> ## Documentation Index
> Fetch the complete documentation index at: https://docs.0xkey.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get attestation document

> Get the raw AWS Nitro attestation document (COSE Sign1) for a live enclave app.

export const EndpointPath = ({type, path}) => {
  return <div class="flex w-full flex-col bg-background-light dark:bg-background-dark border-standard rounded-2xl p-1.5">
      <div class="flex items-center space-x-1.5">
        <div class="relative flex-1 flex gap-2 min-w-0 rounded-xl items-center cursor-pointer p-1.5 border-standard">
          <div class="rounded-lg font-bold px-1.5 py-0.5 text-sm leading-5 bg-blue-400/20 dark:bg-blue-400/20 text-blue-700 dark:text-blue-400">
            POST
          </div>
          <div class="flex items-center space-x-2 overflow-x-auto flex-1 no-scrollbar">
            <div class="group flex items-center flex-1 gap-0.5 font-mono">
              <div class="absolute right-0 p-2 bg-background-light dark:bg-background-dark rounded-lg hidden group-hover:block">
                <svg class="w-4 h-4 bg-gray-400 dark:bg-white/30"></svg>
              </div>
              <div class="text-sm text-gray-400">/</div>
              <div class="text-sm font-medium text-gray-800 dark:text-white min-w-max">
                public
              </div>
              <div class="text-sm text-gray-400">/</div>
              <div class="text-sm font-medium text-gray-800 dark:text-white min-w-max">
                v1
              </div>
              <div class="text-sm text-gray-400">/</div>
              <div class="text-sm font-medium text-gray-800 dark:text-white min-w-max">
                {type}
              </div>
              <div class="text-sm text-gray-400">/</div>
              <div class="text-sm font-medium text-gray-800 dark:text-white min-w-max">
                {path}
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>;
};

export const H3Bordered = ({text}) => <h3 id={text.toLowerCase()} className="border-b pb-2.5 border-gray-100 dark:border-gray-800">
    {text}
  </h3>;

export const Authorizations = () => {
  return <div>
      <H3Bordered text="Authorizations" />

      <Tabs>
        <Tab title="API Key">
          <div className="flex text-sm group/param-head param-head break-all relative" id="authorization-x-stamp">
            <ParamField header="X-Stamp" type="string" required={true}>
              Cryptographically signed (stamped) request to be passed in as a header. For more info, see <a href="https://docs.0xkey.io/developer-reference/api-overview/stamps">here</a>.
            </ParamField>
          </div>
        </Tab>

        <Tab title="WebAuthn (Passkey)">
         <div className="flex text-sm group/param-head param-head break-all relative" id="authorization-x-stamp-webauthn">
            <ParamField body="X-Stamp-WebAuthn" type="string" required={true}>
              Cryptographically signed (stamped) request to be passed in as a header. For more info, see <a href="https://docs.0xkey.io/developer-reference/api-overview/stamps">here</a>.
            </ParamField>
          </div>
        </Tab>
      </Tabs>
    </div>;
};

<EndpointPath type="query" path="get_attestation" />

<Authorizations />

Prefers a **fresh** NSM attestation via `qos_host` (live), with a short in-process
cache (60s). If live fetch fails, falls back to the latest stored boot proof's
`awsAttestationDocB64`. Never returns an empty success.

For full **pivot ↔ quorum-manifest** verification (PCRs + multi-sig approvals),
prefer [`get_latest_boot_proof`](/api-reference/queries/get-the-latest-boot-proof-for-an-app)
plus client-side `verifyBootProof` / `verifyLatestBootProof`. Use
`verifyAttestationDocument` from `@0xkey-io/crypto` when you only need the
hardware attestation chain (Turnkey-style attestation-validator).

<H3Bordered text="Body" />

<ParamField body="organizationId" type="string" required={true}>
  Unique identifier for a given Organization (fleet-wide evidence; used for API
  contract consistency only).
</ParamField>

<ParamField body="enclaveType" type="string" required={true}>
  Enclave app to attest (case-insensitive). Accepted values:

  * `signer`
  * `notarizer`
  * `tls-fetcher` / `fetcher`
  * `evm-parser` / `transaction-parser` / `parser`
  * `ump` / `policy-engine` / `policy` — Turnkey alias `ump` maps to 0xkey
    `policy-engine`
</ParamField>

<H3Bordered text="Response" />

A successful response returns the following fields:

<ResponseField name="attestationDocument" type="string" required={true}>
  Raw COSE Sign1 attestation document bytes (JSON transport encodes as
  base64 / `byte`).
</ResponseField>

<H3Bordered text="Errors" />

* `INVALID_ARGUMENT` — unknown `enclaveType` or invalid `organizationId`
* `FAILED_PRECONDITION` — no live qos\_host and no stored boot proof yet
* `UNAVAILABLE` — live NSM failed and store is empty

<H3Bordered text="Staging smoke" />

After deploying coordinator with `[qos_host_control]` and booted enclaves:

1. `POST /public/v1/query/get_attestation` with `enclaveType: "signer"` (stamped).
2. Assert `attestationDocument` is non-empty base64.
3. Decode bytes and run `verifyAttestationDocument` from `@0xkey-io/crypto` (asOf = now).
4. Optionally also call `get_latest_boot_proof` + `verifyBootProof` for the full pivot↔manifest chain.

<RequestExample>
  ```bash title="cURL" theme={"theme":{"light":"github-light","dark":"github-dark"}}
  curl --request POST \
    --url https://api.0xkey.io/public/v1/query/get_attestation \
    --header 'Accept: application/json' \
    --header 'Content-Type: application/json' \
    --header "X-Stamp: <string> (see Authorizations)" \
    --data '{
      "organizationId": "<string>",
      "enclaveType": "signer"
  }'
  ```

  ```javascript title="JavaScript" theme={"theme":{"light":"github-light","dark":"github-dark"}}
  import { ZeroXKey } from "@0xkey-io/sdk-server";
  import { verifyAttestationDocument } from "@0xkey-io/crypto";

  const zeroXKey = new ZeroXKey({
    apiBaseUrl: "https://api.0xkey.io",
    apiPublicKey: process.env.API_PUBLIC_KEY!,
    apiPrivateKey: process.env.API_PRIVATE_KEY!,
    defaultOrganizationId: process.env.ORGANIZATION_ID!,
  });

  const response = await zeroXKey.getAttestationDocument({
    organizationId: process.env.ORGANIZATION_ID!,
    enclaveType: "signer",
  });

  // JSON `byte` fields arrive as base64 strings from the HTTP client.
  const docBytes = Uint8Array.from(
    Buffer.from(response.attestationDocument as unknown as string, "base64"),
  );
  await verifyAttestationDocument(docBytes);
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  {
    "attestationDocument": "<base64-encoded COSE Sign1 bytes>"
  }
  ```
</ResponseExample>