Favicon

You are here: Home > API Reference > Apple > Apple Enrollment Tokens > Create enrollment token

POST /organizations/:organizationId/mdm/apple/enterprise/enrollment-tokens

Required Permission: mdm.apple.enrollmentToken.create

Creates a new enrollment token with specified configuration for device registration and management.

POST
https://api.applivery.io/v1/organizations/{organizationId}/mdm/apple/enterprise/enrollment-tokens 
curl -X POST "https://api.applivery.io/v1/organizations/{organizationId}/mdm/apple/enterprise/enrollment-tokens" \
  -H "Authorization: Bearer <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
  "type": "object",
  "children": {
    "sendEmail": {},
    "displayName": {},
    "tags": {},
    "duration": {},
    "language": {},
    "emailText": {},
    "policyId": {},
    "admPolicyAssignments": {},
    "profiles": {},
    "applications": {},
    "admVppLocationId": {},
    "segmentId": {}
  },
  "mdmUserId": "698f3bde457fafa13d088791"
}'
const response = await fetch("https://api.applivery.io/v1/organizations/{organizationId}/mdm/apple/enterprise/enrollment-tokens", {
  method: "POST",
  headers: {
    Authorization: "Bearer <YOUR_API_KEY>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "type": "object",
    "children": {
      "sendEmail": {},
      "displayName": {},
      "tags": {},
      "duration": {},
      "language": {},
      "emailText": {},
      "policyId": {},
      "admPolicyAssignments": {},
      "profiles": {},
      "applications": {},
      "admVppLocationId": {},
      "segmentId": {}
    },
    "mdmUserId": "698f3bde457fafa13d088791"
  }),
});

const data = await response.json();
import requests

response = requests.post(
    "https://api.applivery.io/v1/organizations/{organizationId}/mdm/apple/enterprise/enrollment-tokens",
    headers={"Authorization": "Bearer <YOUR_API_KEY>"},
    json={
      "type": "object",
      "children": {
        "sendEmail": {},
        "displayName": {},
        "tags": {},
        "duration": {},
        "language": {},
        "emailText": {},
        "policyId": {},
        "admPolicyAssignments": {},
        "profiles": {},
        "applications": {},
        "admVppLocationId": {},
        "segmentId": {}
      },
      "mdmUserId": "698f3bde457fafa13d088791"
    },
)

data = response.json()

Request

Send your API key in the request header authorization
Example: Authorization: Bearer <token>

organizationId string
required
Match pattern: ^(([a-fA-F0-9]{24})|([a-zA-Z0-9\\-]{3,}))$

