Skip to main content
The Attesso API is a server-to-server JSON interface for mandates, authorizations, and signed evidence.

​
Base URLs

Use an environment-matching key. Resources and credentials do not cross environments.

​
Resources and endpoints

The /browser/v1/... routes used by the hosted approval page are private to Attesso’s isolated approval origin. Do not call them from your integration.

​
Media types

  • Requests and ordinary responses use application/json.
  • Errors use application/problem+json when Attesso supplies a body.
  • Signed evidence uses application/jose+json.

​
Execution contract

An HTTP success response is not permission to execute. Your backend may continue only when the latest authorization representation has can_execute: true.
ALLOW, RESERVED, and execute_before explain the grant, but can_execute is the final gate after deadline reconciliation.

​
Response headers

  • Attesso-Request-Id is safe to log and use for support correlation.
  • Idempotency-Replayed: true indicates an earlier write was replayed.
  • Location identifies a newly created resource where supplied.
  • Retry-After may accompany a retryable 503 response.

Authentication

Store keys safely and isolate staging from production.

Errors and idempotency

Fail closed and make retries safe.