API overview - Attesso

The Attesso API is a server-to-server JSON interface for Mandates, Authorizations, and signed evidence.

Current availability

Access	Base URL	Key prefix
Test	`https://api-staging.attesso.com`	`att_test_...`
Live	`https://api.attesso.com`	`att_live_...`

The test environment is free and requires no billing. The live environment requires att_live_ keys, which are enabled only after linking Stripe Billing. Test and live are separate deployments and databases; keys are not interchangeable.

Public resources

Resource	Operations
Mandate	Create, retrieve, create approval session, revoke, retrieve evidence
Authorization	Evaluate and reserve, retrieve, commit, cancel
Verification keys	Retrieve retained evidence public keys

The /browser/v1/... routes belong exclusively to Attesso’s isolated approval frontend. Company integrations must not call them.

Media types

Requests and ordinary responses: application/json
Problem responses: application/problem+json
Signed evidence: application/jose+json

Response headers

Attesso-Request-Id is safe to log and share for support correlation.
Idempotency-Replayed: true identifies a successful replay.
Location identifies a newly created resource where supplied.
Retry-After may accompany a retryable response.

HTTP success is not permission to execute. Continue only while the latest Authorization has can_execute: true.

The resource operations above are the public v1 surface. The internal browser routes are not integration endpoints.