Token Secure Boot Attestation

Request Secure Boot Attestation Challenge word

This endpoint initiates a Secure Boot attestation by requesting a Challenge Word (BootCW) for a sequence of devices. The client submits the ordered device chain with optional data for each device. The service responds with a BootCW and a transaction ID, which can be used to track or validate the Secure Boot attestation process.

Method & Endpoint

Method: POST

Endpoint: /api/device/requestSecureBootAttestationCW

Headers: CF-Access-Client-ID and CF-Access-Client-Secret

Request Body

{
  "requestSignedResponse": false,
  "chain": [
    {
      "sequence": 1,
      "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",
      "data": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    },
    {
      "sequence": 2,
      "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",
      "data": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    },
    {
      "sequence": 3,
      "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",
      "data": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    }
  ]
}

✅ Successful Response — 201 Created

{
  "transactionId": "123e4567-e89b-12d3-a456-426614174000",
  "BootCW": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}

❌ Error Responses

401 Unauthorized — Invalid authentication

{
  "statusCode": 401,
  "message": "Unauthorized"
}

403 Forbidden — Authorization Forbidden

{
  "statusCode": 403,
  "message": "Invalid request",
  "error": "Forbidden"
}

Reply Secure Boot Attestation Response Word

This endpoint completes the Secure Boot attestation by submitting the Response Word (RW) for the previously issued Boot Challenge Word (BootCW). The client sends the original device chain, the BootCW, the Host Response Word (HRW), and the transaction ID. The service validates the response and finalizes the Secure Boot attestation process.

Method & Endpoint

Method: POST

Endpoint: /api/device/replySecureBootAttestationRW

Headers: CF-Access-Client-ID and CF-Access-Client-Secret

Request Body

{
  "requestSignedResponse": false,
  "chain": [
    {
      "sequence": 1,
      "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",
      "data": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    },
    {
      "sequence": 2,
      "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",
      "data": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    },
    {
      "sequence": 3,
      "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",
      "data": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    }
  ],
  "BootCW": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "HRW": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
  "transactionId": "123e4567-e89b-12d3-a456-426614174000"
}

✅ Successful Response — 201 Created

{
  "transactionId": "123e4567-e89b-12d3-a456-426614174000"
}

❌ Error Responses

401 Unauthorized — Invalid authentication

{
  "statusCode": 401,
  "message": "Unauthorized"
}

403 Forbidden — Authorization Forbidden

{
  "statusCode": 403,
  "message": "Invalid request",
  "error": "Forbidden"
}

Check Request Secure Boot Attestation Status

This endpoint retrieves the current status of a Secure Boot attestation request. By providing the transaction ID in the headers, the client can determine whether the attestation has completed successfully, failed, or is still being processed.

Method & Endpoint

Method: GET

Endpoint: /api/device/checkRequestSecureBootAttestationStatus

Headers: transactionId , CF-Access-Client-Id and CF-Access-Client-Secret

✅ Successful Response — 201 Created

{
  "status": [
    "AUTH_OK",
    "AUTH_NOT_OK",
    "PROCESSING"
  ]
}

❌ Error Responses

401 Unauthorized — Invalid authentication

{
  "statusCode": 401,
  "message": "Unauthorized"
}

403 Forbidden — Authorization Forbidden

{
  "statusCode": 403,
  "message": "Invalid request",
  "error": "Forbidden"
}