Body Params application/json
type string optional
object
children object optional
sendEmail object optional
type string optional
boolean
flags object optional
truthy boolean optional
falsy boolean optional
displayName object optional
type string optional
string
valids string optional
rules object optional
tags object optional
type string optional
array
flags object optional
items object optional
duration object optional
type string optional
number
flags object optional
description string optional
Number of seconds between 1m and 30d. 1d by default
invalids number optional
Format: float
null
rules object optional
language object optional
type string optional
string
flags object optional
valids string optional
es
invalids string optional
emailText object optional
type string optional
string
valids string optional
policyId object optional
type string optional
string
valids string optional
rules object optional
admPolicyAssignments object optional
type string optional
array
flags object optional
items object optional
profiles object optional
type string optional
array
flags object optional
items object optional
applications object optional
type string optional
array
flags object optional
items object optional
admVppLocationId object optional
type string optional
string
valids string optional
rules object optional
segmentId object optional
type string optional
number
flags object optional
invalids number optional
Format: float
null
rules object optional
mdmUserId string required
MDM user identifier specifying target user for enrollment token creation and device assignment.
Match pattern: ^[a-fA-F0-9]{24}$
{
    "type": "object",
    "children": {
        "sendEmail": {
            "type": "boolean",
            "flags": {
                "insensitive": true,
                "presence": "required"
            },
            "truthy": true,
            "falsy": true
        },
        "displayName": {
            "type": "string",
            "valids": "",
            "rules": {
                "name": "max",
                "arg": 128
            }
        },
        "tags": {
            "type": "array",
            "flags": {
                "sparse": true
            },
            "items": {
                "type": "string",
                "valids": "",
                "rules": {
                    "name": "max",
                    "arg": 128
                }
            }
        },
        "duration": {
            "type": "number",
            "flags": {
                "unsafe": true
            },
            "description": "Number of seconds between 1m and 30d. 1d by default",
            "invalids": null,
            "rules": {
                "name": "integer"
            }
        },
        "language": {
            "type": "string",
            "flags": {
                "allowOnly": true
            },
            "valids": "es",
            "invalids": ""
        },
        "emailText": {
            "type": "string",
            "valids": ""
        },
        "policyId": {
            "type": "string",
            "valids": "",
            "rules": {
                "name": "regex",
                "arg": {
                    "pattern": "string"
                }
            }
        },
        "admPolicyAssignments": {
            "type": "array",
            "flags": {
                "sparse": true
            },
            "items": {
                "type": "object",
                "children": {
                    "admPolicyId": {
                        "type": "string",
                        "invalids": "",
                        "rules": {
                            "name": "regex",
                            "arg": {
                                "pattern": "string"
                            }
                        }
                    },
                    "priority": {
                        "type": "number",
                        "flags": {
                            "unsafe": true,
                            "presence": "required"
                        },
                        "invalids": null,
                        "rules": {
                            "name": "integer"
                        }
                    }
                }
            }
        },
        "profiles": {
            "type": "array",
            "flags": {
                "sparse": true
            },
            "items": {
                "type": "string",
                "invalids": "",
                "rules": {
                    "name": "regex",
                    "arg": {
                        "pattern": "string"
                    }
                }
            }
        },
        "applications": {
            "type": "array",
            "flags": {
                "sparse": true
            },
            "items": {
                "type": "object",
                "children": {
                    "admApplication": {
                        "type": "string",
                        "flags": {
                            "presence": "required"
                        },
                        "description": "Apple application assignment target referencing the admApplication entity to install or expose on the device, policy, or enrollment token.",
                        "examples": {
                            "value": "698f42e5457fafa13d088794"
                        },
                        "invalids": "",
                        "rules": {
                            "name": "regex",
                            "arg": {
                                "pattern": "string"
                            }
                        }
                    },
                    "managed": {
                        "type": "boolean",
                        "flags": {
                            "insensitive": true
                        },
                        "description": "Controls Apple managed-install semantics for this app assignment. This field still drives InstallAsManaged and ChangeManagementState.",
