Free demo
25 calls/day
A symbol-level diff of two pinned releases of one package. Both sides are ingested from the real published artifacts, then compared: what was added, what was removed, which signatures changed, what got deprecated.
The classification is set algebra over the two releases' symbol tables, not a changelog summary. Deprecations are reported but never move the verdict: a warning is not a break.
At least one symbol vanished, or a kept symbol's signature changed.
removed and changed list exactly which, with
from_sig and to_sig.
No breaks, but at least one new symbol. The upgrade is safe for existing calls;
added lists what you gained.
Nothing added, removed, or changed. new_deprecations may still be
non-empty; those ship in the answer but never affect the classification.
Same pipeline as the paid route, 25 calls a day per client IP across the four demo endpoints. This is the exact request, and the real verdict it returned:
curl -X POST https://attester.dev/demo/v1/diff \ -H 'Content-Type: application/json' \ -d '{"ecosystem": "pypi", "package": "requests", "from_version": "2.31.0", "to_version": "2.32.3"}'
# 200 OK (trimmed) { "ok": true, "ecosystem": "pypi", "package": "requests", "from_version": "2.31.0", "to_version": "2.32.3", "classification": "additive", "added": [ { "symbol": "…", "kind": "function" } ], "removed": [], "changed": [], "new_deprecations": [ { "symbol": "…", "kind": "function", "since_version": "2.32.0" } ], "counts": { "added": 2, "removed": 0, "changed": 0, "new_deprecations": 1 }, "source": { "from": "ingested", "to": "lazy" }, "proof": { "from": { "artifact_sha256": "…" }, "to": { "artifact_sha256": "…" } }, "attestation": { "verdict": "additive", "…": "…" }, "attestation_hash": "0x…", "signature": "0x…", "served_in_ms": 40 }
Request body:
{"ecosystem": "pypi" | "npm", "package": str, "from_version": str, "to_version": str}.
Order matters: diffs run older to newer. A version the registry does not have, or
from > to, returns HTTP 422 and is never charged. A half-diff is not a
deliverable.
The demo route is free: 25 calls per day per client IP, no headers, reset 00:00 UTC, HTTP 429 when spent. The paid route is POST /v1/diff at $0.02 per call, payable per call with x402 (USDC on Base) or with prepaid credits (X-API-Key from the Stripe pack). Missing versions are ingested on the spot, at most two per request. Old-release diffs never touch the latest-version proof chain: pinned ingests write per-version proof rows only.
Full request and payment details in /llms.txt. Charge and refund rules in /policy.