pub struct ApiClient { /* private fields */ }
Expand description
Client for interacting with Intel Trusted Services API.
Provides methods to access both SGX and TDX certification services, supporting API versions V3 and V4. This client offers functionality to register platforms, retrieve PCK certificates and CRLs, fetch TCB information, enclave identities, as well as TCB evaluation data numbers.
§Examples
use intel_dcap_api::ApiClient;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
// Create a client with default settings (V4 API)
let client = ApiClient::new()?;
// Retrieve TCB info for a specific FMSPC
let tcb_info = client.get_sgx_tcb_info("00606A000000", None, None).await?;
println!("TCB Info: {}", tcb_info.tcb_info_json);
Ok(())
}
Implementations§
Source§impl ApiClient
impl ApiClient
Sourcepub async fn get_sgx_qe_identity(
&self,
update: Option<UpdateType>,
tcb_evaluation_data_number: Option<u64>,
) -> Result<EnclaveIdentityResponse, IntelApiError>
pub async fn get_sgx_qe_identity( &self, update: Option<UpdateType>, tcb_evaluation_data_number: Option<u64>, ) -> Result<EnclaveIdentityResponse, IntelApiError>
Retrieves the SGX QE Identity from the Intel API.
Returns Enclave Identity JSON string (Appendix B) and Issuer Chain header.
Supports both v3 and v4. The update
and tcb_evaluation_data_number
parameters are only valid in API v4. Returns the enclave identity JSON
and an issuer chain header.
§Arguments
update
- OptionalUpdateType
(v4 only).tcb_evaluation_data_number
- Optional TCB Evaluation Data Number (v4 only).
§Returns
An EnclaveIdentityResponse
containing the JSON identity and issuer chain.
§Errors
Returns an IntelApiError
if the request fails, if conflicting v4 parameters are used,
or if the desired identity resource is not found.
Sourcepub async fn get_tdx_qe_identity(
&self,
update: Option<UpdateType>,
tcb_evaluation_data_number: Option<u64>,
) -> Result<EnclaveIdentityResponse, IntelApiError>
pub async fn get_tdx_qe_identity( &self, update: Option<UpdateType>, tcb_evaluation_data_number: Option<u64>, ) -> Result<EnclaveIdentityResponse, IntelApiError>
Retrieves the TDX QE Identity from the Intel API (API v4 only).
§Arguments
update
- OptionalUpdateType
(v4 only).tcb_evaluation_data_number
- Optional TCB Evaluation Data Number (v4 only).
§Returns
An EnclaveIdentityResponse
containing the JSON identity and issuer chain.
§Errors
Returns an IntelApiError
if an unsupported API version is used,
if conflicting parameters are provided, or if the identity resource is not found.
GET /tdx/certification/v4/qe/identity - V4 ONLY
Sourcepub async fn get_sgx_qve_identity(
&self,
update: Option<UpdateType>,
tcb_evaluation_data_number: Option<u64>,
) -> Result<EnclaveIdentityResponse, IntelApiError>
pub async fn get_sgx_qve_identity( &self, update: Option<UpdateType>, tcb_evaluation_data_number: Option<u64>, ) -> Result<EnclaveIdentityResponse, IntelApiError>
Retrieves the SGX QVE Identity from the Intel API.
Supports API v3 and v4. The update
and tcb_evaluation_data_number
parameters
are v4 only. Returns the QVE identity JSON and issuer chain.
§Arguments
update
- OptionalUpdateType
(v4 only).tcb_evaluation_data_number
- Optional TCB Evaluation Data Number (v4 only).
§Returns
An EnclaveIdentityResponse
containing the QVE identity JSON and issuer chain.
§Errors
Returns an IntelApiError
if the request fails, if conflicting parameters are used,
or if the identity resource is not found.
GET /sgx/certification/{v3,v4}/qve/identity
Sourcepub async fn get_sgx_qae_identity(
&self,
update: Option<UpdateType>,
tcb_evaluation_data_number: Option<u64>,
) -> Result<EnclaveIdentityResponse, IntelApiError>
pub async fn get_sgx_qae_identity( &self, update: Option<UpdateType>, tcb_evaluation_data_number: Option<u64>, ) -> Result<EnclaveIdentityResponse, IntelApiError>
Retrieves the SGX QAE Identity from the Intel API (API v4 only).
