# GET /api/v1/attestation — Memory TEE Privacy Attestation

> GET /api/v1/attestation — Memory TEE Privacy Attestation is a paid API for AI agents from memory.withzero.xyz, paid per call via MPP, price unknown, status unknown (last checked 2026-09-13, last successful call 2026-07-29).

Returns the current confidential-compute attestation status, encryption-at-rest configuration, privacy tier, residual risks, and GCP verification commands for the memory.withzero.xyz agent memory service.

## Facts

- Endpoint: GET https://memory.withzero.xyz/api/v1/attestation
- Price: price unknown
- Payment: MPP
- Status: unknown
- Last checked: 2026-09-13
- Last successful call: 2026-07-29
- Success rate: 100% of calls made through Zero
- Activations on Zero: 3
- Provider: memory.withzero.xyz
- Website: https://memory.withzero.xyz
- Canonical page: https://www.zero.xyz/c/memory-withzero-xyz-get-api-v1-attestation-memory-tee-privacy-02e0e832
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ishA-yasTfPnJqVaaAbuM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability memory-withzero-xyz-get-api-v1-attestation-memory-tee-privacy-02e0e832
```

Example prompt: Can you pull the current attestation report for the memory.withzero.xyz service — I want to see the privacy tier, what encryption scheme is in use, which image digest the KMS grant is bound to, and any residual risks I should know about before I trust it with agent data?

## When to prefer this

Use this endpoint before storing sensitive data in the memory service to independently verify the privacy guarantees, encryption scheme, and TEE configuration. Prefer this over documentation alone because it reflects the live deployment state, including the currently bound image digest and any residual risks that may have changed since docs were written. Ideal for compliance checks, trust bootstrapping, or automated pre-flight verification in agent pipelines.

## Known failure modes

- Service unavailable — enclave or attestation endpoint is temporarily down
- Enclave status reflects degraded or non-confidential state — caller should treat data as unprotected
- Missing required fields in response if attestation metadata is partially initialized
- Network error or timeout reaching memory.withzero.xyz
- Bound image digest is null — no image has been bound yet, DEK-unwrap grant is not active

## Output

A JSON object containing: the current privacy tier string, encryption-at-rest details (scheme, KMS key ARN, embeddings side-channel disclosure), enclave details (status, bound image digest, workload identity pool, KMS grant identifier), an array of residual risks the deployment does not yet protect against, and an array of shell commands the caller can run against GCP directly to independently verify all claims.

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "privacy_tier",
  "encryption_at_rest",
  "enclave",
  "residual_risks",
  "verify"
 ],
 "properties": {
  "verify": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Commands a buyer can run to check the claims against GCP directly."
  },
  "enclave": {
   "type": "object",
   "required": [
    "status",
    "bound_image_digest",
    "workload_identity_pool",
    "kms_grant"
   ],
   "properties": {
    "status": {
     "type": "string",
     "description": "Honest state of the confidential-compute rails."
    },
    "kms_grant": {
     "type": "string",
     "description": "The operator-blindness grant to verify."
    },
    "bound_image_digest": {
     "anyOf": [
      {
       "type": "string"
      },
      {
       "type": "null"
      }
     ],
     "description": "The ONLY image the DEK-unwrap grant is bound to. Any other build — even validly attested — is denied the key."
    },
    "workload_identity_pool": {
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "privacy_tier": {
   "type": "string",
   "description": "Current tier per docs/memory-tee-privacy-design.md."
  },
  "residual_risks": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "What this deployment does NOT yet protect against — read before trusting."
  },
  "encryption_at_rest": {
   "type": "object",
   "required": [
    "scheme",
    "kms_key",
    "embeddings"
   ],
   "properties": {
    "scheme": {
     "type": "string"
    },
    "kms_key": {
     "type": "string"
    },
    "embeddings": {
     "type": "string",
     "description": "The disclosed side-channel: vectors stay cleartext so pgvector can search them (closed by Tier B+)."
    }
   },
   "additionalProperties": false
  }
 },
 "additionalProperties": false
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/memory-withzero-xyz-get-api-v1-attestation-memory-tee-privacy-02e0e832/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from memory.withzero.xyz](https://www.zero.xyz/host/memory.withzero.xyz/llms.txt)