> ## Documentation Index > Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get attestation evidence > Fetch request-local attestation metadata for a supported Attestable model in the Confidential or Encrypted tier. The gateway resolves the requested logical or provider-scoped model, generates or validates a fresh 32-byte challenge, and proxies provider evidence into a canonical envelope. The `verified` field is always `false` in the current server release: the in-band pinned-authority verifier was removed and clients that need cryptographic assurance verify the `evidence` bytes themselves against Intel DCAP QVL and NVIDIA NRAS. Top-level `signing_algo`, `signing_address`, `signing_key`, and `model_public_key` are populated from the raw provider envelope and are provider-observed and unverified. The endpoint returns HTTP 503 when the provider returns empty evidence, a nonce that differs from the request challenge at the JSON wire layer, a signing algorithm or address inconsistent with the request-time filters, or (for Encrypted routes) omits `model_public_key`. Evidence, nonces, signatures, signing keys, model public keys, and proof bodies are not persisted. ## OpenAPI ````yaml openapi.json GET /api/v1/attestation openapi: 3.1.0 info: contact: email: developers@trynito.ai name: Nito Developer Support url: https://docs.trynito.ai/support description: >- Nito developer API: inference, Fusion, model catalog, attestation, web retrieval, document parsing, API key management, balance, rate-limit snapshots, and MCP. termsOfService: https://trynito.ai/terms title: Nito API version: '2026-07-01' servers: - description: Configured gateway url: https://app.trynito.ai security: [] tags: - description: >- OpenAI Chat Completions-compatible inference routes backed by gateway routing, billing, privacy, and streaming controls. name: Chat - description: >- Stateless OpenAI Responses-compatible shims for agent clients, including the compact output-item endpoint used by standalone compaction flows. name: Responses - description: >- Anthropic Messages-compatible request, response, token-count, and streaming surfaces mapped into canonical gateway contracts. name: Messages - description: >- Model discovery and browser model-picker metadata for safe logical model selection. name: Models - description: >- Request-local Attestation metadata for supported Attestable models in the Confidential and Encrypted tiers. name: Attestation - description: >- Streamable HTTP MCP transport documented with resource-bound bearer-token authentication. name: MCP - description: >- Standalone, credential-authenticated web search and fetch without an inference model. name: Web - description: >- OAuth-authorized organization API key administration with explicit consent and current owner/admin authorization. name: API Keys - description: >- Browser billing, usage, referral, balance, auto top-up, and x402 funding surfaces using integer nanos. name: Billing externalDocs: description: Nito developer documentation url: https://docs.trynito.ai/nito paths: /api/v1/attestation: get: tags: - Attestation summary: Get request-local model attestation description: >- Fetch request-local attestation metadata for a supported Attestable model in the Confidential or Encrypted tier. The gateway resolves the requested logical or provider-scoped model, generates or validates a fresh 32-byte challenge, and proxies provider evidence into a canonical envelope. The `verified` field is always `false` in the current server release: the in-band pinned-authority verifier was removed and clients that need cryptographic assurance verify the `evidence` bytes themselves against Intel DCAP QVL and NVIDIA NRAS. Top-level `signing_algo`, `signing_address`, `signing_key`, and `model_public_key` are populated from the raw provider envelope and are provider-observed and unverified. The endpoint returns HTTP 503 when the provider returns empty evidence, a nonce that differs from the request challenge at the JSON wire layer, a signing algorithm or address inconsistent with the request-time filters, or (for Encrypted routes) omits `model_public_key`. Evidence, nonces, signatures, signing keys, model public keys, and proof bodies are not persisted. operationId: getAttestation parameters: - description: >- The `model` query parameter for this operation. The example value is placeholder-safe and must be replaced by the caller. example: openai/gpt-5.5 in: query name: model required: true schema: type: string - description: confidential or encrypted example: confidential in: query name: trust_tier required: false schema: enum: - confidential - encrypted type: string - description: >- Optional request-local challenge: exactly 32 random bytes encoded as 64 hexadecimal characters. The gateway generates one when omitted. example: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef in: query name: nonce required: false schema: maxLength: 64 minLength: 64 pattern: ^[0-9A-Fa-f]{64}$ type: string - description: Provider-specific signing address example: '0x0000000000000000000000000000000000000000' in: query name: signing_address required: false schema: type: string - description: Provider-specific signing algorithm example: ed25519 in: query name: signing_algo required: false schema: type: string responses: '200': content: application/json: example: attestation_available: true evidence: redacted: true model: phala/gpt-oss-20b:confidential model_public_key: >- 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef nonce: >- 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef object: attestation privacy_tier: confidential proof_format: provider_report provider_model_id: phala/gpt-oss-20b signing_address: '0x0000000000000000000000000000000000000000' signing_algo: ed25519 signing_key: >- 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef verified: false schema: $ref: '#/components/schemas/AttestationReport' description: OK headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string X-RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' X-RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/RateLimitReset' '400': content: application/json: example: error: code: invalid_request message: The request is invalid. schema: $ref: '#/components/schemas/ErrorResponse' description: Invalid request headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '401': content: application/json: example: error: code: unauthorized message: authentication required schema: $ref: '#/components/schemas/ErrorResponse' description: Authentication required headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '402': content: application/json: example: error: code: payment_required message: >- billing credits or an active subscription are required for this request schema: $ref: '#/components/schemas/ErrorResponse' description: Payment required headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '403': content: application/json: example: error: code: forbidden message: credential is not authorized for this operation schema: $ref: '#/components/schemas/ErrorResponse' description: Forbidden headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '405': content: application/json: example: error: code: invalid_request message: method not allowed schema: $ref: '#/components/schemas/ErrorResponse' description: Method not allowed headers: Allow: description: Allowed method for the attestation endpoint. example: GET