> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-api/api-reference/attestation.md).

# Attestation

## Fetch a GCP Confidential Space attestation token

> Returns a signed JWT issued by GCP Confidential Space, proving that the enclave is running\
> a specific Docker image inside a hardware-verified Trusted Execution Environment (AMD SEV-SNP).\
> \
> The \`nonce\` you supply is embedded in the JWT's \`eat\_nonce\` claim, binding the token to\
> your request and preventing replay attacks.\
> \
> Also returns \`verificationPublicKey\` — an EC P-256 public key generated by the enclave at startup.\
> The key is embedded in the JWT's \`aud\` claim, so its presence in the Google-signed JWT\
> proves it was generated inside the TEE. Use it to verify \`x-hinkal-response-signature\` headers\
> on enclave-api responses.\
> \
> Use this endpoint to verify that the code you can read in the\
> \[Hinkal-API-Enclave]\(<https://github.com/Hinkal-Protocol/Hinkal-API-Enclave>) repository is\
> exactly what is running on the server.<br>

```json
{"openapi":"3.0.3","info":{"title":"Hinkal API","version":"1.0.0"},"tags":[{"name":"Attestation"}],"servers":[{"url":"https://api.hinkal.io","description":"Production"}],"paths":{"/attestation":{"get":{"operationId":"getAttestation","summary":"Fetch a GCP Confidential Space attestation token","description":"Returns a signed JWT issued by GCP Confidential Space, proving that the enclave is running\na specific Docker image inside a hardware-verified Trusted Execution Environment (AMD SEV-SNP).\n\nThe `nonce` you supply is embedded in the JWT's `eat_nonce` claim, binding the token to\nyour request and preventing replay attacks.\n\nAlso returns `verificationPublicKey` — an EC P-256 public key generated by the enclave at startup.\nThe key is embedded in the JWT's `aud` claim, so its presence in the Google-signed JWT\nproves it was generated inside the TEE. Use it to verify `x-hinkal-response-signature` headers\non enclave-api responses.\n\nUse this endpoint to verify that the code you can read in the\n[Hinkal-API-Enclave](https://github.com/Hinkal-Protocol/Hinkal-API-Enclave) repository is\nexactly what is running on the server.\n","tags":["Attestation"],"parameters":[{"name":"nonce","in":"query","required":true,"description":"A UUID you generate. Embedded in the JWT `eat_nonce` claim to bind the token to your request.","schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"Attestation token successfully fetched from the TEE server","headers":{},"content":{"application/json":{"schema":{"type":"object","properties":{"jwt":{"type":"string","description":"Signed JWT issued by GCP Confidential Space\n(`https://confidentialcomputing.googleapis.com`). Contains the running\nimage digest in `submods.container.image_digest` and your nonce in\n`eat_nonce`. Verify the signature against Google's OIDC JWKS.\n"},"imageDigest":{"type":"string","description":"SHA256 digest of the running Docker image, extracted from\n`submods.container.image_digest` in the JWT payload. Compare this to\n`digest.txt` in the Hinkal-API-Enclave repository.\n"},"verificationPublicKey":{"type":"string","description":"PEM-encoded EC P-256 public key generated by the enclave at startup.\nEmbedded in the JWT's `aud` claim — the Google-signed JWT proves this key\nwas generated inside the TEE. Use it to verify the `x-hinkal-response-signature`\nheader on enclave-api responses.\n"},"nonce":{"type":"string","format":"uuid","description":"Echoed `nonce` from the query string. Covered by `x-hinkal-response-signature` — verify this matches your request nonce to prove the response was not replayed."}},"required":["jwt","imageDigest","verificationPublicKey","nonce"]}}}},"400":{"description":"Missing required query parameter `nonce`","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FailedResponse"}}}},"500":{"description":"Failed to fetch attestation token from TEE server","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FailedResponse"}}}}}}}},"components":{"schemas":{"FailedResponse":{"type":"object","properties":{"success":{"type":"boolean","enum":[false]},"error":{"type":"string"}},"required":["success","error"]}}}}
```