                        "examples": {
                            "value": true
                        },
                        "truthy": true,
                        "falsy": true
                    },
                    "managementFlags": {
                        "type": "number",
                        "flags": {
                            "unsafe": true,
                            "allowOnly": true
                        },
                        "description": "Optional Apple MDM InstallApplication.ManagementFlags override for this app assignment. Supported values are 1 (remove app when the MDM profile is removed), 4 (prevent backup of app documents and data), and 5 (both behaviors). If omitted, backend behavior stays unchanged: managed=true sends 5; otherwise the field is omitted. This field only overrides Apple ManagementFlags and does not imply managed=true.",
                        "examples": {
                            "value": 5
                        },
                        "valids": 0,
                        "invalids": null
                    },
                    "vpp": {
                        "type": "boolean",
                        "flags": {
                            "insensitive": true
                        },
                        "description": "Enables Apple Volume Purchase Program purchase handling for this assignment when the app should be installed through VPP licensing.",
                        "examples": {
                            "value": true
                        },
                        "truthy": true,
                        "falsy": true
                    },
                    "iOSApp": {
                        "type": "boolean",
                        "flags": {
                            "insensitive": true
                        },
                        "description": "Apple InstallApplication iOSApp flag passed for this assignment when the target app should be treated as an iOS app payload.",
                        "examples": {
                            "value": true
                        },
                        "truthy": true,
                        "falsy": true
                    },
                    "configuration": {
                        "type": "object",
                        "description": "Managed app configuration object sent with the Apple app assignment when the application supports configuration keys.",
                        "examples": {
                            "value": {}
                        }
                    },
                    "action": {
                        "type": "string",
                        "flags": {
                            "allowOnly": true
                        },
                        "description": "Assignment action defining whether the app is force-installed, available for optional install, or required during setup.",
                        "examples": {
                            "value": "forceInstall"
                        },
                        "valids": "forceInstall",
                        "invalids": ""
                    },
                    "actionStatus": {
                        "type": "string",
                        "flags": {
                            "allowOnly": true
                        },
                        "description": "Read-only effective assignment status shown in responses. Devices may report available assignments as either available or available-install depending on the device request state.",
                        "examples": {
                            "value": "forceInstall"
                        },
                        "valids": "forceInstall",
                        "invalids": ""
                    },
                    "scripts": {
                        "type": "object",
                        "description": "Optional agent-side install lifecycle scripts associated with this assignment for Apple agent-managed application flows.",
                        "examples": {
                            "value": {}
                        },
                        "children": {
                            "preInstall": {
                                "type": "string",
                                "valids": ""
                            },
                            "postInstall": {
                                "type": "string",
                                "valids": ""
                            },
                            "audit": {
                                "type": "string",
                                "valids": ""
                            },
                            "enforce": {
                                "type": "string",
                                "valids": ""
                            },
                            "runner": {
                                "type": "string",
                                "valids": ""
                            }
                        }
                    },
                    "updatePolicy": {
                        "type": "object",
                        "description": "Additional update-policy configuration stored with the app assignment for downstream deployment or agent-handled behaviors.",
                        "examples": {
                            "value": {}
                        }
                    }
                }
            }
        },
        "admVppLocationId": {
            "type": "string",
            "valids": "",
            "rules": {
                "name": "regex",
                "arg": {
                    "pattern": "string"
                }
            }
        },
        "segmentId": {
            "type": "number",
            "flags": {
                "unsafe": true
            },
            "invalids": null,
            "rules": {
                "name": "integer"
            }
        }
    },
    "mdmUserId": "698f3bde457fafa13d088791"
}

