Skip to main content
GET /v1/attestation requests evidence of the worker’s enclave identity, bound to a caller-supplied nonce. Use a fresh nonce of 16 to 128 printable, non-space ASCII characters:
The response can include enclave, nonce, and a base64 COSE_Sign1 document, plus verification results:
  • verified: server-side verification result. Failures include reason.
  • pcrsPinned: whether verification used configured image measurements. verified: true alone does not establish build matching.
  • moduleId, pcr0, timestamp: returned after successful verification.
Invalid nonces return HTTP 400 with error: "invalid_nonce". Worker failures return HTTP 503 with enclave: false and an error string. A missing document yields verified: false and reason: "no_document". Do not infer deployment type from enclave: false. To verify: Decode the document, verify its signature and certificate chain to a trusted AWS Nitro root, check your nonce and timestamp freshness, and compare measurements against a trusted release. Obtain release-bound measurements from Flashnet before claiming build verification; the response’s pcr0 is evidence to compare, not its own trust anchor.