Skip to main content
GET
Attestation report
Returns the gateway’s attestation report: the hardware-backed proof of which TEE workload is serving the API, plus the public keys it signs with. Verify this report before trusting any receipt. For what each field proves, see Attestation report.

Request

string
Exactly 64 lowercase hex characters (32 random bytes). The gateway binds it into the quote’s report_data so you can prove the report is not a replay.

Response

200 OK, application/json. The bare attestation report.

Top-level fields

attestation object

Example (long values truncated)

Verifying the report

  1. Verify attestation.evidence.quote against Intel DCAP collateral, and confirm its report data binds your nonce and the workload_keyset.
  2. Recompute the JCS digest of workload_keyset and compare it with workload_keyset_digest.
  3. Confirm workload_keyset_digest matches the receipts you verify.
  4. Confirm workload_keyset.not_after is in the future.
  5. Replay the event log to RTMR3 and confirm the measured compose hash equals sha256(app_compose).
  6. For reviewed-release enforcement, require that compose hash in an independently obtained allowlist. Do not treat source_provenance as the trust anchor.
The end-to-end procedure is in Verify a response.

Legacy alias

GET /v1/attestation/report?nonce=… returns the same gateway attestation for clients written against earlier API versions, with two differences: top-level signing_address, signing_algo, and signing_public_key derived from the gateway keyset (?signing_algo=ecdsa, the default, or ed25519 selects the key), and all_attestations collapsed to a single entry. Earlier API versions returned the upstream model’s attestation here; the upstream verification for a response is now in the receipt and the attested session. New integrations should use /v1/aci/attestation.

Get receipt

The signed per-response receipt.

Attestation report concept

What each field proves.