Attesto

Connectors

Production connectors

Connectors commit external source evidence into Proofstream without exposing tenant sessions. Every connector has real authentication, replay handling, diagnostics, and revoke behavior.

Signed webhook connector

Use the signed webhook connector when an external source can POST a signed JSON body to Attesto. The source reference is the idempotency key inside the stream. 

POST /v2/connectors/signed-webhooks/{connectorId}/events
Content-Type: application/json
X-Attesto-Connector-Timestamp: <unix-seconds>
X-Attesto-Connector-Signature: <hex-hmac-sha256>
{
  "source_ref": "source-system-2026-0001",
  "event_type": "source.observation",
  "occurred_at": "2026-06-07T12:00:00Z",
  "payload": {
    "control": "policy-check",
    "result": "passed",
    "policy_id": "policy-2026-01"
  }
}

GitHub repository connector

The GitHub connector validates X-Hub-Signature-256 over the raw provider body and commits normalized repository-change metadata to the configured Proofstream. 

{
  "provider": "github",
  "event": "push",
  "repository": "owner/repository",
  "ref": "refs/heads/main",
  "before": "sha-before",
  "after": "sha-after",
  "delivery_id": "provider-delivery-id"
}

GitLab repository connector

The GitLab connector validates the configured signing token over the raw provider delivery. Existing installations can keep their legacy token mode until rotated. 

{
  "provider": "gitlab",
  "event": "push",
  "project_path": "group/project",
  "ref": "refs/heads/main",
  "before": "sha-before",
  "after": "sha-after",
  "delivery_id": "provider-delivery-id"
}

S3/R2 object commitment connector

Use object commitments when evidence already lives in AWS S3, Cloudflare R2, or an S3-compatible store. Attesto performs a real HeadObject call, receipts object identity and integrity metadata, and does not proxy object content. 

POST /v2/tenant/connectors/s3-objects/{connectorId}/commit
Content-Type: application/json

{
  "key": "evidence/input.json",
  "versionId": "$OBJECT_VERSION_ID",
  "metadata": {
    "source": "case-file"
  }
}

Object commitments should include only metadata that is safe to store as evidence. Object content remains in the customer object store.

Connector diagnostics

Tenant-visible diagnostics show whether a connector is enabled, recently used, failing auth, failing replay checks, or revoked. They do not reveal connector credentials, raw provider payloads, or private object content.

StatusMeaning
healthyRecent signed delivery or source check succeeded.
auth_failedProvider or HMAC signature did not verify.
replay_conflictThe same source reference was replayed with different content.
revokedIngress is disabled and should fail closed.

Safety boundaries