DOCS / REFERENCE / API

API Reference

Generate and query evidence programmatically. SDKs are available for Go, TypeScript, and Python — the REST API underlies all three.

Authentication

Every request requires a Bearer token in the Authorization header. Tokens are scoped — a token created for CI attestation can't query the Evidence Graph unless explicitly granted that scope.

header

Authorization: Bearer sk_live_•••

Base URL: https://api.cdk.dev/v1

Create an attestation

POST /attestations — generates a signed attestation for a delivery event.

REQUEST

POST /v1/attestations

{
  "event":    "deployment.approved",
  "artifact": "release-2026.07",
  "policy":   "release-policy-v3"
}

RESPONSE — 201

{
  "id":        "att_8f92ab",
  "status":    "verified",
  "signature": "sha256:8f92ab…"
}

All endpoints

Attestations

POST/attestationsCreate a signed attestation for a delivery event.

GET/attestations/{id}Retrieve a single attestation by ID.

GET/attestations/{id}/verifyIndependently verify an attestation's signature and claims.

Evidence Graph

GET/graph/{artifact}Retrieve the complete evidence graph for an artifact, commit to deployment.

Policies

POST/policies/evaluateEvaluate a policy against a pending change before it merges.

GET/policies/{id}Retrieve a policy definition.

Rate limits

600 requests per minute per token by default. Enterprise plans can raise this limit — contact your account team.

Errors

400

Malformed request body or missing required field.

401

Missing or invalid Bearer token.

403

Token is valid but lacks the required scope.

404

Attestation, policy, or artifact not found.

429

Rate limit exceeded.

500

Something failed on CDK's side — retry with backoff.