---
title: "Mint a signed attestation for an output"
method: POST
path: "/api/v1/outputs/{id}/attestation"
tags: ["Governance"]
---

# Mint a signed attestation for an output

`POST /api/v1/outputs/{id}/attestation`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/outputs/{id}/attestation`
- Auth: HTTP bearer

Signs an Ed25519 attestation for a persisted analysis output on the **API surface** (`nlk_` key). Auth: Bearer `nlk_` key with scope `mcp` (or `analyze`); the internal loopback requires `mcp` → `403 MCP_SCOPE_REQUIRED` otherwise. Owner-only over `analysis_outputs` (ownership resolved by `api_key_id`/org/user — an integrator never mints another tenant's attestation → `404`). **0 credits** (non-generative). The returned attestation is offline-verifiable via `POST /api/v1/attestations/verify` and the public JWKS.

Zero-Retention: the envelope carries only hashes + citation counts — never analysis text or canonical citation strings.

## Path parameters

- `id` string, uuid, required

## Response `200`

The signed attestation envelope (all `Attestation` fields) plus `requestId`.

- object: Signed, offline-verifiable attestation of an output. The EdDSA (Ed25519) signature is verified against the public JWKS (`GET /api/v1/attestations/keys`) with no shared secret. Zero-Retention: `citation_summary` carries counts only (no canonical citation text); `content_hash` binds the exact text the verifier re-submits.
  - `attestation_version` string, required
  - `issued_at` string, date-time, required
  - `signer_key_id` string, required: kid of the signing key (matches a key in the JWKS).
  - `output_id` string, uuid
  - `job_id` string, uuid, nullable
  - `request_id` string, nullable
  - `jurisdiction` string, required
  - `routing` object: Effective routing for the attested run.
    - `mode` 'byo' | 'platform'
    - `provider_id` string, nullable
  - `integrity_hash` string, required: analysis_outputs.integrity_hash = SHA256(analysis_text + job_id + created_at).
  - `content_hash` string, required: SHA256(normalize(analysis_text)); normalize = NFC + trim. Binds the content the verifier re-submits.
  - `model_chain` string[]
  - `verify_engine_version` string, required
  - `citation_summary` object: Counts only (ZR): { counts, anyBroken, total }.
  - `signature` string, required: base64url EdDSA signature over the canonical JSON of the attestation with `signature` excluded.
  - `requestId` string

## Other responses

- `401`: Not authenticated (missing/invalid/revoked key).
- `403`: MCP_SCOPE_REQUIRED — the key needs scope `mcp` for the loopback mint.
- `404`: NOT_FOUND — output does not exist or is not owned by the caller's tenant (uniform, anti-enumeration).
- `503`: Attestation signing temporarily unavailable.

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)