The attestation API can be used to detect probable root, but that's not the only thing it does. It can be used to detect if an APK is modified(and thus probably cracked) or not. There are various things you can check for and you can allow rooted phones while disallowing modified APKs.