Responses

200 Response application/json
status boolean optional
data object optional
id string optional
Unique identifier for Apple enrollment token credentials within organizational MDM deployment system.
Match pattern: ^[a-fA-F0-9]{24}$
organization string optional
Unique identifier for organization managing Apple enrollment tokens and device registration workflows.
Match pattern: ^[a-fA-F0-9]{24}$
admEnterprise string optional
Apple Device Management enterprise identifier linking enrollment token to MDM server configuration.
Match pattern: ^[a-fA-F0-9]{24}$
admDevice string optional
Apple device identifier for enrollment token once device completes registration using token credentials.
Match pattern: ^[a-fA-F0-9]{24}$
mdmUser object optional
MDM user information associating enrollment token with specific user for device ownership tracking.
id string optional
MDM user unique identifier linking enrollment token to specific user account for device assignment.
Match pattern: ^[a-fA-F0-9]{24}$
email string optional
User email address for enrollment token recipient receiving device registration instructions and credentials.
≤ 128 characters
displayName string optional
Human-readable enrollment token name for identification and organization in administrative interfaces.
≤ 128 characters
tags array [string] optional
Classification tags for organizing and filtering enrollment tokens by department, device type, or purpose.
state string optional
Enrollment token lifecycle status indicating availability, usage, expiration, or deletion state.
PENDING DONE DELETED EXPIRED
config object optional
Token configuration object containing device setup parameters and enrollment-specific settings.
enroll object optional
Enrollment metadata containing token expiration and configuration signing status for device registration.
serverExpirationDate string optional
Timestamp when enrollment token expires and becomes invalid for device registration workflows.
Format: date-time
mobileConfigSigned boolean optional
Flag indicating whether mobile configuration profile is cryptographically signed for security verification.
type string optional
Enrollment token type classification defining registration method or device ownership model.
≤ 128 characters
subType string optional
Enrollment token subtype providing additional categorization for specialized registration workflows.
≤ 128 characters
updatedAt string optional
Timestamp indicating when enrollment token configuration was last modified or synchronized.
Format: date-time
createdAt string optional
Timestamp indicating when enrollment token credentials were initially generated in system.
Format: date-time
expireAt string optional
Timestamp defining enrollment token expiration deadline after which registration attempts will fail.
Format: date-time
enrollmentLink string optional
Direct URL for device enrollment combining token credentials and configuration for simplified registration workflow.
≤ 500 characters
enrollCode string optional
Short alphanumeric enrollment code for manual token entry during device setup process.
≤ 128 characters
admPolicy object optional
Apple Device Management policy configuration object defining device restrictions and security settings.
id string optional
Unique Apple device policy identifier used to track configuration rules and security settings throughout lifecycle.
Match pattern: ^[a-fA-F0-9]{24}$
organization string optional
Organization identifier owning this Apple device policy and managing enrolled iOS iPadOS and macOS devices.
Match pattern: ^[a-fA-F0-9]{24}$
admEnterprise string optional
Apple enterprise account identifier linked to Apple Business Manager or Apple School Manager for device management.
Match pattern: ^[a-fA-F0-9]{24}$
targetType string optional
Policy application scope defining whether configurations apply to entire device or device user context only.
device deviceUser
attachedProfile object optional
Automatically attached configuration profile containing essential MDM settings applied independently of policy assignments and priorities.
name string optional
Human-readable policy name displayed in dashboard for administrative identification and organizational purposes throughout device management.
≤ 256 characters
profiles array [object] optional
List of Apple configuration profiles containing device restrictions security settings and feature configurations applied by policy.
applications array [object] optional
List of application assignments defining managed apps with VPP licensing installation actions and configuration settings.
applicationsInfo array [object] optional
Enriched application metadata including app names icons versions and store information for dashboard display purposes.
books array [object] optional
List of book assignments for distributing VPP-purchased books or PDF documents to managed Apple devices.
booksInfo array [object] optional
Enriched book metadata including titles authors cover images and store information for dashboard display purposes.
scripts array [object] optional
List of script assignments for executing automated tasks compliance checks and configuration enforcement on macOS devices.
scriptsInfo array [object] optional
Enriched script metadata including execution history last run timestamps and success rates for monitoring purposes.
bookmarks array [object] optional