§Arguments
update
- OptionalUpdateType
(v4 only).tcb_evaluation_data_number
- Optional TCB Evaluation Data Number (v4 only).
§Returns
An EnclaveIdentityResponse
containing the QAE identity JSON and issuer chain.
§Errors
Returns an IntelApiError
if an unsupported API version is used,
if conflicting parameters are provided, or if the QAE identity is not found.
GET /sgx/certification/v4/qae/identity - V4 ONLY
Source§impl ApiClient
impl ApiClient
Sourcepub async fn get_fmspcs(
&self,
platform_filter: Option<PlatformFilter>,
) -> Result<FmspcJsonResponse, IntelApiError>
pub async fn get_fmspcs( &self, platform_filter: Option<PlatformFilter>, ) -> Result<FmspcJsonResponse, IntelApiError>
GET /sgx/certification/{v3,v4}/fmspcs Retrieves a list of FMSPC values for SGX and TDX platforms (API v4 only).
§Arguments
platform_filter
- An optional filter specifying SGX or TDX platforms.
§Returns
Optional ‘platform’ filter.
A String
containing the JSON array of objects, each containing fmspc
and platform
.
§Errors
Returns an IntelApiError
if an unsupported API version is used or if the request fails.
Sourcepub async fn get_sgx_tcb_evaluation_data_numbers(
&self,
) -> Result<TcbEvaluationDataNumbersResponse, IntelApiError>
pub async fn get_sgx_tcb_evaluation_data_numbers( &self, ) -> Result<TcbEvaluationDataNumbersResponse, IntelApiError>
GET /sgx/certification/v4/tcbevaluationdatanumbers - V4 ONLY Retrieves the currently supported SGX TCB Evaluation Data Numbers (API v4 only).
§Returns
A TcbEvaluationDataNumbersResponse
containing the JSON structure of TCB Evaluation
Data Numbers and an issuer chain header.
§Errors
Returns an IntelApiError
if an unsupported API version is used or if the request fails.
Sourcepub async fn get_tdx_tcb_evaluation_data_numbers(
&self,
) -> Result<TcbEvaluationDataNumbersResponse, IntelApiError>
pub async fn get_tdx_tcb_evaluation_data_numbers( &self, ) -> Result<TcbEvaluationDataNumbersResponse, IntelApiError>
GET /tdx/certification/v4/tcbevaluationdatanumbers - V4 ONLY Retrieves the currently supported TDX TCB Evaluation Data Numbers (API v4 only).
§Returns
A TcbEvaluationDataNumbersResponse
containing the JSON structure of TCB Evaluation
Data Numbers and an issuer chain header.
§Errors
Returns an IntelApiError
if an unsupported API version is used or if the request fails.
Source§impl ApiClient
impl ApiClient
Sourcepub async fn get_pck_certificate_by_ppid(
&self,
encrypted_ppid: &str,
cpusvn: &str,
pcesvn: &str,
pceid: &str,
subscription_key: Option<&str>,
ppid_encryption_key_type: Option<&str>,
) -> Result<PckCertificateResponse, IntelApiError>
pub async fn get_pck_certificate_by_ppid( &self, encrypted_ppid: &str, cpusvn: &str, pcesvn: &str, pceid: &str, subscription_key: Option<&str>, ppid_encryption_key_type: Option<&str>, ) -> Result<PckCertificateResponse, IntelApiError>
GET /sgx/certification/{v3,v4}/pckcert Retrieves a single SGX PCK certificate using encrypted PPID and SVNs.
Optionally requires a subscription key. The ppid_encryption_key_type
parameter
is only valid for API v4 and allows specifying the PPID encryption key type (e.g. “RSA-3072”).
§Arguments
encrypted_ppid
- Hex-encoded encrypted PPID.cpusvn
- Hex-encoded CPUSVN value.pcesvn
- Hex-encoded PCESVN value.pceid
- Hex-encoded PCEID value.subscription_key
- Optional subscription key if the Intel API requires it.ppid_encryption_key_type
- Optional PPID encryption key type (V4 only).
§Returns
A PckCertificateResponse
containing the PEM-encoded certificate, issuer chain,
TCBm, and FMSPC.
§Errors
Returns an IntelApiError
if the API call fails or the response contains an invalid status.
Returns PEM Cert, Issuer Chain, TCBm, FMSPC.