schema: type: string Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '429': content: application/json: examples: insufficient_quota: summary: Billing balance or free-tier quota exhausted value: error: code: insufficient_quota message: insufficient billing balance rate_limited: summary: Gateway or provider rate limit exceeded value: error: code: rate_limited message: rate limited schema: $ref: '#/components/schemas/ErrorResponse' description: Rate limited or insufficient quota headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string Retry-After: description: >- Seconds to wait before retrying when the gateway can compute a retry window. example: '60' schema: type: string X-RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' X-RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/RateLimitReset' '500': content: application/json: example: error: code: internal_error message: internal error schema: $ref: '#/components/schemas/ErrorResponse' description: Internal server error headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '502': content: application/json: example: error: code: provider_error message: provider request failed schema: $ref: '#/components/schemas/ErrorResponse' description: Attestation provider failed headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string '503': content: application/json: example: error: code: unavailable message: service unavailable schema: $ref: '#/components/schemas/ErrorResponse' description: Service unavailable headers: Cache-Control: description: >- Always `no-store` for request-local attestation responses and errors. example: no-store schema: type: string security: - PublicApiBearer: [] - PublicApiKeyHeader: [] - CliOAuthBearer: [] components: schemas: AttestationReport: description: >- Schema for `AttestationReport` values returned by or accepted by the Nito gateway. example: attestation_available: true evidence: redacted: true model: phala/gpt-oss-20b:confidential model_public_key: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef nonce: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef object: attestation privacy_tier: confidential proof_format: provider_report provider_model_id: phala/gpt-oss-20b signing_address: '0x0000000000000000000000000000000000000000' signing_algo: ed25519 signing_key: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef verified: false properties: attestation_available: description: The `attestation_available` field on `AttestationReport`. example: true type: boolean attestation_subject: description: The `attestation_subject` field on `AttestationReport`. example: example type: string evidence: additionalProperties: true description: The `evidence` field on `AttestationReport`. example: {} type: object model: description: Routed attested model ID returned for the request. example: phala/gpt-oss-20b:confidential type: string model_public_key: description: >- Public key material for the attested model. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify `evidence` locally. example: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef type: string nonce: description: >- 32-byte hexadecimal challenge for this attestation request. Always populated in a successful response — the value the caller supplied verbatim if they passed one, or the value the server generated for callers who omitted it. Clients performing their own evidence verification compare this challenge against the nonce bound inside the Intel TDX `report_data`; a provider-echoed wire nonce that differs from the challenge is rejected upstream with HTTP 503 and never reaches this envelope. example: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef type: string object: description: The `object` field on `AttestationReport`. enum: - attestation example: attestation type: string privacy_tier: description: The `privacy_tier` field on `AttestationReport`. enum: - confidential - encrypted example: confidential type: string proof_format: description: The `proof_format` field on `AttestationReport`. example: example type: string provider_model_id: description: The `provider_model_id` field on `AttestationReport`. example: 00000000-0000-4000-8000-000000000001 type: string signing_address: description: >- Signing address (e.g. gateway- or model-bound signer) for the attested model. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify `evidence` locally. example: '0x0000000000000000000000000000000000000000' type: string signing_algo: description: >- Signature algorithm identifier for the attested model's signing key. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify `evidence` locally. example: ed25519 type: string signing_key: description: >- Public signing key material for the attested model, mirrored from `model_public_key`. Provider-observed and unverified in the current server release: sourced from the raw provider envelope, useful as a hint for consumers that verify `evidence` locally. example: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef type: string verified: description: >- Always false in the current server release: the in-band pinned-authority verifier was removed and clients that need cryptographic assurance verify `evidence` themselves. example: false type: boolean verifier_provenance: description: >- Always empty in the current server release. Preserved in the envelope for wire-contract compatibility with previously-persisted client state; the pinned-authority verifier path no longer runs on the server. example: '' type: string required: - object - model - provider_model_id - privacy_tier - attestation_available - verified - evidence type: object ErrorResponse: description: >- Schema for `ErrorResponse` values returned by or accepted by the Nito gateway. example: error: code: invalid_request message: The request is invalid. param: model properties: error: $ref: '#/components/schemas/Error' description: The `error` field on `ErrorResponse`. example: example required: - error type: object Error: description: Schema for `Error` values returned by or accepted by the Nito gateway. example: code: example message: example operation_id: 00000000-0000-4000-8000-000000000001 param: example properties: code: description: The `code` field on `Error`. example: example type: string message: description: The `message` field on `Error`. example: example type: string operation_id: description: The `operation_id` field on `Error`. example: 00000000-0000-4000-8000-000000000001 type: string param: description: The `param` field on `Error`. example: example type: string required: - message - code type: object headers: RateLimitLimit: description: Maximum requests for the controlling gateway request-rate bucket. schema: type: string RateLimitRemaining: description: >- Additional requests immediately available in the controlling gateway request-rate bucket. schema: type: string RateLimitReset: description: >- UTC Unix epoch seconds, rounded up, when the controlling gateway request-rate bucket is fully replenished. schema: type: string securitySchemes: PublicApiBearer: description: 'Org API key as Authorization: Bearer z_sk_...' scheme: bearer type: http PublicApiKeyHeader: description: Org API-key compatibility header. CLI and MCP tokens are rejected here. in: header name: X-API-Key type: apiKey CliOAuthBearer: description: 'OAuth CLI access token as Authorization: Bearer nito_cli_...' scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.