List of bookmark assignments for deploying web application shortcuts and internal portal links to device home screens.
assets array [object] optional
List of asset assignments for deploying files certificates configuration data and resources to managed macOS devices.
assetsInfo array [object] optional
Enriched asset metadata including file sizes deployment status and version information for monitoring and auditing purposes.
version integer optional
Policy version number incremented with each modification for tracking configuration changes and rollback capabilities.
≥ 0
updatedAt string optional
ISO timestamp of last policy modification for change tracking synchronization and audit trail purposes.
Format: date-time
createdAt string optional
ISO timestamp when policy was created in system for lifecycle tracking and compliance reporting purposes.
Format: date-time
agentConfiguration object optional
MDM agent behavior settings controlling location tracking app monitoring data collection and application enforcement actions.
segmentId integer optional
Segment identifier for scoping policy into an specific segment
≥ 0
exposeToChildren boolean optional
admPolicyAssignments array [object] optional
Array of policy assignments with priority ordering applied to devices enrolled using this token.
admPolicyId string optional
Policy identifier for multi-policy assignment specifying device configuration and security requirements.
Match pattern: ^[a-fA-F0-9]{24}$
admPolicy object optional
Complete policy configuration object embedded for reference containing device restrictions and settings.
priority integer optional
Numeric priority value determining policy application order when multiple policies target same device.
≥ 0
admVppLocation object optional
Volume Purchase Program location metadata for automatic app assignment during device enrollment.
id string optional
Volume Purchase Program location unique identifier within Apple Business Manager organization.
Match pattern: ^[a-fA-F0-9]{24}$
name string optional
Human-readable VPP location name identifying app purchase and distribution settings.
≤ 256 characters
config object optional
VPP location configuration settings defining regional app purchasing and distribution parameters.
summary object optional
Summary information providing quick access to enrollment token key metrics and expiration details.
expirationTimestamp string optional
Unix timestamp representation of enrollment token expiration for programmatic deadline calculation.
Format: date-time
profiles array [object] optional
Array of configuration profiles automatically installed on devices during enrollment using this token.
id string optional
Match pattern: ^[a-fA-F0-9]{24}$
organization string optional
Match pattern: ^[a-fA-F0-9]{24}$
admEnterprise string optional
Match pattern: ^[a-fA-F0-9]{24}$
admPolicy string optional
Match pattern: ^[a-fA-F0-9]{24}$
targetType string optional
device deviceUser
name string optional
≤ 256 characters
config object optional
certificates array [object] optional
type string optional
attached single
UUID string optional
≤ 128 characters
version integer optional
≥ 0
updatedAt string optional
Format: date-time
createdAt string optional
Format: date-time
assignedTo object optional
useCustomFileVaultCertificates boolean optional
parentAdmProfileId string optional
Match pattern: ^[a-fA-F0-9]{24}$
applications array [object] optional
Array of application assignments automatically deployed to devices during enrollment using this token.
admApplication string required
Apple application assignment target referencing the admApplication entity to install or expose on the device, policy, or enrollment token.
Match pattern: ^[a-fA-F0-9]{24}$
managed boolean optional
Controls Apple managed-install semantics for this app assignment. This field still drives InstallAsManaged and ChangeManagementState.
managementFlags number optional
Optional Apple MDM InstallApplication.ManagementFlags override for this app assignment. Supported values are 1 (remove app when the MDM profile is removed), 4 (prevent backup of app documents and data), and 5 (both behaviors). If omitted, backend behavior stays unchanged: managed=true sends 5; otherwise the field is omitted. This field only overrides Apple ManagementFlags and does not imply managed=true.
Format: float
0 1 4 5
vpp boolean optional
Enables Apple Volume Purchase Program purchase handling for this assignment when the app should be installed through VPP licensing.
iOSApp boolean optional
Apple InstallApplication iOSApp flag passed for this assignment when the target app should be treated as an iOS app payload.
configuration object optional
Managed app configuration object sent with the Apple app assignment when the application supports configuration keys.
action string optional
Assignment action defining whether the app is force-installed, available for optional install, or required during setup.
forceInstall available requiredForSetup
actionStatus string optional
Read-only effective assignment status shown in responses. Devices may report available assignments as either available or available-install depending on the device request state.
forceInstall available requiredForSetup available-install
scripts object optional
Optional agent-side install lifecycle scripts associated with this assignment for Apple agent-managed application flows.
updatePolicy object optional
