> ## Documentation Index > Fetch the complete documentation index at: https://docs.zode.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attest a region > Attestation of every active host in a region (any role). `zode verify `. Hosts are named by a short hash, never by node id. A host that does not answer is listed with class `none`. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/regions/{region}/attestation openapi: 3.1.0 info: title: Zode API version: 0.1.0 description: Sandboxes for coding agents. Every route takes an API key as a bearer token. servers: - url: https://api.zode.dev security: - bearerAuth: [] tags: - name: Sandboxes - name: Commands - name: Browser and desktop - name: Snapshots - name: Images - name: Environments - name: Flight recorder - name: Attestation - name: Agents - name: Proxying - name: Webhooks - name: OpenTelemetry - name: Alerts - name: CI - name: Usage and billing - name: Workspace - name: Platform paths: /v1/regions/{region}/attestation: parameters: - name: region in: path required: true schema: type: string example: eu-central get: tags: - Attestation summary: Attest a region description: |- Attestation of every active host in a region (any role). `zode verify `. Hosts are named by a short hash, never by node id. A host that does not answer is listed with class `none`. operationId: getRegionAttestation parameters: - $ref: '#/components/parameters/AttestNonce' responses: '200': description: The region's hosts content: application/json: schema: type: object required: - region - hosts properties: region: type: string hosts: type: array items: $ref: '#/components/schemas/HostAttestation' '400': description: '`invalid_nonce`.' content: application/json: schema: $ref: '#/components/schemas/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' '501': description: '`attestation_unavailable`: the fleet does not report attestation.' content: application/json: schema: $ref: '#/components/schemas/Error' components: parameters: AttestNonce: name: nonce in: query required: false description: >- 8 to 32 bytes of hex. On tpm_quoted hosts the TPM quotes the boot PCRs with it, so the quote cannot be replayed. schema: type: string pattern: ^([0-9a-fA-F]{2}){8,32}$ schemas: HostAttestation: type: object description: One host's attestation. required: - host - region - report - verdict properties: host: type: string description: Short hash naming the host, e.g. host-1a2b3c4d region: type: string report: type: object description: >- What the host reports, unchanged. Verify it yourself with `zode verify`. required: - class properties: class: type: string enum: - tpm_quoted - signed_image - none release: type: string manifest: type: string format: byte description: Release manifest exactly as signed manifest_digest: type: string description: sha256 of manifest, hex bundle: type: object description: Sigstore bundle (v0.3) for the manifest measured: type: array items: type: object required: - name - path - sha256 properties: name: type: string path: type: string sha256: type: string error: type: string measured_at: type: string format: date-time quote: type: object description: TPM2 quote over the nonce (tpm_quoted hosts only) properties: nonce: type: string attest: type: string format: byte signature: type: string format: byte ak_public: type: string pcrs: type: object additionalProperties: type: string error: type: string verdict: type: object description: >- This server's own check of the report (shown in the console; gates secret delivery when required). required: - ok - class - claimed - checks properties: ok: type: boolean class: type: string enum: - tpm_quoted - signed_image - none description: What was proven, which can be less than claimed claimed: type: string release: type: string manifest_digest: type: string log: type: object properties: log: type: string log_url: type: string log_index: type: integer tree_size: type: integer root_hash: type: string integrated_time: type: string format: date-time set: type: boolean checks: type: array items: type: string limits: type: array items: type: string problem: type: string Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string examples: - not_found - rate_limited - plan_required description: | Stable machine code; branch on it rather than on `message`. Deliberately not a closed enum: new codes are added over time, so treat an unknown code by its HTTP status. The codes in use, by status (a few appear under two): - 400: `bad_request` (malformed JSON or unknown field), `invalid_request`, `bad_signature`, `confirm_required`, `default_environment`, `email_not_allowed`, `endpoint_required`, `invalid_code`, `invalid_email`, `invalid_image`, `invalid_name`, `invalid_nonce`, `invalid_state`, `invalid_token`, `not_admin`, `order_mismatch`, `org_required`, `owner_cannot_leave`, `password_too_long`, `password_too_short`, `personal_workspace`, `same_email`, `secret_unsupported`, `self`, `too_many`, `unknown_channel`, `unknown_environment`, `unknown_installation`, `url_not_allowed`, `use_transfer` - 401: `unauthorized`, `invalid_credentials`, `bad_signature` - 402: `plan_required` (the plan does not include it), `credit_exhausted` (no credit left and no card on file) - 403: `forbidden` (the role may not), `token_scope`, `csrf`, `cors`, `email_unverified`, `installation_not_yours`, `no_user`, `not_yours`, `subscriptions_off`, `wrong_account`, `wrong_password` - 404: `not_found`, `code_not_found`, `invalid_invite`, `not_configured`, `unknown_node`, `unknown_org`, `unknown_sandbox` - 409: `invalid_state` (wrong sandbox status), `concurrency_limit` (plan's running-sandbox cap), `daily_cap_reached` (workspace daily spend cap), `limit_reached`, `name_taken`, `node_full`, `not_running`, `browser_off`, `desktop_off`, `already_deleted`, `already_linked`, `already_member`, `already_on_plan`, `billing_not_open`, `checkout_required`, `code_not_applicable`, `code_redeemed`, `code_taken`, `endpoint_disabled`, `installation_taken`, `invite_pending`, `last_method`, `no_sandbox`, `not_placed`, `not_waiting`, `sandboxes_running`, `sole_owner`, `too_many_keys`, `trial_unavailable`, `trial_used` - 410: `expired`, `used`, `expired_token`, `expired_invite`, `code_expired`, `code_used_up` - 413: `too_large` - 415: `unsupported_media_type` - 429: `rate_limited` (see the RateLimited response), `too_many_viewers` (desktop viewers) - 500: `internal` - 501 (this server or host cannot do it yet): `feature_unavailable`, `attach_unavailable`, `exec_unavailable`, `snapshots_unavailable`, `images_unavailable`, `recorder_unavailable`, `attestation_unavailable` - 502: `node_error`, `host_unreachable`, `key_destroy_failed`, `provider_error`, `github_error`, `recorder_error` - 503: `no_capacity`, `unhealthy`, `alerts_unavailable`, `auth_unavailable`, `ci_unavailable`, `email_unavailable`, `ingest_unavailable`, `secrets_unavailable`, `webhook_not_ready` The device-flow code and token endpoints answer 400 in the RFC 6749/8628 shape instead (OAuthError). message: type: string responses: Error: description: Error content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: zode_tok_<64 hex chars> description: >- An API key (`zode_tok_...`). Create one in the console under API keys (https://console.zode.dev/tokens), or with `zode login`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.