Get request-local model attestation

curl --request GET \
  --url https://app.trynito.ai/api/v1/attestation \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://app.trynito.ai/api/v1/attestation', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.trynito.ai/api/v1/attestation",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.trynito.ai/api/v1/attestation"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.trynito.ai/api/v1/attestation")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "attestation_available": true,
  "evidence": {
    "redacted": true
  },
  "model": "phala/gpt-oss-20b:confidential",
  "model_public_key": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "nonce": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "object": "attestation",
  "privacy_tier": "confidential",
  "proof_format": "provider_report",
  "provider_model_id": "phala/gpt-oss-20b",
  "signing_address": "0x0000000000000000000000000000000000000000",
  "signing_algo": "ed25519",
  "signing_key": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "verified": false
}

Attestation

Get attestation evidence

Fetch request-local attestation metadata for a supported Attestable model in the Confidential or Encrypted tier.

The gateway resolves the requested logical or provider-scoped model, generates or validates a fresh 32-byte challenge, and proxies provider evidence into a canonical envelope. The verified field is always false in the current server release: the in-band pinned-authority verifier was removed and clients that need cryptographic assurance verify the evidence bytes themselves against Intel DCAP QVL and NVIDIA NRAS. Top-level signing_algo, signing_address, signing_key, and model_public_key are populated from the raw provider envelope and are provider-observed and unverified. The endpoint returns HTTP 503 when the provider returns empty evidence, a nonce that differs from the request challenge at the JSON wire layer, a signing algorithm or address inconsistent with the request-time filters, or (for Encrypted routes) omits model_public_key. Evidence, nonces, signatures, signing keys, model public keys, and proof bodies are not persisted.

GET

api

attestation

Get request-local model attestation

curl --request GET \
  --url https://app.trynito.ai/api/v1/attestation \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://app.trynito.ai/api/v1/attestation', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.trynito.ai/api/v1/attestation",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.trynito.ai/api/v1/attestation"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.trynito.ai/api/v1/attestation")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "attestation_available": true,
  "evidence": {
    "redacted": true
  },
  "model": "phala/gpt-oss-20b:confidential",
  "model_public_key": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "nonce": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "object": "attestation",
  "privacy_tier": "confidential",
  "proof_format": "provider_report",
  "provider_model_id": "phala/gpt-oss-20b",
  "signing_address": "0x0000000000000000000000000000000000000000",
  "signing_algo": "ed25519",
  "signing_key": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "verified": false
}

Authorizations

Authorization

string

header

required

Org API key as Authorization: Bearer z_sk_...

Query Parameters

model

string

required

The model query parameter for this operation. The example value is placeholder-safe and must be replaced by the caller.

trust_tier

enum<string>

confidential or encrypted

Available options:

confidential,

encrypted

nonce

string

Optional request-local challenge: exactly 32 random bytes encoded as 64 hexadecimal characters. The gateway generates one when omitted.

Required string length: 64

Pattern: ^[0-9A-Fa-f]{64}$

signing_address

string

Provider-specific signing address

signing_algo

string

Provider-specific signing algorithm

Response

Schema for AttestationReport values returned by or accepted by the Nito gateway.

attestation_available

boolean

required

The attestation_available field on AttestationReport.

Example:

true

evidence

object

required

The evidence field on AttestationReport.

Example:

{}

model

string

required

Routed attested model ID returned for the request.

Example:

"phala/gpt-oss-20b:confidential"

object

enum<string>

required

The object field on AttestationReport.

Available options:

attestation

Example:

"attestation"

privacy_tier

enum<string>

required

The privacy_tier field on AttestationReport.

Available options:

confidential,

encrypted

Example:

"confidential"

provider_model_id

string

required

The provider_model_id field on AttestationReport.

Example:

"00000000-0000-4000-8000-000000000001"

verified

boolean

required

Always false in the current server release: the in-band pinned-authority verifier was removed and clients that need cryptographic assurance verify evidence themselves.

Example:

false

attestation_subject

string

The attestation_subject field on AttestationReport.

Example:

"example"

model_public_key

string

Public key material for the attested model. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify evidence locally.

Example:

"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

nonce

string

32-byte hexadecimal challenge for this attestation request. Always populated in a successful response — the value the caller supplied verbatim if they passed one, or the value the server generated for callers who omitted it. Clients performing their own evidence verification compare this challenge against the nonce bound inside the Intel TDX report_data; a provider-echoed wire nonce that differs from the challenge is rejected upstream with HTTP 503 and never reaches this envelope.

Example:

"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

proof_format

string

The proof_format field on AttestationReport.

Example:

"example"

signing_address

string

Signing address (e.g. gateway- or model-bound signer) for the attested model. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify evidence locally.

Example:

"0x0000000000000000000000000000000000000000"

signing_algo

string

Signature algorithm identifier for the attested model's signing key. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify evidence locally.

Example:

"ed25519"

signing_key

string

Public signing key material for the attested model, mirrored from model_public_key. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify evidence locally.

Example:

"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

verifier_provenance

string

Always empty in the current server release. Preserved in the envelope for wire-contract compatibility with previously-persisted client state; the pinned-authority verifier path no longer runs on the server.

Example:

""

Basics

Features

Server-Side Tools

Multimodal

Best Practices

SDKs

API Reference

Get attestation evidence

Authorizations

Query Parameters

Response