Sourcepub async fn get_pck_certificate_by_manifest(
&self,
platform_manifest: &str,
cpusvn: &str,
pcesvn: &str,
pceid: &str,
subscription_key: Option<&str>,
) -> Result<PckCertificateResponse, IntelApiError>
pub async fn get_pck_certificate_by_manifest( &self, platform_manifest: &str, cpusvn: &str, pcesvn: &str, pceid: &str, subscription_key: Option<&str>, ) -> Result<PckCertificateResponse, IntelApiError>
POST /sgx/certification/{v3,v4}/pckcert Retrieves a single SGX PCK certificate using a platform manifest and SVNs.
Optionally requires a subscription key.
§Arguments
platform_manifest
- Hex-encoded platform manifest.cpusvn
- Hex-encoded CPUSVN value.pcesvn
- Hex-encoded PCESVN value.pceid
- Hex-encoded PCEID value.subscription_key
- Optional subscription key if the Intel API requires it.
§Returns
A PckCertificateResponse
containing the PEM-encoded certificate, issuer chain,
TCBm, and FMSPC.
§Errors
Returns an IntelApiError
if the request fails or if the response is invalid.
Returns PEM Cert, Issuer Chain, TCBm, FMSPC.
Sourcepub async fn get_pck_certificates_by_ppid(
&self,
encrypted_ppid: &str,
pceid: &str,
subscription_key: Option<&str>,
ppid_encryption_key_type: Option<&str>,
) -> Result<PckCertificatesResponse, IntelApiError>
pub async fn get_pck_certificates_by_ppid( &self, encrypted_ppid: &str, pceid: &str, subscription_key: Option<&str>, ppid_encryption_key_type: Option<&str>, ) -> Result<PckCertificatesResponse, IntelApiError>
GET /sgx/certification/{v3,v4}/pckcerts Retrieves all SGX PCK certificates for a platform using encrypted PPID.
Optionally requires a subscription key. The ppid_encryption_key_type
parameter
is only valid for API v4.
§Arguments
encrypted_ppid
- Hex-encoded encrypted PPID.pceid
- Hex-encoded PCEID value.subscription_key
- Optional subscription key if the Intel API requires it.ppid_encryption_key_type
- Optional PPID encryption key type (V4 only).
§Returns
A PckCertificatesResponse
containing JSON with {tcb, tcbm, cert}
entries,
as well as the issuer chain and FMSPC headers.
§Errors
Returns an IntelApiError
if the API call fails or the response status is invalid.
Sourcepub async fn get_pck_certificates_by_manifest(
&self,
platform_manifest: &str,
pceid: &str,
subscription_key: Option<&str>,
) -> Result<PckCertificatesResponse, IntelApiError>
pub async fn get_pck_certificates_by_manifest( &self, platform_manifest: &str, pceid: &str, subscription_key: Option<&str>, ) -> Result<PckCertificatesResponse, IntelApiError>
POST /sgx/certification/{v3,v4}/pckcerts Retrieves all SGX PCK certificates for a platform using a platform manifest.
Optionally requires a subscription key.
§Arguments
platform_manifest
- Hex-encoded platform manifest.pceid
- Hex-encoded PCEID value.subscription_key
- Optional subscription key if the Intel API requires it.
§Returns
A PckCertificatesResponse
containing JSON with {tcb, tcbm, cert}
entries,
as well as the issuer chain and FMSPC headers.
§Errors
Returns an IntelApiError
if the API call fails or the response status is invalid.
Sourcepub async fn get_pck_certificates_config_by_ppid(
&self,
encrypted_ppid: &str,
pceid: &str,
cpusvn: &str,
subscription_key: Option<&str>,
ppid_encryption_key_type: Option<&str>,
) -> Result<PckCertificatesResponse, IntelApiError>
pub async fn get_pck_certificates_config_by_ppid( &self, encrypted_ppid: &str, pceid: &str, cpusvn: &str, subscription_key: Option<&str>, ppid_encryption_key_type: Option<&str>, ) -> Result<PckCertificatesResponse, IntelApiError>
GET /sgx/certification/{v3,v4}/pckcerts/config (using PPID) Retrieves SGX PCK certificates for a specific configuration (CPUSVN) using encrypted PPID.
