---
title: "Provision"
method: POST
path: "/servers/{vm_name}/provision"
tags: ["Servers"]
---

# Provision

`POST /servers/{vm_name}/provision`

## Request

- Base URL: `https://api.chutes.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.chutes.ai/servers/{vm_name}/provision`
- Auth: none declared

Provision a new VM at runtime: record its root CA identity and issue storage secrets.

Only 1.4.0+ VMs reach this route (it is behind require_cvm_proxy), and every one of them
signs, so require_hotkey_auth demands a proven hotkey at the door -- no backwards-compatible
"unsigned is acceptable" case exists here, unlike boot attestation. The proven identity is
what the rc gate in verify_quote is given.

The RTMR3-attested runtime entry point for new VMs (supersedes /luks/attest going
forward). The VM presents its per-boot root CA as the mTLS client cert; the quote's
REPORTDATA binds SHA256(that cert's pubkey), so the same cert_hash check that guards
/luks/attest also proves CA possession — no bespoke quote logic is needed.
require_luks_quote_nonce validates and consumes the runtime nonce; the handler verifies
the quote (signature + all RTMR measurements incl. RTMR3), records
server.vm_root_ca_cert (idempotent), and returns rotated passphrases, the k3s encryption
key, and a confirm nonce.

## Path parameters

- `vm_name` string, required

## Headers

- `X-Chutes-Hotkey` string, nullable
- `X-Quote-Nonce` string, nullable

## Request body

- ProvisionRequest: Request model for POST /servers/{vm_name}/provision. The runtime (RTMR3-attested) provisioning entry point for new VMs. The VM presents its root CA as the mTLS client cert; the quote's REPORTDATA binds SHA256(that cert's pubkey), so the CA identity is recorded from this call. Mirrors the luks/attest body today (quote + volumes) and is the extensible home for future provisioning inputs.
  - `quote` string, required: Base64-encoded TDX quote (runtime type, RTMR3 extended)
  - `volumes` string[], required: Volume names to rotate passphrases for

## Response `200`

Successful Response

- string

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-16** `23e8895b217d`: 4 breaking, 2 info
  - the response's body type changed from `object` to `string` for status `200`
  - removed the required property `confirm_nonce` from the response with the `200` status
  - removed the required property `k3s_encryption_key` from the response with the `200` status
  - removed the required property `volumes` from the response with the `200` status
  - …2 more
- **2026-09-02** `37e3c562aa28`: 3 warning
  - deleted the `header` request parameter `X-Chutes-Nonce`
  - deleted the `header` request parameter `X-Chutes-Signature`
  - deleted the `header` request parameter `X-Operator-Signature`
- **2026-08-26** `8d909638091e`: 1 info
  - endpoint added
- **2026-08-22** `05d9af05d87e`: 1 breaking
  - api path removed without deprecation
- **2026-08-04** `352418d4e3a2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/chutes/apis/chutes-api/changes/servers/:vm_name/provision/post.md)

---

[API](https://skmtc.dev/chutes/apis/chutes-api.md) - [All operations](https://skmtc.dev/chutes/apis/chutes-api/llms.txt) - [OpenAPI document](https://skmtc.dev/chutes/apis/chutes-api/revisions/8add5b0e22da?raw)