- [HTTP request](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.HTTP_TEMPLATE)
- [Path parameters](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.PATH_PARAMETERS)
- [Request body](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.request_body)
- [Response body](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.response_body)
  - [JSON representation](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.ShieldedInstanceIdentity.SCHEMA_REPRESENTATION)
- [Authorization scopes](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.aspect)
- [IAM Permissions](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#body.aspect_1)
- [Try it!](https://docs.cloud.google.com/compute/docs/reference/rest/v1/instances/getShieldedInstanceIdentity#try-it)

Returns the Shielded Instance Identity of an instance

### HTTP request

Choose an endpoint:
global africa-south1 asia-east1 asia-east2 asia-northeast1 asia-northeast2 asia-northeast3 asia-south1 asia-south2 asia-southeast1 asia-southeast2 asia-southeast3 australia-southeast1 australia-southeast2 europe-central2 europe-north1 europe-north2 europe-southwest1 europe-west1 europe-west10 europe-west12 europe-west2 europe-west3 europe-west4 europe-west6 europe-west8 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast1 northamerica-northeast2 northamerica-south1 southamerica-east1 southamerica-west1 us-central1 us-east1 us-east4 us-east5 us-south1 us-west1 us-west2 us-west3 us-west4   
`GET https://compute.googleapis.com/compute/v1/projects/{project}/zones/{zone}/instances/{instance}/getShieldedInstanceIdentity`

<br />

The URLs use [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Path parameters

| Parameters ||
|---|---|
| `project` | `string` Project ID for this request. |
| `zone` | `string` The name of the zone for this request. |
| `instance` | `string` Name or id of the instance scoping this request. |

### Request body

The request body must be empty.

### Response body

A Shielded Instance Identity.

If successful, the response body contains data with the following structure:

| JSON representation |
|---|
| ``` { "kind": string, "signingKey": { "ekCert": string, "ekPub": string }, "encryptionKey": { "ekCert": string, "ekPub": string }, "eccP256SigningKey": { "ekCert": string, "ekPub": string }, "eccP256EncryptionKey": { "ekCert": string, "ekPub": string } } ``` |

| Fields ||
|---|---|
| `kind` | `string` Output only. Type of the resource. Always `compute#shieldedInstanceIdentity` for shielded Instance identity entry. |
| `signingKey` | `object` An Attestation Key (AK) made by the RSA 2048 algorithm issued to the Shielded Instance's vTPM. |
| `signingKey.ekCert` | `string` A PEM-encoded X.509 certificate. This field can be empty. |
| `signingKey.ekPub` | `string` A PEM-encoded public key. |
| `encryptionKey` | `object` An Endorsement Key (EK) made by the RSA 2048 algorithm issued to the Shielded Instance's vTPM. |
| `encryptionKey.ekCert` | `string` A PEM-encoded X.509 certificate. This field can be empty. |
| `encryptionKey.ekPub` | `string` A PEM-encoded public key. |
| `eccP256SigningKey` | `object` An Attestation Key (AK) made by the ECC P256 algorithm issued to the Shielded Instance's vTPM. |
| `eccP256SigningKey.ekCert` | `string` A PEM-encoded X.509 certificate. This field can be empty. |
| `eccP256SigningKey.ekPub` | `string` A PEM-encoded public key. |
| `eccP256EncryptionKey` | `object` An Endorsement Key (EK) made by the ECC P256 algorithm issued to the Shielded Instance's vTPM. |
| `eccP256EncryptionKey.ekCert` | `string` A PEM-encoded X.509 certificate. This field can be empty. |
| `eccP256EncryptionKey.ekPub` | `string` A PEM-encoded public key. |

### Authorization scopes

Requires one of the following OAuth scopes:

- `https://www.googleapis.com/auth/compute.readonly`
- `
  https://www.googleapis.com/auth/compute`
- `
  https://www.googleapis.com/auth/cloud-platform`

For more information, see the [Authentication Overview](https://docs.cloud.google.com/docs/authentication#authorization-gcp).

### IAM Permissions

In addition to any permissions specified on the fields above, authorization requires one or more of the following [IAM](https://cloud.google.com/iam/docs/) permissions:

- `compute.instances.getShieldedInstanceIdentity`

To find predefined roles that contain those permissions, see [Compute Engine IAM Roles](https://docs.cloud.google.com/compute/docs/access/iam).