitted to /v1/exports/{exportId}/truth-package/verify records truth_package.verified, proving that a verifier checked the package hash, manifest hash, and included artifacts. The final ZIP hash is recorded after the ZIP bytes are finalized and is not embedded back into the same ZIP; that avoids circular self-reference while keeping the downloadable bytes independently hashable.

curl -X POST https://dashboard.attesto.eu/v1/exports/$EXPORT_ID/truth-package/verify \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @truth-package-verification-report.json

curl -X POST https://verify.attesto.eu/v2/verify \
  -H "Content-Type: application/json" \
  --data-binary @attesto-bundle.json

Error semantics