API Spec

The production endpoint is https://api.confidential.ai.

The gateway checks API keys before it sends a request to the inference service. It does not send the API key to the inference service.

Quickstart

export CONFIDENTIAL_API_BASE='https://api.confidential.ai'
export CONFIDENTIAL_API_KEY='<API_KEY>'

curl --fail --silent "$CONFIDENTIAL_API_BASE/v1/models" \
  -H "Authorization: Bearer $CONFIDENTIAL_API_KEY" | jq .

curl --fail --silent "$CONFIDENTIAL_API_BASE/v1/chat/completions" \
  -H "Authorization: Bearer $CONFIDENTIAL_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{
    "model": "deepseek-ai/DeepSeek-V4-Flash-0731",
    "messages": [{"role": "user", "content": "Reply with one word."}],
    "stream": false
  }' | jq .

Authentication

All /v1/* endpoints require this header:

Authorization: Bearer <API_KEY>

/health and /attestation are public. They have rate limits. Do not send an API key or a prompt to /attestation.

Keep your API key private. Contact Confidential AI if you need a new key or need to disable an existing key.

Health

GET /health

Returns the health of the gateway process.

curl --fail --silent "$CONFIDENTIAL_API_BASE/health" | jq .

Example response:

{"status":"ok"}

Health is not attestation evidence.

Attestation

GET /attestation?nonce={base64url}

Returns fresh c8s launch or admission evidence. This is the only public attestation endpoint.

The nonce must decode to exactly 32 random bytes. It must use URL-safe base64 without padding. Generate a new nonce for each request.

NONCE="$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')"

curl --fail --silent \
  "$CONFIDENTIAL_API_BASE/attestation?nonce=$NONCE" | jq .

The endpoint also accepts the nonce in the X-Attestation-Nonce header. Do not send both forms.

The response contains evidence for these workloads:

• gateway
• sglang-router
• inference-worker
• metrics-collector
• kube-state-metrics

Example response shape:

{
  "schemaVersion": 1,
  "scope": "launch-or-admission-only",
  "nonce": "43-character-base64url-value",
  "operationalStatus": "not-verified",
  "receipts": [
    {"target": "gateway", "workload": "gateway", "receipt": {}},
    {"target": "sglang-router", "workload": "sglang-router", "receipt": {}},
    {"target": "inference-worker", "workload": "inference-worker", "receipt": {}},
    {"target": "metrics-collector", "workload": "metrics-collector", "receipt": {}},
    {"target": "kube-state-metrics", "workload": "kube-state-metrics", "receipt": {}}
  ]
}

Each receipt uses the c8s/attest-pq/v1 format. Use an independent c8s verifier. Verify all of these items:

1. Intel TDX evidence and collateral.
2. The caller nonce binding.
3. The expected confidential VM base-image measurements.
4. The c8s operator-key binding.
5. The workload identity and approved allowlist digest.
6. The OCI image digest and effective command approved for each workload.

The result proves launch or admission facts. It does not prove current health, model output quality, availability, or GPU state.

Models

GET /v1/models

Returns the model catalog. This endpoint requires an API key.

curl --fail --silent "$CONFIDENTIAL_API_BASE/v1/models" \
  -H "Authorization: Bearer $CONFIDENTIAL_API_KEY" | jq .

The production service returns this model:

{
  "object": "list",
  "data": [
    {"id": "deepseek-ai/DeepSeek-V4-Flash-0731", "object": "model", "owned_by": "confidential.ai"}
  ]
}

Chat completions

POST /v1/chat/completions

Accepts an OpenAI-compatible chat-completions request. This endpoint requires an API key. Use an exact model ID from /v1/models.

For streaming requests, the response uses text/event-stream and ends with:

data: [DONE]

Text completions

POST /v1/completions

Accepts an OpenAI-compatible text-completions request. This endpoint requires an API key.

curl --fail --silent "$CONFIDENTIAL_API_BASE/v1/completions" \
  -H "Authorization: Bearer $CONFIDENTIAL_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{
    "model": "deepseek-ai/DeepSeek-V4-Flash-0731",
    "prompt": "Reply with one word.",
    "stream": false
  }' | jq .

The prompt can be a string or an array. Streaming responses use server-sent events and end with data: [DONE].

Errors

JSON errors use this shape:

{
  "error": {
    "code": "machine_readable_code",
    "message": "Human-readable message"
  }
}