> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redpill.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# TEE-only Endpoint

> Point your base URL at tee.redpill.ai to serve confidential models only, on attested providers, with no per-request configuration.

`https://tee.redpill.ai` is a base URL that serves confidential models only. Every request is
restricted to a model that can run in a TEE and is forced onto an attested provider, without a
per-request `provider` block. Point your client at it when an application must never reach a
standard, non-attested model.

It is the same gateway as `https://api.redpill.ai`, with the same API key, receipts, and verification
headers. The host changes what the gateway will serve, not how you call it.

## Use it

Change the base URL. Everything else stays the same.

```bash theme={null}
curl https://tee.redpill.ai/v1/chat/completions \
  -H "Authorization: Bearer $REDPILL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "z-ai/glm-5.2",
    "messages": [{"role": "user", "content": "Summarize this patient note."}]
  }'
```

```python theme={null}
from openai import OpenAI

client = OpenAI(api_key="YOUR_API_KEY", base_url="https://tee.redpill.ai/v1")
resp = client.chat.completions.create(
    model="z-ai/glm-5.2",
    messages=[{"role": "user", "content": "Summarize this patient note."}],
)
```

## What the endpoint enforces

| Behavior                         | `api.redpill.ai` (default)                                 | `tee.redpill.ai`                    |
| -------------------------------- | ---------------------------------------------------------- | ----------------------------------- |
| `GET /v1/models`                 | Full catalog                                               | Confidential (`is_tee`) models only |
| Request for a confidential model | Served                                                     | Served on an attested provider      |
| Request for a standard model     | Served                                                     | `404`, not available                |
| Attested serving                 | Opt in per request with `provider: {"aci_verified": true}` | Always on, cannot be waived         |

The endpoint applies two constraints together:

* The catalog is filtered to confidential models, the same set as
  [`GET /v1/models?tee=true`](/guides/attested-routing#list-the-models-you-can-use). A standard model
  such as `openai/gpt-4o-mini` is not listed and returns `404` if requested.
* Serving is forced onto an attested upstream, the same guarantee as
  [`provider: {"aci_verified": true}`](/guides/attested-routing). A client cannot opt out on this
  host: `provider: {"aci_verified": false}` and `X-Upstream-Verification: none` are ignored.

List exactly what this endpoint will serve:

```bash theme={null}
curl -s https://tee.redpill.ai/v1/models \
  -H "Authorization: Bearer $REDPILL_API_KEY" \
  | jq -r '.data[].id'
```

## When to use it

Use `tee.redpill.ai` when the whole application must stay confidential and you do not want to add a
`provider` block to every request. It removes the risk of one request omitting the constraint and
reaching a standard model.

Use the default `api.redpill.ai` with a per-request [`provider` block](/guides/attested-routing) when
the application mixes standard and confidential traffic, or when you pin individual requests to one
specific attested channel with `aci_session_ids`.

## Statuses to expect

| Request on `tee.redpill.ai`                                      | Result                                |
| ---------------------------------------------------------------- | ------------------------------------- |
| Confidential model with a live attested provider                 | `200`, served and attested            |
| Standard (non-`is_tee`) model                                    | `404`, not available on this endpoint |
| Confidential model with no attested provider available right now | `503`, no prompt is sent              |

The `503` case is the same failure as an attested request on the default endpoint: the model is
confidential in the catalog, but none of its live deployments is on an attested provider at that
moment. See the [catalog and routing note](/guides/attested-routing#list-the-models-you-can-use).

## Verify a response

The endpoint issues the same signed receipt as the default one. A response carries `x-receipt-id`.
Fetch the receipt and read its `upstream.verified` event to confirm the request was served on a
verified upstream.

```bash theme={null}
curl -s "https://tee.redpill.ai/v1/aci/receipts/$RECEIPT_ID" \
  -H "Authorization: Bearer $REDPILL_API_KEY" \
  | jq '.event_log[] | select(.type == "upstream.verified")'
```

`"result": "verified"` with `"required": true` is the proof. See
[Verify a response](/guides/verify-a-response).

## Related

<CardGroup cols={2}>
  <Card title="Attested Routing" icon="shield-check" href="/guides/attested-routing">
    Per-request attestation with the `provider` block, and pinning to one channel.
  </Card>

  <Card title="Confidential Models" icon="lock" href="/confidential-ai/confidential-models">
    How confidential and standard models differ.
  </Card>

  <Card title="Verify a Response" icon="circle-check" href="/guides/verify-a-response">
    Check the receipt for a specific response.
  </Card>

  <Card title="Models" icon="grid-2" href="/get-started/models">
    Browse the catalog and read the `is_tee` flag.
  </Card>
</CardGroup>