API

Public API

The production API origin for SDKs and public verification is https://verify.attesto.eu. Tenant browser workflows live on https://dashboard.attesto.eu.

Origins

Authentication

Server-side event ingest uses a tenant system key in the Authorization: Bearer header. Public verification routes validate supplied proof objects and do not require tenant cookies.

curl -X POST https://verify.attesto.eu/v1/sdk/events \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $ATTESTO_IDEMPOTENCY_KEY" \
  --data-binary @event.json

Idempotency and replay behavior

Write routes accept Idempotency-Key. Repeating the same key with the same canonical request returns the original result. Repeating the same key with a different request fails as a conflict. This protects connector retries and server-side job retries from creating duplicate evidence.

v1 event ingest

Use v1 when you need the stable event audit trail and anchoring path. SDKs set defaults for event type, status, retries, and idempotency.

• POST /v1/sdk/events logs one event.
• POST /v1/sdk/events/batch logs up to 1000 events.
• GET /v1/events/{eventId}/proof returns anchored proof material for an event.
• POST /v1/public/verify verifies a v1 proof object.

Minimal event body:

{
  "type": "ai.decision",
  "status": "verified",
  "occurred_at": "2026-06-07T12:00:00Z",
  "source_ref": "case-2026-0001",
  "payload": {
    "model": "risk-classifier-v4",
    "decision": "manual_review",
    "policy_id": "policy-2026-01"
  }
}

v2 Proofstream

Proofstream adds append-only streams, signed receipts, windows, checkpoints, witness evidence, anchors, bundles, and offline verification.

• POST /v2/streams creates a stream.
• POST /v2/streams/{streamId}/events appends one event and returns a signed receipt.
• POST /v2/streams/{streamId}/events/batch appends multiple events with receipt results.
• GET /v2/receipts/{eventId} returns the stored receipt.
• GET /v2/windows/{windowId} returns window evidence and inclusion material.
• GET /v2/checkpoints/{checkpointId} returns checkpoint evidence.
• GET /v2/checkpoints/{checkpointId}/consistency?from=... returns consistency evidence.
• POST /v2/audit/packs creates an offline verifier bundle when the range has the required witness and anchor evidence.
• POST /v2/verify verifies receipt, stream, checkpoint, consistency, anchor, IVC, or bundle objects.

Create a stream:

curl -X POST https://verify.attesto.eu/v2/streams \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @- <<JSON
{
  "system_id": "sys_...",
  "use_case": "ai-decision-history",
  "policy_id": "policy-2026-01",
  "metadata": {
    "owner": "risk-platform",
    "environment": "production"
  }
}
JSON

Append an event:

curl -X POST https://verify.attesto.eu/v2/streams/$STREAM_ID/events \
  -H "Authorization: Bearer $ATTESTO_API_KEY" \
  -H "Idempotency-Key: $ATTESTO_IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @- <<JSON
{
  "source_ref": "case-2026-0001:decision-1",
  "event_type": "ai.decision",
  "payload": {
    "decision": "manual_review",
    "score": 91,
    "policy_id": "policy-2026-01"
  }
}
JSON

Receipt response shape:

{
  "stream_event_id": "sev_...",
  "stream_id": "str_...",
  "seq_no": 1,
  "event_hash": "sha256-hex",
  "stream_head_hash": "sha256-hex",
  "receipt": {
    "protocol": "ATTESTO-PROOFSTREAM-001",
    "alg": "Ed25519",
    "kid": "proofstream-receipt-key",
    "signature": "hex-encoded-signature"
  }
}

Verification behavior

Verification fails closed on malformed objects, changed payloads, changed sequence numbers, removed or inserted events, stale checkpoints, wrong witness signatures, wrong anchors, and ambiguous fork evidence.

curl -X POST https://verify.attesto.eu/v2/verify \
  -H "Content-Type: application/json" \
  --data-binary @attesto-bundle.json

Error semantics