Skip to main content
Requirements: Python 3.9 or later. Uses httpx for HTTP requests.

Installation

Quick Start

quickstart.py

Client Configuration

Idempotency keys

The SDK generates an Idempotency-Key header automatically on every write operation (mint, revoke, supersede), making retries safe by default. If a request fails and is retried, the server returns the original response instead of performing the action twice. When multiple applications share the same tenant, set idempotency_prefix to namespace the auto-generated keys and prevent collisions:
With these prefixes, a key generated by the billing service looks like billing-svc_<uuid>, while onboarding produces onboarding-svc_<uuid> — so concurrent requests from different services never conflict.
Idempotency keys expire after 24 hours. If you omit idempotency_prefix, keys are generated without a prefix and are still unique per request.

Retry behavior

When max_retries is set (default: 3), the SDK automatically retries failed requests using exponential backoff with jitter.

What gets retried

The SDK retries when all of the following are true:
  • The HTTP status code is retryable: 408, 429, 500, 502, 503, or 504
  • The retry count has not exceeded max_retries
Responses with 400, 401, 403, 404, or 409 are not retried.

Backoff schedule

The delay doubles on each attempt, capped at 2 seconds. If the API returns a 429 with a Retry-After header, the SDK waits the server-specified duration instead.

Disabling retries

The SDK generates idempotency keys automatically for write operations, so retries for mint and revoke calls are safe. See idempotency keys to configure a prefix for multi-service environments.

Error handling

Revoke an attestation

Permanently invalidate an attestation. Once revoked, any verification check returns REVOKED. This action cannot be undone — if you need to issue an updated credential instead, use supersede.
revoke.py
Revocation is permanent and recorded in the transparency log. You cannot undo it. Use supersede if you need to replace a credential with an updated version.

Supersede an attestation

Replace an existing attestation with an updated version. The original is marked as SUPERSEDED and linked to the new one, creating an auditable version chain.
supersede.py
Both the original and new attestation remain in the transparency log. Verifiers can trace the full chain using the superseded_by_attestation_id field on the original.

Context Manager

Use the client as a context manager to ensure proper cleanup of HTTP connections.

API Reference

Issuers

  • client.issuers.create(name, ...) - Create a new issuer
  • client.issuers.list(limit, offset) - List issuers
  • client.issuers.get(issuer_id) - Get issuer by ID
  • client.issuers.trust(issuer_id) - Trust an issuer

Attestations

  • client.attestations.mint(...) - Mint a new attestation
  • client.attestations.get(id) - Get attestation details
  • client.attestations.list(limit, offset) - List attestations
  • client.attestations.revoke(id, reason) - Revoke an attestation
  • client.attestations.supersede(attestation_id, payload_b64url) - Supersede an attestation
  • client.attestations.proof_bundle(id) - Get proof bundle

Receipts

  • client.receipts.mint(req) - Mint a signed receipt
  • client.receipts.get(receipt_id) - Get receipt by ID
  • client.receipts.list(filter?) - List receipts with optional filters
  • client.receipts.revoke(receipt_id, reason?) - Revoke a receipt
  • client.receipts.list_types() - List available receipt types
  • client.receipts.get_type(name) - Get a receipt type by name
  • client.receipts.get_proof_bundle(receipt_id) - Get proof bundle
  • client.receipts.verify(receipt_id) - Verify a receipt
  • client.receipts.search(**kwargs) - Search receipts
  • client.receipts.export(format, filters?) - Queue bulk export
  • client.receipts.get_export(export_id) - Get export job status
  • client.receipts.redact(receipt_id) - Redact receipt payload

Verify

  • client.verify.verify_online(attestation_id, payload_b64url) - Verify attestation online

Audit

  • client.audit.query(params) - Query audit events with filters
  • client.audit.export(data) - Start an async audit log export

Governance

  • client.governance.list_requests() - List governance requests
  • client.governance.create_request(data) - Create a governance request
  • client.governance.approve_request(id) - Approve a pending request
  • client.governance.execute_request(id) - Execute an approved request

Querying audit logs

Retrieve audit events to track API activity, monitor security events, and generate compliance reports. Filter by action, actor, resource, or time range.
audit.py
See the audit API reference for the full list of filter parameters.

Governance workflows

Manage formal issuer actions — suspend, revoke, reinstate, and change trust tier — through a multi-party approval workflow. Create a request, collect approvals from authorized reviewers, then execute.
governance.py
See the governance API reference for the full request and response schemas.

Audit queries and exports

Query audit events with filters and export logs for compliance reporting. Use client.audit.query() to search events and client.audit.export() to start an asynchronous export job.
audit.py
See audit logs for the full event structure, filter parameters, and retention policies.

Receipt operations

Mint, verify, search, export, and redact cryptographically signed receipts. See the receipts guide for an overview of receipt types and the full lifecycle.
receipts.py
See the receipts API reference for the full request and response schemas.