Get attestation document

Prefers a fresh NSM attestation via qos_host (live), with a short in-process cache (60s). If live fetch fails, falls back to the latest stored boot proof’s awsAttestationDocB64. Never returns an empty success. For full pivot ↔ quorum-manifest verification (PCRs + multi-sig approvals), prefer get_latest_boot_proof plus client-side verifyBootProof / verifyLatestBootProof. Use verifyAttestationDocument from @0xkey-io/crypto when you only need the hardware attestation chain (Turnkey-style attestation-validator).

string

required

Unique identifier for a given Organization (fleet-wide evidence; used for API contract consistency only).

string

required

Enclave app to attest (case-insensitive). Accepted values:

signer
notarizer
tls-fetcher / fetcher
evm-parser / transaction-parser / parser
ump / policy-engine / policy — Turnkey alias ump maps to 0xkey policy-engine

A successful response returns the following fields:

string

required

Raw COSE Sign1 attestation document bytes (JSON transport encodes as base64 / byte).

INVALID_ARGUMENT — unknown enclaveType or invalid organizationId
FAILED_PRECONDITION — no live qos_host and no stored boot proof yet
UNAVAILABLE — live NSM failed and store is empty

After deploying coordinator with [qos_host_control] and booted enclaves:

POST /public/v1/query/get_attestation with enclaveType: "signer" (stamped).
Assert attestationDocument is non-empty base64.
Decode bytes and run verifyAttestationDocument from @0xkey-io/crypto (asOf = now).
Optionally also call get_latest_boot_proof + verifyBootProof for the full pivot↔manifest chain.

curl --request POST \
  --url https://api.0xkey.io/public/v1/query/get_attestation \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-Stamp: <string> (see Authorizations)" \
  --data '{
    "organizationId": "<string>",
    "enclaveType": "signer"
}'

import { ZeroXKey } from "@0xkey-io/sdk-server";
import { verifyAttestationDocument } from "@0xkey-io/crypto";

const zeroXKey = new ZeroXKey({
  apiBaseUrl: "https://api.0xkey.io",
  apiPublicKey: process.env.API_PUBLIC_KEY!,
  apiPrivateKey: process.env.API_PRIVATE_KEY!,
  defaultOrganizationId: process.env.ORGANIZATION_ID!,
});

const response = await zeroXKey.getAttestationDocument({
  organizationId: process.env.ORGANIZATION_ID!,
  enclaveType: "signer",
});

// JSON `byte` fields arrive as base64 strings from the HTTP client.
const docBytes = Uint8Array.from(
  Buffer.from(response.attestationDocument as unknown as string, "base64"),
);
await verifyAttestationDocument(docBytes);

{
  "attestationDocument": "<base64-encoded COSE Sign1 bytes>"
}

Webhooks

Public API

Get attestation document