GET /v1/attestation

Generate a compliance attestation for your organization — a factual record of your provenance and verification activity over a date range, mapped to the transparency obligations of EU AI Act Article 50.

The attestation summarizes what your org signed and verified through Certivu. It is intended as supporting evidence for your own compliance documentation.

Not a certification. An attestation is a factual record of activity, not a certification, legal opinion, or guarantee of compliance. Certivu does not certify that your organization meets any regulatory obligation, and does not claim to detect all AI-generated content. Absence of provenance data does not imply human origin.

Authentication required — Authorization: Bearer ctv_key_…

This endpoint is available on the Enterprise plan only, and only via API key (programmatic access). Requests from other plans return 402 plan_required.

Request

GET /v1/attestation?from=2026-01-01&to=2026-03-31
Authorization: Bearer ctv_key_abc123

Export a downloadable file (JSON or HTML):

GET /v1/attestation/export?format=html&from=2026-01-01&to=2026-03-31
Authorization: Bearer ctv_key_abc123

Query parameters

Parameter	Default	Description
`from`	start of current period	Inclusive start of the reporting window (ISO 8601 date or timestamp)
`to`	now	Inclusive end of the reporting window (ISO 8601 date or timestamp)
`format`	`json`	Export only — `json` or `html`. `html` returns a printable, self-contained attestation document.

GET /v1/attestation always returns JSON. GET /v1/attestation/export returns the attestation as a downloadable file with a Content-Disposition attachment header; use format to choose JSON or a printable HTML document.

Response

{
  "attestation_id": "att_9f3kx2mq7",
  "org": {
    "org_id": "org-00000000-0000-0000-0000-000000000000",
    "name": "Acme AI",
    "plan": "enterprise"
  },
  "period": {
    "from": "2026-01-01T00:00:00.000Z",
    "to": "2026-03-31T23:59:59.999Z"
  },
  "generated_at": "2026-06-26T17:00:00.000Z",
  "summary": {
    "records_signed": 18432,
    "content_verified": 51204,
    "tamper_events": 37,
    "generators_active": 4,
    "formats": ["image", "audio", "text", "video"]
  },
  "eu_ai_act_article_50": {
    "transparency_obligation": "Article 50(2) — providers of AI systems generating synthetic content must mark outputs as artificially generated in a machine-readable format.",
    "mapping": [
      {
        "obligation": "Machine-readable marking of AI-generated output",
        "certivu_mechanism": "ML-DSA (NIST FIPS 204) signed provenance record + format-native ctv_ token",
        "records_covered": 18432
      },
      {
        "obligation": "Detectability of synthetic content",
        "certivu_mechanism": "Resilient frequency-domain watermark + perceptual-hash fallback",
        "records_covered": 18432
      },
      {
        "obligation": "Verifiability by third parties",
        "certivu_mechanism": "Public, unauthenticated POST /v1/verify and GET /v1/verify/status/:token",
        "verifications_recorded": 51204
      }
    ]
  },
  "disclaimer": "This attestation is a factual record of activity performed via Certivu. It is not a certification, legal opinion, or guarantee of compliance with the EU AI Act or any other regulation. Absence of provenance data does not imply human origin."
}

Fields

Field	Description
`attestation_id`	Unique ID for this generated attestation
`org`	Organization identity and plan at generation time
`period`	Resolved reporting window (`from`/`to`)
`generated_at`	Timestamp the attestation was produced
`summary`	Aggregate counts of signing, verification, and tamper activity in the window
`eu_ai_act_article_50`	Mapping of your activity to Article 50 transparency obligations
`disclaimer`	The non-certification disclaimer — always present

Notes

Enterprise plan only, accessed via API key. Other plans receive 402 plan_required.
An attestation is a factual record, not a certification, legal opinion, or guarantee of compliance. It does not assert that your organization satisfies any regulatory obligation.
Certivu does not claim to detect all AI-generated content. The attestation reflects only content signed and verified through Certivu — absence of provenance data does not imply human origin.
The html export is a self-contained, printable document suitable for attaching to internal compliance records.
Counts are scoped to your organization and to the requested window.

See the SDK usage guide and CLI guide for getAttestation / certivu attestation examples.