Tinfoil Enclaves serve the remote attestation document (RAD) over HTTP at the well known endpoint /.well-known/tinfoil-attestation.

The document is a JSON object containing a type and a signed enclave remote attestation payload.

​
Schema

{
  "format": "<PREDICATE_TYPE>",
  "body": "<ATTESTATION_BODY>"
}

​
Fields

The RAD is represented as a JSON object with the following fields:

format string (TypeURI), required

URI identifying the type of attestation format. This URI is identical to the predicate TypeURI field in the enclave’s Sigstore attestations, conformant to in-toto.io/Statement/v1. Currently supported format is: https://tinfoil.sh/predicate/aws-nitro-enclave/v1

body string, required

The attestation document body containing the measurements and verification data. Format and content requirements depend on the specified attestation format.