Sign in
Servers

Verify Boot Attestation

Verify boot attestation and return LUKS passphrase.

auth (signed mode) carries the X-Chutes-Signature header, only consulted when the matched measurement is a release candidate: it must be an RSA-SHA256 signature (openssl dgst) over the boot nonce by one of the measurement's authorized operator signing keys, proving possession (see authorize_rc_measurement). Ignored for published measurements, so existing VMs are unaffected.

This endpoint verifies the TDX quote against expected boot measurements and returns the LUKS passphrase for disk decryption if valid. For VMs running version >= 1.3.0, also returns a luks_quote_nonce for the subsequent POST /luks/attest call.

post/servers/boot/attestation

Headers

X-Chutes-Noncestring nullable
X-Operator-Signaturestring nullable
X-Chutes-Hotkeystring nullable
X-Chutes-Signaturestring nullable

Request body

quotestring required

Base64 encoded TDX quote

miner_hotkeystring required

Miner hotkey that owns this VM

vm_namestring required

VM name/identifier

first_bootboolean

True when the VM detected a fresh (re-downloaded) image via its LUKS2 header token

Response

Successful Response

keystring required
luks_quote_noncestring nullable
root_nextstring nullable

New root passphrase the VM should rotate to (None for pre-1.4.0 VMs)

root_confirm_noncestring nullable

Single-use nonce for confirming root passphrase rotation via POST /luks/confirm

vm_auth_ss58string nullable

Changes