Create enrollment token

POST

/v1/organizations/:organizationId/mdm/android/enterprise/enrollment-tokens/

Create enrollment token

Required Permission: mdm.android.enrollmentToken.create

Creates a new enrollment token with specified configuration for device registration and management.

Request

Add parameter in header authorization

Example: Authorization: Bearer <token>

organizationId string

required

Match pattern: ^(([a-fA-F0-9]{24})|([a-zA-Z0-9\\-]{3,}))$

Body Params application/json

policyId string optional

Primary Android Enterprise policy identifier applied to devices enrolling with this token as default configuration baseline.

Match pattern: ^[a-fA-F0-9]{24}$

emmPolicyAssignments array [object] optional

Ordered list of Android Enterprise policy assignments applied to devices enrolling with this token prioritized by sequence.

emmPolicyId string required

Match pattern: ^[a-fA-F0-9]{24}$

priority integer required

≥ 0 · ≤ 10000

displayName any optional

Human-readable enrollment token name displayed in dashboard for administrative identification and organizational purposes throughout device lifecycle.

tags array optional

Custom classification labels for enrollment token organization enabling filtering, grouping, and policy automation across device fleet.

managementMode string required

Android Enterprise management mode defining device ownership and control level applied during enrollment process execution.

DEVICE_OWNER PROFILE_OWNER COPE USERLESS

sendEmail boolean required

Flag controlling whether enrollment instructions and QR code are automatically sent to MDM user email address.

duration integer optional

Enrollment token validity duration in seconds ranging from sixty seconds to thirty days controlling expiration timestamp.

≥ 60 · ≤ 2592000

language string optional

Preferred language code for enrollment notification email localization following ISO standard two-letter country codes.

es en fr de it zh pt ru

emailText any optional

Custom message content appended to enrollment notification email for user-specific instructions or organizational policy communication.

segmentId integer optional

≥ 0 · ≤ 9007199254740991

mdmUserId string required

Target MDM user identifier for single enrollment token creation linking device ownership to specific user account.

Match pattern: ^[a-fA-F0-9]{24}$

{
    "policyId": "string",
    "emmPolicyAssignments": [
        {
            "emmPolicyId": "string",
            "priority": 0
        }
    ],
    "displayName": "string",
    "tags": [
        "string"
    ],
    "managementMode": "DEVICE_OWNER",
    "sendEmail": true,
    "duration": 0,
    "language": "es",
    "emailText": "string",
    "segmentId": 0,
    "mdmUserId": "string"
}

Responses

200 Response application/json

status boolean required

data object required

id string required

Unique enrollment token identifier used to track Android Enterprise device enrollment credentials throughout lifecycle.

Match pattern: ^[a-fA-F0-9]{24}$

organization string optional

Organization identifier owning this enrollment token and managing enrolled Android Enterprise devices under EMM policy.

Match pattern: ^[a-fA-F0-9]{24}$

emmEnterprise string optional

Android Enterprise (EMM) enterprise account identifier linked to Google Managed Play for device and app management.

Match pattern: ^[a-fA-F0-9]{24}$

emmPolicyAssignments array [object] optional

Ordered list of Android Enterprise policy assignments applied to devices enrolling with this token prioritized by sequence.

emmPolicyId string optional

Match pattern: ^[a-fA-F0-9]{24}$

emmPolicy any optional

priority integer optional

≥ 0 · ≤ 9007199254740991

mdmUser object optional

MDM user account information associated with enrollment token including identifier and email for device ownership tracking.

id string optional

Match pattern: ^[a-fA-F0-9]{24}$

email string optional

≤ 128 characters

emmDevice string optional

Android Enterprise device identifier created after successful enrollment using this token for device lifecycle tracking.

Match pattern: ^[a-fA-F0-9]{24}$

displayName any optional

Human-readable enrollment token name displayed in dashboard for administrative identification and organizational purposes throughout device lifecycle.

tags array optional

Custom classification labels for enrollment token organization enabling filtering, grouping, and policy automation across device fleet.

status string optional

Current enrollment token lifecycle state indicating availability for device enrollment or completion status tracking.

