The tenancy attestation is a field in the rental record

The tender asks for single tenancy, the datacenter name, and the processor. Procurement asks you for a signed letter.

You send them GET /api/v1/rentals/{id} instead. The record says is_vm false, is_free_tier false, a datacenter, a city, the CPU model and core count under specs, a PassMark score, the rental's start and end, the pool it belongs to. Every field the tender asked for is a field the platform maintains, read from the same API the server was rented through.

The letter used to be an assertion you signed because you couldn't prove it. Now it's a JSON response with a date on it, and next year's re-audit is the same GET.