---
title: "Validate confidential compute attestation evidence against the hardware vendors (AMD SEV-SNP, Intel TDX, NVIDIA)"
method: POST
path: "/v1/confidential-compute/attestation/validate"
tags: ["Confidential Compute"]
---

# Validate confidential compute attestation evidence against the hardware vendors (AMD SEV-SNP, Intel TDX, NVIDIA)

`POST /v1/confidential-compute/attestation/validate`

## Request body

- object
  - `nonce` string, required — Per-request freshness challenge sent to the hardware, base64 (64 bytes, AEP-83 §5)
  - `report` string, required — CPU attestation report (AMD SEV-SNP or Intel TDX quote), base64
  - `tee_platform` 'snp' | 'tdx' | 'snp-gpu' | 'tdx-gpu', required — TEE platform that produced the evidence
  - `cert_chain` string — CPU vendor cert chain, base64; may be empty (e.g. AMD VCEK fetched from KDS)
  - `auxblob` string — Platform auxiliary blob (e.g. TDX collateral), base64; may be empty
  - `gpu_reports` object[] — Per-GPU attestation reports; empty for CPU-only platforms
    - `device_index` integer, required — GPU device index this report attests
    - `report` string, required — Hardware-signed GPU attestation report (embeds the device cert chain), base64

## Response `200`

Per-report attestation verdicts

- object
  - `overall` 'valid' | 'invalid' | 'unverifiable', required — Rollup: valid only if every report is valid; invalid if any report is invalid; otherwise unverifiable
  - `nonce` string, required — Echo of the request nonce, for client correlation
  - `reports` union[], required
    - union
      - object
        - `kind` 'cpu', required
        - `vendor` 'amd-sev-snp' | 'intel-tdx', required
        - `status` 'valid' | 'invalid' | 'unverifiable', required — valid = chained to the vendor root, signature/EAT verified, and bound to the request nonce; invalid = a check ran and failed (bad signature, untrusted chain, nonce mismatch); unverifiable = the check could not be completed (vendor service unreachable, not configured, missing material)
        - `detail` string, required — Human-readable explanation of the verdict
        - `checks` object — Granular sub-results behind the verdict; fields are omitted when not evaluated
          - `certChainValid` boolean — Evidence chains to the vendor root certificate
          - `signatureValid` boolean — The report/EAT signature verified
          - `nonceMatch` boolean — The evidence is bound to the request nonce
          - `notRevoked` boolean — Revocation status; omitted when revocation was not checked
      - object
        - `kind` 'gpu', required
        - `device_index` integer, required
        - `vendor` 'nvidia', required
        - `status` 'valid' | 'invalid' | 'unverifiable', required — valid = chained to the vendor root, signature/EAT verified, and bound to the request nonce; invalid = a check ran and failed (bad signature, untrusted chain, nonce mismatch); unverifiable = the check could not be completed (vendor service unreachable, not configured, missing material)
        - `detail` string, required — Human-readable explanation of the verdict
        - `checks` object — Granular sub-results behind the verdict; fields are omitted when not evaluated
          - `certChainValid` boolean — Evidence chains to the vendor root certificate
          - `signatureValid` boolean — The report/EAT signature verified
          - `nonceMatch` boolean — The evidence is bound to the request nonce
          - `notRevoked` boolean — Revocation status; omitted when revocation was not checked

## Other responses

- `400` — Invalid request body

---

[API](https://skmtc.net/akash-network/apis/akash-network-console-api.md) · [All operations](https://skmtc.net/akash-network/apis/akash-network-console-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akash-network/akash-network-console-api/versions/bb0b68662ba3/schema)