Phala Cloud Documentation — Confidential AI on TEE

Signature

curl --request GET \
  --url https://api.example.com/signature/{id}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/signature/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/signature/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/signature/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

GET

signature

{id}

Signature

curl --request GET \
  --url https://api.example.com/signature/{id}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/signature/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/signature/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/signature/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

GET /v1/signature/{id} is a legacy compatibility endpoint. It returns the same proof as the canonical Get Receipt endpoint, but wrapped in the older text, signature, and signing_address envelope. New integrations should use GET /v1/aci/receipts/{id}.

Endpoint

GET https://inference.phala.com/v1/signature/{id}

Parameters

string

required

Receipt id (rcpt-...) or response id from POST /v1/chat/completions.

Example

curl "https://inference.phala.com/v1/signature/$RECEIPT_OR_RESPONSE_ID" \
  -H "Authorization: Bearer <API_KEY>"

Response

Field	Description
`api_version`	ACI version token, for example `aci/1`.
`signing_algo`	Signature algorithm, for example `ecdsa`.
`signing_address`	Address that signed `text`.
`text`	`"<request body hash>:<response hash>"`.
`signature`	Signature over `text`.
`receipt`	Full receipt object, identical to the canonical `/v1/aci/receipts/{id}` response.

{
  "api_version": "aci/1",
  "signing_algo": "ecdsa",
  "signing_address": "0xffb22d95...",
  "text": "111d08a5...:07703fb4...",
  "signature": "0xd0cd266a...",
  "receipt": {
    "receipt_id": "rcpt-...",
    "event_log": ["..."],
    "signature": "..."
  }
}

Verification

For new clients, verify the receipt object directly:

Fetch a fresh Attestation Report.
Confirm receipt.workload_id and receipt.workload_keyset_digest match the report.
Verify receipt.signature under a receipt_signing_keys entry from the attested keyset.
Confirm the request and response hashes in receipt.event_log match the bytes you sent and received.

For legacy clients that verify the wrapper, also verify signature over text, then bind signing_address back to a fresh attestation report.

Get Receipt

Verify a Response

Get Session Embeddings

​Endpoint

​Parameters

​Example

​Response

​Verification

​Related