---
title: "Attest to an SGX enclave."
method: POST
path: "/attest/OpenEnclave"
---

# Attest to an SGX enclave.

`POST /attest/OpenEnclave`

Processes an OpenEnclave report , producing an artifact. The type of artifact
produced is dependent upon attestation policy.

## Query parameters

- `api-version` string, required

## Request body

- AttestOpenEnclaveRequest — Attestation request for Intel SGX enclaves
  - `report` string, base64url — OpenEnclave report from the enclave to be attested
  - `runtimeData` RuntimeData — Runtime data are a conduit for any information defined by the Trusted Execution Environment (TEE) when actually running.
    - `data` string, base64url — Runtime data are generated by the Trusted Execution Environment (TEE). For an SGX quote (Coffeelake or Icelake), the SHA256 hash of the RuntimeData must match the lower 32 bytes of the quote's "report data" attribute. For a SEV-SNP quote, the SHA256 hash of the RuntimeData must match the quote's "report data" attribute.
    - `dataType` 'Binary' | 'JSON' — Specifies the type of the data encoded contained within the "data" field of a "RuntimeData" or "InitTimeData" object
  - `initTimeData` InitTimeData — Initialization time data are a conduit for any configuration information that is unknown when building the Trusted Execution Environment (TEE) and is defined at TEE launch time. This data can be used with confidential container or VM scenarios to capture configuration settings such as disk volume content, network configuration, etc.
    - `data` string, base64url — Initialization time data are passed into the Trusted Execution Environment (TEE) when it is created. For an Icelake SGX quote, the SHA256 hash of the InitTimeData must match the lower 32 bytes of the quote's "config id" attribute. For a SEV-SNP quote, the SHA256 hash of the InitTimeData must match the quote's "host data" attribute.
    - `dataType` 'Binary' | 'JSON' — Specifies the type of the data encoded contained within the "data" field of a "RuntimeData" or "InitTimeData" object
  - `draftPolicyForAttestation` string — Attest against the provided draft policy. Note that the resulting token cannot be validated.
  - `nonce` string — Nonce for incoming request - emitted in the generated attestation token

## Response `200`

The request has succeeded.

- AttestationResponse — The result of an attestation operation
  - `token` string — An RFC 7519 JSON Web Token, the body of which is an AttestationResult object.

## Other responses

- `default` — An unexpected error response.

## Changes

- **2026-07-13** (2018-09-01-preview) `74e240995f3e` — 1 info
  - api tag `Attestation` removed
- **2026-07-13** (2018-09-01-preview) `e2463a10f80d` — 1 breaking
  - api path removed without deprecation
- **2026-07-13** (2018-09-01-preview) `cb7cc16888f7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/azure/apis/attestation-attestation/changes/attest/OpenEnclave/post.md)

---

[API](https://skmtc.dev/azure/apis/attestation-attestation.md) · [All operations](https://skmtc.dev/azure/apis/attestation-attestation/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azure/attestation-attestation/revisions/74e240995f3e/schema)