quickstart

Make your first API call

Get a free API key at api.attestd.io/portal/login, then set export ATTESTD_KEY=<your-key> before running the examples below. The free tier includes 5,000 calls per month (no credit card required.)

1. Query a product version

Pass a product slug and version string as query parameters. The response is always JSON.

bash

curl "https://api.attestd.io/v1/check?product=log4j&version=2.14.1" \
  -H "Authorization: Bearer $ATTESTD_KEY"

2. Read the response

Log4j 2.14.1 is Log4Shell. You should see risk_state: "critical" with actively_exploited: true.

json

{
  "product": "log4j",
  "version": "2.14.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "2.17.1",
  "confidence": 0.94,
  "cve_ids": [
    "CVE-2021-44228",
    "CVE-2021-45046",
    "CVE-2021-45105"
  ],
  "cves": null,
  "max_epss": null,
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null,
  "last_updated": "2026-02-23T18:21:30Z"
}

3. Try a safe version

nginx 1.27.4 has no known relevant vulnerabilities. The response will have risk_state: "none".

bash

curl "https://api.attestd.io/v1/check?product=nginx&version=1.27.4" \
  -H "Authorization: Bearer $ATTESTD_KEY"

4. Use the Python SDK

Install the SDK, then call client.check(). The SDK handles retries, parses the response into a typed dataclass, and raises named exceptions for auth errors and rate limits.

bash

pip install attestd

check.py

import attestd

client = attestd.Client(api_key="<your-api-key>")

result = client.check("nginx", "1.27.4")

print(result.risk_state)        # "none"
print(result.actively_exploited) # False
print(result.cve_ids)           # []

# Blocking check
if result.risk_state in ("critical", "high"):
    raise SystemExit(f"Deployment blocked: {result.risk_state} risk in nginx {result.version}")

5. Check PyPI and npm packages for supply chain threats

Attestd monitors 27459 PyPI and 237601 npm packages for malicious publishes. When you query a monitored package, the response includes a supply_chain object alongside CVE data.

For example, checking LiteLLM:

bash

curl "https://api.attestd.io/v1/check?product=litellm&version=1.82.7" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Notice the supply_chain object:

json

{
  "product": "litellm",
  "version": "1.82.7",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 1,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "supply_chain": {
    "compromised": true,
    "sources": [
      "osv",
      "registry"
    ],
    "malware_type": "backdoor",
    "description": "TeamPCP supply chain attack: a malicious version contained a credential stealer in proxy_server.py targeting LLM provider API keys. Published at 10:39 UTC and removed within six hours after community detection.",
    "advisory_url": "https://docs.litellm.ai/blog/security-update-march-2026",
    "compromised_at": "2026-03-24T10:39:00Z",
    "removed_at": "2026-03-24T16:00:00Z"
  },
  "supply_chain_monitored": true,
  "typosquat": null,
  "last_updated": "2026-04-27T16:07:47.644177Z"
}

If supply_chain.compromised is true, block deployment immediately. See the Supply Chain Integrity guide for all monitored packages and detailed semantics.

6. Check an invented package name

When supported is false, check typosquat first. AI agents often invent package names. Attestd returns a name-integrity signal with the package the requester probably meant.

bash

curl "https://api.attestd.io/v1/check?product=react-codeshift&version=1.0.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Expected shape when the name fails integrity:

json

{
  "supported": false,
  "typosquat": {
    "detected": true,
    "kind": "hallucination",
    "resembles": "jscodeshift",
    "likely_intended": ["jscodeshift"],
    "confidence": 0.9,
    "ecosystem": "npm"
  }
}

7. CVE-covered products

Attestd currently covers 356 infrastructure products on the API (77 with detailed docs pages). Use the exact API slug for each product (e.g. log4j, nginx, runc). Attestd returns supported: false for anything not in the set. When the name also fails package name integrity, the response includes a typosquat object. Check that field first before treating the name as unknown. An unsupported product is not a safety signal. It means Attestd is not tracking CVE or supply-chain data for it yet.

View all 356 API slugs and featured docs →

next steps

→ Product Coverage (356 API products, featured docs, and full slug list)
→ Response Field Reference (semantics of every field, including supply_chain signals)
→ Supply Chain Integrity (27459 PyPI + 237601 npm packages, malware detection sources)
→ Account & Portal Guide (API key management, scoping, billing)
→ SDK Reference (AsyncClient, error types, and the testing module)
→ CI/CD Integration (GitHub Actions and GitLab CI examples)