Reference / Os Access

Mint a host enrollment (join) token. Returns the secret once (201).

POST /v1/os/enrollment-tokens

Secret API key operationId: create_enrollment_token

Authorization

Server-to-server. Send a secret key as a Bearer token plus the x-application-id header.

Request body · required

expires_in_days integer<int64> int64

Days until the token expires. `null` = never.
host_group_id string<uuid> uuid
label string required
max_uses integer<int32> int32

`null` = reusable within its expiry (fleet rollout); `1` = strict single-use.
platform string

Restrict the token to a platform (`windows` | `linux`). Omitted = either.

Responses

201 Created (secret shown once)

{
  "data": {
    "active": false,
    "created_at": "2026-01-15T09:30:00Z",
    "expires_at": "2026-01-15T09:30:00Z",
    "host_group_id": "018f3c4a-7b2e-7c1d-9e0a-1f2b3c4d5e6f",
    "id": "018f3c4a-7b2e-7c1d-9e0a-1f2b3c4d5e6f",
    "label": "string",
    "max_uses": 0,
    "platform": "string",
    "uses": 0,
    "token_secret": "string"
  },
  "error": {
    "code": "string",
    "message": "string"
  },
  "meta": {
    "timestamp": "string"
  },
  "success": false
}

404 Host group not found

422 Invalid request

Request

curl -X POST "https://api.identrahq.com/v1/os/enrollment-tokens" \
  -H "Content-Type: application/json" \
  -d '{
  "expires_in_days": 0,
  "host_group_id": "018f3c4a-7b2e-7c1d-9e0a-1f2b3c4d5e6f",
  "label": "prod-linux-fleet",
  "max_uses": 0,
  "platform": "string"
}'

Try it

live request

POST https://api.identrahq.com/v1/os/enrollment-tokens

Request body

application/json