Documentation
Attestor is a neutral, third-party attestation suite. This documentation covers how to authenticate, send calls to each primitive, and verify the receipts you get back.
Quickstart
Get a working signed receipt in under a minute.
1 · Get an API key
Sign up at attestor.com and copy your key from the dashboard. Keys start with atst_ followed by 32 alphanumeric characters.
2 · Make a call
Route any HTTP request through the relay. Tabs below show the same call in different languages.
curl https://agined.com/api/v1/attestor/call \
-H "Authorization: Bearer $ATTESTOR_KEY" \
-H "Content-Type: application/json" \
-d '{
"destination": "https://httpbin.org/get",
"method": "GET",
"agent_id": "quickstart-test"
}'const response = await fetch('https://agined.com/api/v1/attestor/call', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.ATTESTOR_KEY}`,
'Content-Type': 'application/json'
},
body: JSON.stringify({
destination: 'https://httpbin.org/get',
method: 'GET',
agent_id: 'quickstart-test'
})
});
const receipt = response.headers.get('X-Attestor-Receipt');
console.log('Receipt:', receipt);import os, requests
r = requests.post(
'https://agined.com/api/v1/attestor/call',
headers={'Authorization': f'Bearer {os.environ["ATTESTOR_KEY"]}'},
json={
'destination': 'https://httpbin.org/get',
'method': 'GET',
'agent_id': 'quickstart-test'
}
)
print('Receipt:', r.headers['X-Attestor-Receipt'])body := `{"destination":"https://httpbin.org/get","method":"GET","agent_id":"quickstart-test"}`
req, _ := http.NewRequest("POST", "https://agined.com/api/v1/attestor/call", strings.NewReader(body))
req.Header.Set("Authorization", "Bearer " + os.Getenv("ATTESTOR_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
fmt.Println("Receipt:", resp.Header.Get("X-Attestor-Receipt"))3 · Verify the receipt
Take the receipt from the X-Attestor-Receipt header (base64url-encoded) or the X-Attestor-Receipt-Id header (to fetch the receipt separately) and verify it with the verification library or paste it into the verify page.
Core concepts
Primitive
A primitive is a single attestation operation. Attestor ships eight primitives in v1: agent relay, notarization, API monitor, webhook delivery, DNS attestation, TLS attestation, LLM attestation, and commit attestation. Every primitive produces a receipt in the same format.
Receipt
A JSON object signed with Attestor's ed25519 key that attests to a specific event having a specific shape at a specific time. Receipts are cryptographically verifiable without contacting Attestor. See Receipt format.
Public verification
Anyone with the public key can verify any receipt. The public key is published at agined.com/.well-known/attestor-keys.json and embedded in the verification libraries. Verification requires no Attestor account.
Authentication
Every request includes your API key in the Authorization header:
Authorization: Bearer atst_a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2Keys are generated in the dashboard and shown exactly once. Lose a key and you generate a new one — the old key is invalidated immediately. Keys are not recoverable.
Receipt format
Every primitive produces a receipt that follows this shape:
{
"version": 1,
"receipt_id": "01H8X4P9R7Z2E5M3K6Q1V0W4N8",
"type": "agent.call",
"issued_at": "2026-05-14T15:42:11.234Z",
"agent_id": "billing-bot",
"purpose": "refund_processing",
"user_id_hash": "sha256:7f8a9b2c...",
"call": {
"destination": "https://api.stripe.com/v1/charges",
"method": "POST",
"response_status": 200,
"request_body_sha256": "sha256:...",
"response_body_sha256": "sha256:...",
"duration_ms": 184
},
"signature": {
"algorithm": "ed25519",
"key_id": "attestor-2026-q2",
"value": "BASE64URL_ENCODED_SIGNATURE"
}
}The type field identifies which primitive produced the receipt — values are agent.call, content.notarize, monitor.http, webhook.deliver, dns.watch, tls.watch, llm.attest, or commit.attest. Per-primitive fields vary; the envelope (version, receipt_id, issued_at, signature) is universal.
The full spec, including canonicalization rules, is at github.com/attestor/receipt-spec.
Agent relay
Route any HTTP call through the relay. Get back the destination's response with a signed receipt header.