Optionally requires a subscription key. The ppid_encryption_key_type
parameter
is only valid for API v4. Returns JSON with {tcb, tcbm, cert}
entries,
as well as the issuer chain and FMSPC headers.
§Arguments
encrypted_ppid
- Hex-encoded encrypted PPID.pceid
- Hex-encoded PCEID value.cpusvn
- Hex-encoded CPUSVN value for the requested configuration.subscription_key
- Optional subscription key if the Intel API requires it.ppid_encryption_key_type
- Optional PPID encryption key type (V4 only).
§Returns
A PckCertificatesResponse
with the requested config’s certificate data.
§Errors
Returns an IntelApiError
if the request fails or if the response status
is not 200 OK
.
Sourcepub async fn get_pck_certificates_config_by_manifest(
&self,
platform_manifest: &str,
pceid: &str,
cpusvn: &str,
subscription_key: Option<&str>,
) -> Result<PckCertificatesResponse, IntelApiError>
pub async fn get_pck_certificates_config_by_manifest( &self, platform_manifest: &str, pceid: &str, cpusvn: &str, subscription_key: Option<&str>, ) -> Result<PckCertificatesResponse, IntelApiError>
POST /sgx/certification/{v3,v4}/pckcerts/config (using Manifest) Retrieves SGX PCK certificates for a specific configuration (CPUSVN) using a platform manifest.
Optionally requires a subscription key. Returns JSON with {tcb, tcbm, cert}
entries,
as well as the issuer chain and FMSPC headers.
§Arguments
platform_manifest
- Hex-encoded platform manifest.pceid
- Hex-encoded PCEID value.cpusvn
- Hex-encoded CPUSVN value for the requested configuration.subscription_key
- Optional subscription key if needed by the Intel API.
§Returns
A PckCertificatesResponse
with the requested config’s certificate data.
§Errors
Returns an IntelApiError
if the request fails or if the response status
is not 200 OK
.
Source§impl ApiClient
impl ApiClient
Sourcepub async fn get_pck_crl(
&self,
ca_type: CaType,
encoding: Option<CrlEncoding>,
) -> Result<PckCrlResponse, IntelApiError>
pub async fn get_pck_crl( &self, ca_type: CaType, encoding: Option<CrlEncoding>, ) -> Result<PckCrlResponse, IntelApiError>
GET /sgx/certification/{v3,v4}/pckcrl Retrieves the PCK Certificate Revocation List (CRL) for a specified CA type.
Optionally takes an encoding
parameter indicating whether the CRL should be
returned as PEM or DER. Defaults to PEM if not specified.
§Arguments
ca_type
- The type of CA to retrieve the CRL for (e.g., “processor” or “platform”).encoding
- An optionalCrlEncoding
(PEM or DER).
§Returns
A PckCrlResponse
containing the CRL data and the issuer chain.
§Errors
Returns an IntelApiError
if the request fails or if the response status
is not 200 OK
.
Optional ‘encoding’ parameter (“pem” or “der”).
Returns CRL data (PEM or DER) and Issuer Chain header.
Source§impl ApiClient
impl ApiClient
Sourcepub async fn register_platform(
&self,
platform_manifest: Vec<u8>,
) -> Result<String, IntelApiError>
pub async fn register_platform( &self, platform_manifest: Vec<u8>, ) -> Result<String, IntelApiError>
POST /sgx/registration/v1/platform Registers a multi-package SGX platform with the Intel Trusted Services API.
§Arguments
platform_manifest
- Binary data representing the platform manifest.
§Returns
Request body is binary Platform Manifest
Returns the hex-encoded PPID as a String
upon success.
§Errors
Returns an IntelApiError
if the request fails or if the response status
is not HTTP 201 CREATED
.
Sourcepub async fn add_package(
&self,
add_package_request: Vec<u8>,
subscription_key: &str,
) -> Result<AddPackageResponse, IntelApiError>
pub async fn add_package( &self, add_package_request: Vec<u8>, subscription_key: &str, ) -> Result<AddPackageResponse, IntelApiError>
POST /sgx/registration/v1/package Adds new package(s) to an already registered SGX platform instance.
§Arguments
add_package_request
- Binary data for the “Add Package” request body.subscription_key
- The subscription key required by the Intel API.
§Returns
A AddPackageResponse
containing the Platform Membership Certificates and
the count of them extracted from the response header.
