---
title: "Attest to an SEV SNP Virtual Machine."
method: POST
path: "/attest/SevSnpVm"
---

# Attest to an SEV SNP Virtual Machine.

`POST /attest/SevSnpVm`

Processes a SEV SNP Boot chain. The type of artifact produced is dependent upon
attestation policy.

## Query parameters

- `api-version` string, required

## Request body

- AttestSevSnpVmRequest — Attestation request for AMD SEV SNP Virtual Machine
  - `report` string — Hardware rooted report of the virtual machine being attested along with the signing certificate chain and optionally, additional endorsements
  - `runtimeData` RuntimeData — Runtime data are a conduit for any information defined by the Trusted Execution Environment (TEE) when actually running.
    - `data` string, base64url — Runtime data are generated by the Trusted Execution Environment (TEE). For an SGX quote (Coffeelake or Icelake), the SHA256 hash of the RuntimeData must match the lower 32 bytes of the quote's "report data" attribute. For a SEV-SNP quote, the SHA256 hash of the RuntimeData must match the quote's "report data" attribute.
    - `dataType` 'Binary' | 'JSON' — Specifies the type of the data encoded contained within the "data" field of a "RuntimeData" or "InitTimeData" object
  - `initTimeData` InitTimeData — Initialization time data are a conduit for any configuration information that is unknown when building the Trusted Execution Environment (TEE) and is defined at TEE launch time. This data can be used with confidential container or VM scenarios to capture configuration settings such as disk volume content, network configuration, etc.
    - `data` string, base64url — Initialization time data are passed into the Trusted Execution Environment (TEE) when it is created. For an Icelake SGX quote, the SHA256 hash of the InitTimeData must match the lower 32 bytes of the quote's "config id" attribute. For a SEV-SNP quote, the SHA256 hash of the InitTimeData must match the quote's "host data" attribute.
    - `dataType` 'Binary' | 'JSON' — Specifies the type of the data encoded contained within the "data" field of a "RuntimeData" or "InitTimeData" object
  - `draftPolicyForAttestation` string — Attest against the provided draft policy. Note that the resulting token cannot be validated.
  - `nonce` string — Nonce for incoming request - emitted in the generated attestation token

## Response `200`

The request has succeeded.

- AttestationResponse — The result of an attestation operation
  - `token` string — An RFC 7519 JSON Web Token, the body of which is an AttestationResult object.

## Other responses

- `default` — An unexpected error response.

## Changes

- **2026-07-13** (2018-09-01-preview) `74e240995f3e` — 1 info
  - api tag `Attestation` removed
- **2026-07-13** (2018-09-01-preview) `1f2ecfa8c101` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/azure/apis/attestation-attestation/changes/attest/SevSnpVm/post.md)

---

[API](https://skmtc.dev/azure/apis/attestation-attestation.md) · [All operations](https://skmtc.dev/azure/apis/attestation-attestation/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azure/attestation-attestation/revisions/74e240995f3e/schema)