> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashnet.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Attestation

> Verify worker identity

`GET /v1/attestation` requests evidence of the worker's enclave identity, bound to a caller-supplied nonce.

Use a fresh nonce of 16 to 128 printable, non-space ASCII characters:

```bash theme={null}
curl "https://orchestration.flashnet.xyz/v1/attestation?nonce=$(openssl rand -hex 16)"
```

The response can include `enclave`, `nonce`, and a base64 COSE\_Sign1 `document`, plus verification results:

* `verified`: server-side verification result. Failures include `reason`.
* `pcrsPinned`: whether verification used configured image measurements. `verified: true` alone does not establish build matching.
* `moduleId`, `pcr0`, `timestamp`: returned after successful verification.

Invalid nonces return HTTP 400 with `error: "invalid_nonce"`. Worker failures return HTTP 503 with `enclave: false` and an error string. A missing document yields `verified: false` and `reason: "no_document"`. Do not infer deployment type from `enclave: false`.

To verify:

Decode the document, verify its signature and certificate chain to a trusted AWS Nitro root, check your nonce and timestamp freshness, and compare measurements against a trusted release. Obtain release-bound measurements from Flashnet before claiming build verification; the response's `pcr0` is evidence to compare, not its own trust anchor.