§Errors
Returns an IntelApiError
if the request fails, if the subscription key is invalid,
or if the response status is not HTTP 200 OK
.
Source§impl ApiClient
impl ApiClient
Sourcepub async fn get_sgx_tcb_info(
&self,
fmspc: &str,
update: Option<UpdateType>,
tcb_evaluation_data_number: Option<u64>,
) -> Result<TcbInfoResponse, IntelApiError>
pub async fn get_sgx_tcb_info( &self, fmspc: &str, update: Option<UpdateType>, tcb_evaluation_data_number: Option<u64>, ) -> Result<TcbInfoResponse, IntelApiError>
GET /sgx/certification/{v3,v4}/tcb Retrieves SGX TCB information for a given FMSPC.
Returns TCB Info JSON string (Appendix A) and Issuer Chain header.
This function supports both API v3 and v4. The update
and tcbEvaluationDataNumber
parameters are only supported by API v4. If both are provided at the same time (for v4),
a conflict error is returned.
§Arguments
fmspc
- Hex-encoded FMSPC value.update
- OptionalUpdateType
for API v4.tcb_evaluation_data_number
- Optional TCB Evaluation Data Number (v4 only).
§Returns
A TcbInfoResponse
containing the TCB info JSON and the issuer chain.
§Errors
Returns an IntelApiError
if the API request fails, if conflicting parameters are used,
or if the requested TCB data is not found.
Sourcepub async fn get_tdx_tcb_info(
&self,
fmspc: &str,
update: Option<UpdateType>,
tcb_evaluation_data_number: Option<u64>,
) -> Result<TcbInfoResponse, IntelApiError>
pub async fn get_tdx_tcb_info( &self, fmspc: &str, update: Option<UpdateType>, tcb_evaluation_data_number: Option<u64>, ) -> Result<TcbInfoResponse, IntelApiError>
GET /tdx/certification/v4/tcb Retrieves TDX TCB information for a given FMSPC (API v4 only).
§Arguments
fmspc
- Hex-encoded FMSPC value.update
- An optionalUpdateType
(v4 only).tcb_evaluation_data_number
- An optional TCB Evaluation Data Number (v4 only).
§Returns
A TcbInfoResponse
containing TDX TCB info JSON and the issuer chain.
§Errors
Returns an IntelApiError
if an unsupported API version is used,
if there are conflicting parameters, or if the TDX TCB data is not found.
Returns TCB Info JSON string (Appendix A) and Issuer Chain header.
Source§impl ApiClient
impl ApiClient
Sourcepub fn new() -> Result<Self, IntelApiError>
pub fn new() -> Result<Self, IntelApiError>
Creates a new client targeting the latest supported API version (V4).
§Returns
A result containing the newly created ApiClient
or an IntelApiError
if there
was an issue building the underlying HTTP client.
§Errors
This function may fail if the provided TLS version or base URL
cannot be used to build a reqwest
client.
Sourcepub fn new_with_version(api_version: ApiVersion) -> Result<Self, IntelApiError>
pub fn new_with_version(api_version: ApiVersion) -> Result<Self, IntelApiError>
Sourcepub fn new_with_base_url(base_url: impl IntoUrl) -> Result<Self, IntelApiError>
pub fn new_with_base_url(base_url: impl IntoUrl) -> Result<Self, IntelApiError>
Sourcepub fn new_with_options(
base_url: impl IntoUrl,
api_version: ApiVersion,
) -> Result<Self, IntelApiError>
pub fn new_with_options( base_url: impl IntoUrl, api_version: ApiVersion, ) -> Result<Self, IntelApiError>
Creates a new client with a custom base URL and specific API version.
§Arguments
base_url
- The custom base URL for the Intel Trusted Services API.api_version
- The desired API version (V3 or V4).
§Errors
Returns an IntelApiError
if the reqwest
client cannot be built
or if the provided base URL is invalid.
Sourcepub fn set_max_retries(&mut self, max_retries: u32)
pub fn set_max_retries(&mut self, max_retries: u32)
Sets the maximum number of automatic retries for rate-limited requests.
When the API returns a 429 (Too Many Requests) response, the client will automatically wait for the duration specified in the Retry-After header and retry the request up to this many times.
§Arguments
max_retries
- Maximum number of retries (0 disables automatic retries)