---
title: "Attest Luks"
method: POST
path: "/servers/{vm_name}/luks/attest"
tags: ["Servers"]
---

# Attest Luks

`POST /servers/{vm_name}/luks/attest`

## Request

- Base URL: `https://api.chutes.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.chutes.ai/servers/{vm_name}/luks/attest`
- Auth: none declared

Rotate LUKS passphrases for new-format VMs (version >= 1.3.0).

DEPRECATED: superseded by POST /provision, which does the same storage rotation and
additionally records the VM root CA identity. Kept unchanged for legacy in-field VMs;
retire once the fleet upgrades.

The VM embeds the luks_quote_nonce (received in the boot attestation response)
in a TDX quote after extending RTMR3 in initramfs. require_luks_quote_nonce
validates and consumes the nonce; the handler then calls verify_quote which
checks the TDX signature and all RTMR measurements including RTMR3. Returns
rotated passphrases, the k3s encryption key, and a confirm nonce.

## Path parameters

- `vm_name` string, required

## Headers

- `X-Chutes-Hotkey` string, nullable
- `X-Quote-Nonce` string, nullable

## Request body

- LuksAttestRequest: Request model for POST /luks/attest.
  - `quote` string, required: Base64-encoded TDX quote (runtime type, RTMR3 extended)
  - `volumes` string[], required: Volume names to rotate passphrases for

## Response `200`

Successful Response

- string

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-16** `23e8895b217d`: 4 breaking, 2 info
  - the response's body type changed from `object` to `string` for status `200`
  - removed the required property `confirm_nonce` from the response with the `200` status
  - removed the required property `k3s_encryption_key` from the response with the `200` status
  - removed the required property `volumes` from the response with the `200` status
  - …2 more
- **2026-08-26** `8d909638091e`: 1 info
  - endpoint added
- **2026-08-22** `05d9af05d87e`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/chutes/apis/chutes-api/changes/servers/:vm_name/luks/attest/post.md)

---

[API](https://skmtc.dev/chutes/apis/chutes-api.md) - [All operations](https://skmtc.dev/chutes/apis/chutes-api/llms.txt) - [OpenAPI document](https://skmtc.dev/chutes/apis/chutes-api/revisions/8add5b0e22da?raw)