Sign in
Servers

Verify Boot Attestation

Verify boot attestation and return LUKS passphrase.

Both VM generations reach this route, so the hotkey proof is EXTRACTED rather than required: a presented signature is verified here and 401s if it does not hold, but its absence is left for the handler to judge once the quote names the attested image. See process_boot_attestation, which requires a proof from any image whose measured initramfs ships the signer.

Verifies the TDX quote against the expected boot measurements and returns the LUKS passphrase for disk decryption if valid. For VMs >= 1.3.0 it also returns a luks_quote_nonce for the following runtime call (POST /provision on 1.4.0+, POST /luks/attest on 1.3.x); for 1.4.0+ it additionally returns root_next + root_confirm_nonce and the VM's ephemeral auth SS58.

post/servers/boot/attestation

Headers

X-Chutes-Noncestring nullable
X-Chutes-Hotkeystring nullable

Request body

quotestring required

Base64 encoded TDX quote

miner_hotkeystring required

Miner hotkey that owns this VM

vm_namestring required

VM name/identifier

first_bootboolean

True when the VM detected a fresh (re-downloaded) image via its LUKS2 header token

Response

Successful Response

keystring required
luks_quote_noncestring nullable
root_nextstring nullable

New root passphrase the VM should rotate to (None for pre-1.4.0 VMs)

root_confirm_noncestring nullable

Single-use nonce for confirming root passphrase rotation via POST /luks/confirm

vm_auth_ss58string nullable

Changes

Changed in 5 of the 11 revisions of this API.135

  • 37e3c562aa282See the full diff
    • ●

      deleted the header request parameter X-Chutes-Signature

      request-parameter-removed

    • ●

      deleted the header request parameter X-Operator-Signature

      request-parameter-removed

    This revision also has 2 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 8d909638091e1See the full diff
    • ○

      endpoint added

      endpoint-added

  • 05d9af05d87e1See the full diff
    • ▲

      api path removed without deprecation

      api-path-removed-without-deprecation

    This revision also has 97 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 352418d4e3a24See the full diff
    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      added the optional property to the response with the status

      response-optional-property-added

    • ○

      added the optional property to the response with the status

      response-optional-property-added

    • ○

      added the optional property to the response with the status

      response-optional-property-added

  • 9fed8100e50d1See the full diff
    • ●

      removed the optional property from the response with the status

      response-optional-property-removed

    This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog