Enrollment token API
Issue constrained enrollment authority and revoke unused tokens.
Enrollment tokens authorize new node identities. They cannot authorize ordinary API requests or impersonate an already registered node.
/organizations/{organization_id}/enrollment-tokensCreates constrained authority for enrolling node identities.
region_idstringrequiredzone_idstringrequiredpool_idstringrequiredrolesstring[]requiredcompute, storage, or both.max_usesintegeroptional1rule1–100 inclusivettl_secondsintegeroptional900rule60–86400 inclusiveThe response returns enrollment authority and its remaining uses:
{
"data": {
"id": "enr_rack12",
"token": "enr_example_replace_before_use",
"max_uses": 1,
"uses": 0,
"expires_at": "2026-01-15T11:45:00Z"
}
}The response reveals the plaintext once. Invalid limits, a zone outside the
region, or an unsupported role set return 422 and create no token. Tokens
inherit no region access beyond the explicit creation constraints.
Consumption
The agent exchanges the token for its node identity through the enrollment protocol. Successful registration consumes one use. A failed request that never registers an identity does not consume a successful-use slot.
A lost successful response can leave a registered node whose agent needs identity recovery. Do not automatically use another token to create a duplicate inventory record. Inspect enrollment results by host identity and operation ID first.
Inspect and revoke
/organizations/{organization_id}/enrollment-tokensLists visible enrollment tokens with standard pagination.
/organizations/{organization_id}/enrollment-tokens/{token_id}Returns token constraints, usage, expiry, and revocation state without plaintext.
Requires fleet:read. Reads return constraints, usage, expiry, and revocation
state without returning the plaintext token.
/organizations/{organization_id}/enrollment-tokens/{token_id}Revokes the token's unused enrollment authority.
Requires fleet:write and returns 204 after revocation.
Revoking unused authority prevents subsequent registrations. It does not revoke
node identities already issued through that token; retire those nodes explicitly.
Expired, exhausted, and revoked token exchanges are rejected. A token copied into a host image can therefore expose enrollment authority until its expiry or use limit. Use a short TTL and the smallest required use count.
Resulting node
Newly registered nodes begin cordoned. A successful token exchange does not establish KVM support, storage health, or mesh readiness. Complete node enrollment validation before admission. See Node API for the resulting inventory resource.