Phala Cloud Documentation — Confidential AI on TEE

commitCvmProvision

POST /cvms Commits a CVM provision, finalizing the deployment. This is the second phase of the two-phase flow started by provisionCvm. The required parameters differ based on the KMS type:

PHALA KMS: app_id comes from the provisionCvm response.
On-chain KMS (ETHEREUM/BASE): app_id comes from deploying an AppAuth contract via deployAppAuth. You must also provide kms_id, contract_address, and deployer_address.

Parameters:

Field	Type	Required	Description
`app_id`	`string`	Yes	App ID from provision (PHALA) or contract deployment (on-chain)
`compose_hash`	`string`	Yes	Hash from `provisionCvm`
`encrypted_env`	`string`	No	Hex-encoded encrypted environment variables
`env_keys`	`string[]`	No	Allowed environment variable keys
`kms_id`	`string`	No	KMS instance slug (required for on-chain KMS)
`contract_address`	`string`	No	AppAuth contract address (on-chain KMS only)
`deployer_address`	`string`	No	Deployer wallet address (on-chain KMS only)

Returns: CommitCvmProvision

Field	Type	Description
`id`	`number`	CVM ID
`name`	`string`	CVM name
`status`	`string`	Initial status (typically `"starting"`)
`app_id`	`string?`	App ID
`app_url`	`string?`	Public URL for the CVM
`vm_uuid`	`string?`	VM unique identifier
`instance_id`	`string?`	Instance identifier
`vcpu`	`number`	Allocated vCPUs
`memory`	`number`	Allocated memory (MB)
`disk_size`	`number`	Disk size (GB)
`created_at`	`string`	ISO 8601 creation timestamp
`encrypted_env_pubkey`	`string?`	Public key for encrypting environment variables
`app_auth_contract_address`	`string?`	AppAuth contract address (on-chain KMS only)
`deployer_address`	`string?`	Deployer wallet address (on-chain KMS only)

After a successful commit, the CVM begins booting. Track progress with watchCvmState or subscribe to cvm.created / cvm.create_failed webhook events. Example — PHALA KMS:

const result = await client.commitCvmProvision({
  app_id: provision.app_id!,
  compose_hash: provision.compose_hash,
  encrypted_env: encryptedEnvHex,
  env_keys: ["API_KEY"],
});

Example — On-chain KMS:

const result = await client.commitCvmProvision({
  app_id: deployedContract.appId,
  compose_hash: provision.compose_hash,
  encrypted_env: encryptedEnvHex,
  env_keys: ["API_KEY"],
  kms_id: kmsSlug,
  contract_address: deployedContract.appAuthAddress,
  deployer_address: deployedContract.deployer,
});

safeCommitCvmProvision

Safe variant that returns a SafeResult<CommitCvmProvision> instead of throwing on errors.

​commitCvmProvision

​safeCommitCvmProvision

commitCvmProvision

safeCommitCvmProvision