Developers

Re-run it yourself.

The engine is open source. The claim definitions, the evaluators, the transparency log and the verifier are all in one repository, so “check it yourself” is an instruction rather than a slogan.

Check an attestation without us

No account, no API key, no network. The verifier takes bytes you already hold plus a pinned public key, and tells you what it established, step by step.

git clone https://github.com/Attestr-dev/claimer

cargo run -p claimer -- verify attestation ./attestation.json
cargo run -p claimer -- verify receipt ./receipt.json
cargo run -p claimer -- verify consistency --older old.txt --newer new.txt \
    --proof proof.txt --origin attestr.dev/log/attestations

The same code compiled to WebAssembly is what runs onthe verify page. Both are held to one shared vector file containing valid cases and tampered ones — a flipped signature byte, a forged inclusion proof, a forked log. If the browser and the command line ever disagree, that is a bug, and we want to hear about it.

Evaluate your own code

2 claims can be evaluated today. The analyzer parses your source — it never builds it, never runsbuild.rs, and never expands a procedural macro.

cargo run -p claimer -- check /path/to/project

pass  NO_PERSISTENT_STORAGE  v1
FAIL  NO_RAW_EGRESS          v1
      src/api.rs:42:8  request body attached with `.json()` without
                       passing through anonymize, redact or sanitize

142 scanned, 3 skipped, 0 unparsed, 0 unsupported  (analyzer 0.2.0)

Exit codes are part of the contract

Code	Meaning
0	every claim passed
1	at least one claim failed
2	at least one claim was not evaluable, and none failed
3	the tool could not run

Code 2 is the one that matters. A claim is not evaluable when the evidence was incomplete — a file that would not parse, or source in a language the analyzer cannot read. Reporting that as a pass would be a lie of omission, so it gets its own answer and its own exit code.

The standard

The Attestr Claim Standard v0 defines every format: subjects, claims, evidence, outcomes, attestations, the log, canonical JSON, receipts and commitments. The v0 formats are frozen.

It ends with a section on what the standard does not give you, which is the part worth reading twice.

The API has no opinion

Public read endpoints need no authentication. None of them returns a “valid” flag. They return the document and the proofs; your client decides. A verdict you cannot re-derive is just our word again.

Endpoint	Returns
`GET /v0/catalog`	every claim definition
`GET /v0/subjects/{id}`	claims, latest outcomes, attestation history
`GET /v0/attestations/{digest}`	the envelope, the statement, a checkpoint and an inclusion proof
`GET /log/…/checkpoint`	the log's current signed checkpoint
`GET /badge/{id}/{claim}.svg`	a status badge

The API is not deployed yet. These paths are documented here because the formats they serve are already frozen and implemented.

Integrating as an operator

A PHP client is being built so that reporting a vote is one server-side call, made at the same point you already send server-side conversion events. It computes every commitment on your own servers, so raw identifiers — Facebook IDs, phone numbers, emails, Stripe IDs — never leave your systems.

Not released yet. If you are integrating now, get in touch and we will work through it with you.