Additional update-policy configuration stored with the app assignment for downstream deployment or agent-handled behaviors.
sendEmail boolean optional
Flag enabling automatic enrollment notification email delivery to user with token credentials and instructions.
emailText string optional
Custom message text appended to enrollment notification email providing additional context or instructions.
configuration object optional
Enrollment configuration settings controlling device setup workflow behavior and user data collection.
skipPersonalInfo boolean optional
Flag bypassing personal information collection during enrollment for corporate-owned device registration.
segmentId integer optional
Segment identifier for scoping enrollment token into an specific segment
≥ 0
{
    "status": true,
    "data": {
        "id": "698f3bde457fafa13d088791",
        "organization": "698f3bde457fafa13d088791",
        "admEnterprise": "698f3bde457fafa13d088791",
        "admDevice": "698f3bde457fafa13d088791",
        "mdmUser": {
            "id": "698f3bde457fafa13d088791",
            "email": "[email protected]"
        },
        "displayName": "John Doe - iPhone 15 Pro",
        "tags": [
            "sales",
            "executive",
            "iphone"
        ],
        "state": "PENDING",
        "config": {},
        "enroll": {
            "serverExpirationDate": "2026-03-15T23: 59:59Z",
            "mobileConfigSigned": true
        },
        "type": "user",
        "subType": "standard",
        "updatedAt": "2026-02-10T14: 22:00Z",
        "createdAt": "2026-01-15T10: 30:00Z",
        "expireAt": "2026-02-20T10: 30:00Z",
        "enrollmentLink": "https://app.applivery.com/enroll/apple/ABC123DEF456",
        "enrollCode": "ABC123DEF",
        "admPolicy": null,
        "admPolicyAssignments": [
            {
                "admPolicyId": "698f3bde457fafa13d088791",
                "admPolicy": {},
                "priority": 10
            }
        ],
        "admVppLocation": {
            "id": "698f3bde457fafa13d088791",
            "name": "US Corporate VPP",
            "config": {
                "countryISO2ACode": "US",
                "defaultPlatform": "ios",
                "locationName": "US Corporate Location"
            }
        },
        "summary": {
            "expirationTimestamp": "2026-02-20T10: 30:00Z"
        },
        "profiles": [
            {
                "id": "string",
                "organization": "string",
                "admEnterprise": "string",
                "admPolicy": "string",
                "targetType": "device",
                "name": "string",
                "config": {},
                "certificates": [
                    {
                        "mdmAssetId": "string",
                        "format": {
                            "uuid": "uuid",
                            "base64": "base64"
                        },
                        "location": "string",
                        "password": "string",
                        "allowAllAppsAccess": true,
                        "keyIsExtractable": true
                    }
                ],
                "type": "attached",
                "UUID": "string",
                "version": 0,
                "updatedAt": "2024-01-01T00: 00:00Z",
                "createdAt": "2024-01-01T00: 00:00Z",
                "assignedTo": {
                    "policies": [
                        {
                            "id": "string",
                            "name": "string"
                        }
                    ],
                    "devices": [
                        {
                            "id": "string",
                            "displayName": "string"
                        }
                    ]
                },
                "useCustomFileVaultCertificates": true,
                "parentAdmProfileId": "string"
            }
        ],
        "applications": [
            {
                "admApplication": "698f42e5457fafa13d088794",
                "managed": true,
                "managementFlags": 5,
                "vpp": true,
                "iOSApp": true,
                "configuration": {},
                "action": "forceInstall",
                "actionStatus": "forceInstall",
                "scripts": {},
                "updatePolicy": {}
            }
        ],
        "sendEmail": true,
        "emailText": "Please enroll your device by following the instructions in this email.",
        "configuration": {
            "skipPersonalInfo": true
        },
        "segmentId": "1"
    }
}
400 Response application/json
status boolean optional
false
error object optional
code number optional
5086
message string optional
Attached adm profiles can not be added
{
    "status": false,
    "error": {
        "code": 5050,
        "message": "Feature not allowed for you billing plan"
    }
}
401 Response application/json
status boolean optional
false
error object optional
code number optional
4004
message string optional
Invalid Token
{
    "status": false,
    "error": {
        "code": 4002,
        "message": "No auth token"
    }
}
404 Response application/json
status boolean optional
false
error object optional
code number optional
3001
message string optional
Entity not found
{
    "status": false,
    "error": {
        "code": 3001,
        "message": "Entity not found"
    }
}