---
title: "Provision"
method: POST
path: "/servers/{vm_name}/provision"
tags: ["Servers"]
---

# Provision

`POST /servers/{vm_name}/provision`

Provision a new VM at runtime: record its root CA identity and issue storage secrets.

The RTMR3-attested runtime entry point for new VMs (supersedes /luks/attest going
forward). The VM presents its per-boot root CA as the mTLS client cert; the quote's
REPORTDATA binds SHA256(that cert's pubkey), so the same cert_hash check that guards
/luks/attest also proves CA possession — no bespoke quote logic is needed.
require_luks_quote_nonce validates and consumes the runtime nonce; the handler verifies
the quote (signature + all RTMR measurements incl. RTMR3), records
server.vm_root_ca_cert (idempotent), and returns rotated passphrases, the k3s encryption
key, and a confirm nonce.

## Path parameters

- `vm_name` string, required

## Headers

- `X-Chutes-Hotkey` string, nullable
- `X-Quote-Nonce` string, nullable

## Request body

- ProvisionRequest — Request model for POST /servers/{vm_name}/provision. The runtime (RTMR3-attested) provisioning entry point for new VMs. The VM presents its root CA as the mTLS client cert; the quote's REPORTDATA binds SHA256(that cert's pubkey), so the CA identity is recorded from this call. Mirrors the luks/attest body today (quote + volumes) and is the extensible home for future provisioning inputs.
  - `quote` string, required — Base64-encoded TDX quote (runtime type, RTMR3 extended)
  - `volumes` string[], required — Volume names to rotate passphrases for

## Response `200`

Successful Response

- ProvisionResponse — Response model for POST /servers/{vm_name}/provision. Carries the storage-provisioning secrets today (rotated volume passphrases, k3s encryption key, confirm nonce); shaped to extend with future provisioning outputs.
  - `volumes` object, required
  - `confirm_nonce` string, required — Single-use nonce for POST /provision/confirm
  - `k3s_encryption_key` string, required — k3s encryption key (base64)

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/chutes/apis/fastapi.md) · [All operations](https://skmtc.net/chutes/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/chutes/fastapi/versions/352418d4e3a2/schema)