---
title: "Verify Boot Attestation"
method: POST
path: "/servers/boot/attestation"
tags: ["Servers"]
---

# Verify Boot Attestation

`POST /servers/boot/attestation`

Verify boot attestation and return LUKS passphrase.

auth (signed mode) carries the X-Chutes-Signature header, only consulted when the matched
measurement is a release candidate: it must be an RSA-SHA256 signature (openssl dgst) over the
boot nonce by one of the measurement's authorized operator signing keys, proving possession
(see authorize_rc_measurement). Ignored for published measurements, so existing VMs are
unaffected.

This endpoint verifies the TDX quote against expected boot measurements
and returns the LUKS passphrase for disk decryption if valid.
For VMs running version >= 1.3.0, also returns a luks_quote_nonce for
the subsequent POST /luks/attest call.

## Headers

- `X-Chutes-Nonce` string, nullable
- `X-Operator-Signature` string, nullable
- `X-Chutes-Hotkey` string, nullable
- `X-Chutes-Signature` string, nullable

## Request body

- BootAttestationArgs — Request model for boot attestation.
  - `quote` string, required — Base64 encoded TDX quote
  - `miner_hotkey` string, required — Miner hotkey that owns this VM
  - `vm_name` string, required — VM name/identifier
  - `first_boot` boolean — True when the VM detected a fresh (re-downloaded) image via its LUKS2 header token

## Response `200`

Successful Response

- BootAttestationResponse — Response model for successful boot attestation.
  - `key` string, required
  - `luks_quote_nonce` string, nullable
  - `root_next` string, nullable — New root passphrase the VM should rotate to (None for pre-1.4.0 VMs)
  - `root_confirm_nonce` string, nullable — Single-use nonce for confirming root passphrase rotation via POST /luks/confirm
  - `vm_auth_ss58` string, nullable

## Other responses

- `422` — Validation Error

## Changes

> 7 revisions in range; 4 could not be searched.

- **2026-08-04** `352418d4e3a2` — 4 info
  - added the new optional request property `first_boot`
  - added the optional property `root_confirm_nonce` to the response with the `200` status
  - added the optional property `root_next` to the response with the `200` status
  - added the optional property `vm_auth_ss58` to the response with the `200` status
- **2026-07-26** `9fed8100e50d` — 1 warning
  - removed the optional property `boot_token` from the response with the `200` status

[Change history](https://skmtc.dev/chutes/apis/fastapi/changes/servers/boot/attestation/post.md)

---

[API](https://skmtc.dev/chutes/apis/fastapi.md) · [All operations](https://skmtc.dev/chutes/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/chutes/fastapi/revisions/7be1aa2fe1a0/schema)