---
title: "Attest Luks"
method: POST
path: "/servers/{vm_name}/luks/attest"
tags: ["Servers"]
---

# Attest Luks

`POST /servers/{vm_name}/luks/attest`

Rotate LUKS passphrases for new-format VMs (version >= 1.3.0).

DEPRECATED: superseded by POST /provision, which does the same storage rotation and
additionally records the VM root CA identity. Kept unchanged for legacy in-field VMs;
retire once the fleet upgrades.

The VM embeds the luks_quote_nonce (received in the boot attestation response)
in a TDX quote after extending RTMR3 in initramfs. require_luks_quote_nonce
validates and consumes the nonce; the handler then calls verify_quote which
checks the TDX signature and all RTMR measurements including RTMR3. Returns
rotated passphrases, the k3s encryption key, and a confirm nonce.

## Path parameters

- `vm_name` string, required

## Headers

- `X-Chutes-Hotkey` string, nullable
- `X-Quote-Nonce` string, nullable

## Request body

- LuksAttestRequest — Request model for POST /luks/attest.
  - `quote` string, required — Base64-encoded TDX quote (runtime type, RTMR3 extended)
  - `volumes` string[], required — Volume names to rotate passphrases for

## Response `200`

Successful Response

- LuksAttestResponse — Response model for POST /luks/attest.
  - `volumes` object, required
  - `confirm_nonce` string, required — Single-use nonce for the confirm endpoint
  - `k3s_encryption_key` string, required — k3s encryption key (base64)

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/chutes/apis/fastapi.md) · [All operations](https://skmtc.net/chutes/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/chutes/fastapi/versions/352418d4e3a2/schema)