Attest Capture API · v1

Capture API reference.

All JSON endpoints use UTF-8. Authenticated routes expect Authorization: Bearer <api_key>.

No authentication

POST /api/v1/keys

Body: { "label": "My agent" }. Issues 100 free credits and returns the API key once. No email is collected. Limited to three keys per source IP in a rolling 24-hour window.

Bearer key

GET /api/v1/keys/verify

Returns valid, credits, free and the applicable per-minute rate limit.

Bearer key · JSON

POST /api/v1/capture

{
  "url": "https://example.com",
  "format": "png",
  "full_page": true,
  "viewport": { "width": 1440, "height": 900 },
  "attest": true
}

format is png, pdf or html. attest defaults to true. The response includes id, a 24-hour signed artifact_url, sha256, captured_at and evidence_url.

Stripe Checkout Session · browser redirect

GET /capture/claim?session_id=cs_…

After checkout, the confirmation URL supplies the Checkout Session ID. Attest waits for the signed webhook, then atomically creates a paid Capture key. The key is shown once. Refreshing an already collected purchase never reveals it again.

Machine-readable failures

Errors

400: Invalid input or a blocked private/non-HTTP target.
401: Missing or invalid API key.
402: Not enough credits for the requested format.
410: The retired redemption endpoint directs clients to the claim page.
429: Rate limit exceeded.
503: Capture storage or renderer unavailable.

Free tier

Limits

Free keys allow 10 captures per minute. PNG and HTML cost 1 credit; PDF costs 2. Viewports accept widths from 320–2560 and heights from 240–2000 pixels. Targets must resolve to public HTTP or HTTPS addresses; redirects and browser requests to private networks are blocked.

Evidence scope

What “Attested capture” means

It proves what the Attest renderer saw at the recorded time and binds those bytes to the shown SHA-256 digest. It is not a forensic chain of custody, proof of page authorship or legal certification.