PENDING DONE DELETED EXPIRED

sendEmail boolean optional

Flag controlling whether enrollment instructions and QR code are automatically sent to MDM user email address.

managementMode string optional

Android Enterprise management mode defining device ownership and control level applied during enrollment process execution.

DEVICE_OWNER PROFILE_OWNER COPE USERLESS

emailText any optional

Custom message content appended to enrollment notification email for user-specific instructions or organizational policy communication.

config object optional

Technical enrollment configuration containing Google Cloud generated credentials and expiration settings for device provisioning.

expirationTimestamp string optional

≤ 128 characters

code string optional

≤ 128 characters

_config any optional

Internal configuration data restricted to administrator access level containing sensitive enrollment credentials and system metadata.

summary object optional

Enrollment token overview containing human-readable management mode description and expiration information for dashboard display.

managementMode string optional

DEVICE_OWNER PROFILE_OWNER COPE USERLESS

expirationTimestamp string optional

≤ 128 characters

type string optional

Enrollment token type classifier indicating platform-specific enrollment method used for cross-platform MDM management dashboards.

≤ 128 characters

subType string optional

Enrollment token sub-classification providing additional context for specialized enrollment scenarios within Android Enterprise management.

≤ 128 characters

state string optional

Legacy enrollment token state field maintained for backward compatibility with previous API versions tracking lifecycle.

PENDING DONE DELETED EXPIRED

perpetual boolean optional

Flag indicating whether enrollment token has unlimited validity or follows standard expiration policy for continuous enrollment.

qrcodeUrl string optional

URL to downloadable QR code image embeddin enrollment credentials for Android device camera-based provisioning workflow.

enrollmentLink string optional

Deep link URL for Android enrollment initiation allowing web-based device provisioning without QR code scanning.

≤ 256 characters

createdAt string optional

ISO timestamp when enrollment token was created in system for audit tracking and lifecycle management purposes.

updatedAt string optional

ISO timestamp of last enrollment token modification for change tracking and synchronization across distributed systems.

segmentId integer optional

Segment identifier for scoping enrollment token into an specific segment

≥ 0 · ≤ 9007199254740991

{
    "status": true,
    "data": {
        "id": "string",
        "organization": "string",
        "emmEnterprise": "string",
        "emmPolicyAssignments": [
            {
                "emmPolicyId": "string",
                "emmPolicy": "string",
                "priority": 0
            }
        ],
        "mdmUser": {
            "id": "string",
            "email": "string"
        },
        "emmDevice": "string",
        "displayName": "string",
        "tags": [
            "string"
        ],
        "status": "PENDING",
        "sendEmail": true,
        "managementMode": "DEVICE_OWNER",
        "emailText": "string",
        "config": {
            "expirationTimestamp": "string",
            "code": "string"
        },
        "_config": "string",
        "summary": {
            "managementMode": "DEVICE_OWNER",
            "expirationTimestamp": "string"
        },
        "type": "string",
        "subType": "string",
        "state": "PENDING",
        "perpetual": true,
        "qrcodeUrl": "string",
        "enrollmentLink": "string",
        "createdAt": "string",
        "updatedAt": "string",
        "segmentId": 0
    }
}

400 Response application/json

status boolean optional

false

error object optional

code number optional

5017

message string optional

Limit Exceeded

{
    "status": false,
    "error": {
        "code": 5050,
        "message": "Feature not allowed for you billing plan"
    }
}

401 Response application/json

status boolean optional

false

error object optional

code number optional

4004

message string optional

Invalid Token

{
    "status": false,
    "error": {
        "code": 4002,
        "message": "No auth token"
    }
}

404 Response application/json

status boolean optional

false

error object optional

code number optional

3001

message string optional

Entity not found

{
    "status": false,
    "error": {
        "code": 3001,
        "message": "Entity not found"
    }
}