POST /organizations/:organizationId/mdm/aosp/enterprise/enrollment-tokens

POST

/v1/organizations/:organizationId/mdm/aosp/enterprise/enrollment-tokens

Create non-GMS Android enrollment token

Required Permission: mdm.aosp.enrollmentToken.create

Create a non-GMS Android enrollment token for device onboarding

Request

Add parameter in header authorization

Example: Authorization: Bearer <token>

organizationId string

required

Match pattern: ^(([a-fA-F0-9]{24})|([a-zA-Z0-9\\-]{3,}))$

Body Params application/json

displayName string optional

Optional human-friendly label shown in the dashboard.

≤ 256 characters

tags array [string] optional

Free-form labels used to group and filter AOSP resources in the dashboard.

managementMode string required

Provisioning mode requested for enrolled devices.

DEVICE_OWNER MANAGEMENT_MODE_UNSPECIFIED

sendEmail boolean optional

Whether the backend should send the enrollment invitation email after creation.

language string optional

Optional language for the invitation email content.

es en fr de it zh pt ru

emailText string optional

Optional custom invitation email body text.

perpetual boolean optional

Whether the token should remain reusable after successful enrollment.

aosPolicyAssignments array [object] optional

Ordered AOSP policy assignments that will apply to enrolled devices.

aosPolicyId string required

Match pattern: ^[a-fA-F0-9]{24}$

priority integer required

≥ -9007199254740991 · ≤ 9007199254740991

dpcBuildTag string optional

Optional DPC build tag used to select a specific AOSP agent build for onboarding.

≤ 256 characters

mdmUserId string required

Identifier of the MDM user associated with the enrollment token.

Match pattern: ^[a-fA-F0-9]{24}$

duration integer required

Token validity duration in seconds for non-perpetual tokens.

≥ 0 · ≤ 9007199254740991

pushNotificationProvider string optional

Optional push notification provider override used for this enterprise or resource.

Match pattern: ^[a-fA-F0-9]{24}$

segmentId integer optional

Optional segment identifier used to scope the resource within the organization.

≥ 0 · ≤ 9007199254740991

{
    "displayName": "string",
    "tags": [
        "string"
    ],
    "managementMode": "DEVICE_OWNER",
    "sendEmail": true,
    "language": "es",
    "emailText": "string",
    "perpetual": true,
    "aosPolicyAssignments": [
        {
            "aosPolicyId": "string",
            "priority": 0
        }
    ],
    "dpcBuildTag": "string",
    "mdmUserId": "string",
    "duration": 0,
    "pushNotificationProvider": "string",
    "segmentId": 0
}

Responses

200 Response application/json

status boolean required

data object required

id string required

Identifier of the AOSP enrollment token resource.

Match pattern: ^[a-fA-F0-9]{24}$

organizationId string required

Identifier of the organization that owns the AOSP enterprise resource.

Match pattern: ^[a-fA-F0-9]{24}$

aosEnterpriseId string required

Identifier of the AOSP enterprise configuration associated with this resource.

Match pattern: ^[a-fA-F0-9]{24}$

segmentId integer optional

Optional segment identifier used to scope the resource within the organization.

≥ 0 · ≤ 9007199254740991

mdmUserId string required

Identifier of the MDM user associated with the enrollment token.

Match pattern: ^[a-fA-F0-9]{24}$

mdmUser object optional

Optional expanded MDM user metadata.

id string optional

Match pattern: ^[a-fA-F0-9]{24}$

email string optional

≤ 128 characters

type string required

Top-level MDM resource type.

aosp

subType string required

Subtype of the AOSP resource returned by this endpoint.

enrollment

status string required

Current backend status of the enrollment token.

PENDING PROCESSING DONE DELETED EXPIRED

state string required

Current state mirror kept for compatibility with other MDM resources.

PENDING PROCESSING DONE DELETED EXPIRED

summary object required

Operational summary of the token lifecycle.

managementMode string required

Provisioning mode that the token will use during onboarding.

DEVICE_OWNER MANAGEMENT_MODE_UNSPECIFIED

expirationTimestamp string required

Timestamp when the token expires unless it is perpetual.

managementMode string required

Provisioning mode requested for devices enrolled with this token.

DEVICE_OWNER MANAGEMENT_MODE_UNSPECIFIED

perpetual boolean required

Whether the token can be reused without expiring after a single successful enrollment.

aosDeviceId string optional

Identifier of the enrolled AOSP device when the token has already been consumed.

Match pattern: ^[a-fA-F0-9]{24}$

aosPolicyAssignments array [object] optional

Ordered AOSP policy assignments that will apply to enrolled devices.

aosPolicyId string required

Match pattern: ^[a-fA-F0-9]{24}$

aosPolicy object required

priority integer required

≥ -9007199254740991 · ≤ 9007199254740991

displayName string optional

Optional human-friendly label shown in the dashboard.

≤ 256 characters

tags array required

Free-form labels used to group and filter AOSP resources in the dashboard.

dpcBuildTag string optional

Optional DPC build tag used to select a specific AOSP agent build for onboarding.

≤ 256 characters

pushNotificationProvider string optional

Optional push notification provider override used for this enterprise or resource.

Match pattern: ^[a-fA-F0-9]{24}$

config object optional

Resolved bootstrap configuration generated for the enrollment token.

oneTimeToken string required

enrollmentHost string required

qrCode object required

updatedAt string required

Timestamp when the resource was last updated.

createdAt string required

Timestamp when the resource was created.

{
    "status": true,
    "data": {
        "id": "string",
        "organizationId": "string",
        "aosEnterpriseId": "string",
        "segmentId": 0,
        "mdmUserId": "string",
        "mdmUser": {
            "id": "string",
            "email": "string"
        },
        "type": "aosp",
        "subType": "enrollment",
        "status": "PENDING",
        "state": "PENDING",
        "summary": {
            "managementMode": "DEVICE_OWNER",
            "expirationTimestamp": "string"
        },
        "managementMode": "DEVICE_OWNER",
        "perpetual": true,
        "aosDeviceId": "string",
        "aosPolicyAssignments": [
            {
                "aosPolicyId": "string",
                "aosPolicy": {
                    "id": "string",
                    "name": "string",
                    "version": "string"
                },
                "priority": 0
            }
        ],
        "displayName": "string",
        "tags": [
            "string"
        ],
        "dpcBuildTag": "string",
        "pushNotificationProvider": "string",
        "config": {
            "oneTimeToken": "string",
            "enrollmentHost": "string",
            "qrCode": {}
        },
        "updatedAt": "string",
        "createdAt": "string"
    }
}

400 Response application/json

status boolean optional

false

error object optional

code number optional

5017

message string optional

Limit Exceeded

{
    "status": false,
    "error": {
        "code": 5017,
        "message": "Limit Exceeded"
    }
}

401 Response application/json

status boolean optional

false

error object optional

code number optional

4004

message string optional

Invalid Token

{
    "status": false,
    "error": {
        "code": 4002,
        "message": "No auth token"
    }
}

404 Response application/json

status boolean optional

false

error object optional

code number optional

3001

message string optional

Entity not found

{
    "status": false,
    "error": {
        "code": 3001,
        "message": "Entity not found"
    }
}