Los datos se quedan dentro del nivel elegido.

# 1. Haz una petición y guarda la cabecera
curl -sD - -o /dev/null https://api.situra.ai/v1/chat/completions \
  -H "Authorization: Bearer $SITURA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5-mini","messages":[{"role":"user","content":"Hola"}]}' \
  | grep -i '^x-situra-attestation:'

# 2. Descarga las claves públicas de la pasarela
curl -s https://api.situra.ai/.well-known/situra-attestation-keys

import base64, json, sys, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

GATEWAY = "https://api.situra.ai"
token = sys.argv[1]  # valor de la cabecera x-situra-attestation

def b64d(s: str) -> bytes:
    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

header_b64, claims_b64, sig_b64 = token.split(".")
header = json.loads(b64d(header_b64))
assert header["alg"] == "EdDSA" and header["typ"] == "situra-residency+jwt"

jwks = json.load(urllib.request.urlopen(f"{GATEWAY}/.well-known/situra-attestation-keys"))
jwk = next(k for k in jwks["keys"] if k["kid"] == header["kid"])
key = Ed25519PublicKey.from_public_bytes(b64d(jwk["x"]))
key.verify(b64d(sig_b64), f"{header_b64}.{claims_b64}".encode())  # lanza excepción si no es válida

claims = json.loads(b64d(claims_b64))
print("verified:", claims["rid"], claims["residency"], claims["region"], claims["provider"])

import { createPublicKey, verify } from "node:crypto";

const GATEWAY = "https://api.situra.ai";
const token = process.argv[2]; // valor de la cabecera x-situra-attestation
const [h, c, s] = token.split(".");
const header = JSON.parse(Buffer.from(h, "base64url"));
if (header.alg !== "EdDSA" || header.typ !== "situra-residency+jwt") throw new Error("not an attestation");

const { keys } = await (await fetch(`${GATEWAY}/.well-known/situra-attestation-keys`)).json();
const jwk = keys.find((k) => k.kid === header.kid);
const ok = verify(null, Buffer.from(`${h}.${c}`), createPublicKey({ key: jwk, format: "jwk" }), Buffer.from(s, "base64url"));
if (!ok) throw new Error("bad signature");

const claims = JSON.parse(Buffer.from(c, "base64url"));
console.log("verified:", claims.rid, claims.residency, claims.region, claims.provider);