POST https://agined.com/api/v1/attestor/call
{
"destination": "https://api.example.com/path",
"method": "POST",
"headers": { ... }, // forwarded as-is, never stored
"body": "...", // forwarded as-is, only hash stored
"agent_id": "my-agent", // your identifier, free-form
"purpose": "what for" // optional human-readable
}Notarization
Submit a content hash. Get back a signed attestation that the hash existed at this exact moment.
POST https://agined.com/api/v1/attestor/notarize
{
"content_sha256": "sha256:7f8a9b2c...",
"label": "human-readable label",
"content_type": "application/pdf",
"size_bytes": 142887
}API monitor
Register a URL to be checked on schedule. Receipts stream into your account.
POST https://agined.com/api/v1/attestor/monitors
{
"url": "https://api.example.com/healthz",
"method": "GET",
"interval": "1m", // "1m", "5m", "1h", "24h"
"expect_status": 200,
"label": "production-api"
}Webhook delivery
Submit a webhook payload. Attestor delivers it (with retries) and produces a receipt for every attempt.
POST https://agined.com/api/v1/attestor/webhooks/deliver
{
"destination": "https://customer.example/hook",
"payload": { ... },
"max_retries": 5,
"retry_strategy": "exponential"
}DNS attestation
Watch a domain's DNS records over time. Multi-resolver consensus is signed at every interval.
POST https://agined.com/api/v1/attestor/dns/watch
{
"domain": "example.com",
"records": ["A", "MX", "TXT"],
"resolvers": ["1.1.1.1", "8.8.8.8", "9.9.9.9"],
"interval": "1h"
}TLS attestation
Periodic TLS handshakes against a host. Full cert chain captured and signed.
POST https://agined.com/api/v1/attestor/tls/watch
{
"host": "example.com",
"port": 443,
"sni": "example.com",
"interval": "6h"
}LLM attestation
Submit metadata for an LLM completion. Get back a signed receipt binding provider, model, and content hashes to a moment.
POST https://agined.com/api/v1/attestor/llm/attest
{
"provider": "anthropic",
"model": "claude-opus-4-7",
"prompt_sha256": "sha256:...",
"response_sha256": "sha256:...",
"input_tokens": 2140,
"output_tokens": 812
}Commit attestation
Install the GitHub Action or run the git hook. Every push produces signed commit receipts. Manual API also available:
POST https://agined.com/api/v1/attestor/commits/attest
{
"project": "acme/core",
"commit_hash": "a3b4c5d6...",
"tree_hash": "...",
"parent_hashes": ["..."],
"author_email_hash": "sha256:...",
"message_sha256": "sha256:...",
"signed_by": "..."
}@attestor/verify (JavaScript)
npm install @attestor/verify
import { verify } from '@attestor/verify';
const result = await verify(receipt);
// { valid: true, receiptId, keyId, issuedAt }
// or { valid: false, reason: 'signature_invalid' }attestor-verify (Python)
pip install attestor-verify
from attestor_verify import verify
result = verify(receipt)
# VerificationResult(valid=True, receipt_id=..., key_id=..., issued_at=...)
# or VerificationResult(valid=False, reason='signature_invalid')Keys file
The public keys file is served at https://agined.com/.well-known/attestor-keys.json. Verification libraries fetch and cache it automatically. You can pin a copy for air-gapped verification.
{
"issuer": "Attestor",
"version": 1,
"keys": [
{
"key_id": "attestor-2026-q2",
"algorithm": "ed25519",
"public_key": "BASE64URL...",
"valid_from": "2026-05-01T00:00:00Z",
"valid_until": null
}
]
}Error codes
400 invalid_request— malformed JSON or missing required fields401 unauthorized— missing or invalid API key402 quota_exceeded— monthly quota reached; upgrade or wait for reset429 rate_limited— short-term rate limit (return after delay)502 destination_unreachable— destination did not respond within timeout503 service_unavailable— Attestor is degraded; receipts may be delayed
Rate limits
Burst limits apply per plan and are not published yet; a request over the limit returns 429 rate_limited and can be retried after a short delay. These are short-term burst limits; the monthly quota is independent of them.
Changelog
See CHANGELOG.md for the relay. Library changelogs are in their respective repositories.