Create enrollment token for single user

POST

/v1/organizations/:organizationId/mdm/windows/enterprise/enrollment-tokens/

Create enrollment token for single user

Required Permission: mdm.windows.enrollmentToken.create

Generate a new enrollment credential assigned to a specific user, optionally sending enrollment instructions via email with custom messaging and policy configuration.

Request

Add parameter in header authorization

Example: Authorization: Bearer <token>

organizationId string

required

Match pattern: ^(([a-fA-F0-9]{24})|([a-zA-Z0-9\\-]{3,}))$

Body Params application/json

type string optional

object

children object optional

sendEmail object optional

type string optional

boolean

flags object optional

insensitive boolean optional

presence string optional

required

truthy boolean optional

falsy boolean optional

displayName object optional

type string optional

string

valids string optional

rules object optional

name string optional

max

arg number optional

Format: float

128

tags object optional

type string optional

array

flags object optional

sparse boolean optional

items object optional

type string optional

string

valids string optional

rules object optional

name string optional

max

arg number optional

Format: float

128

duration object optional

type string optional

number

flags object optional

unsafe boolean optional

invalids number optional

Format: float

null

rules object optional

name string optional

integer

language object optional

type string optional

string

flags object optional

allowOnly boolean optional

valids string optional

es

invalids string optional

emailText object optional

type string optional

string

valids string optional

winPolicyId object optional

type string optional

string

valids string optional

rules object optional

name string optional

regex

arg object optional

pattern string optional

Match pattern: ^[a-fA-F0-9]{24}$

winPolicyAssignments object optional

type string optional

array

flags object optional

sparse boolean optional

items object optional

type string optional

object

children object optional

winPolicyId object optional

priority object optional

segmentId object optional

type string optional

number

flags object optional

unsafe boolean optional

invalids number optional

Format: float

null

rules object optional

name string optional

integer

mdmUserId string required

MDM user identifier establishing device ownership upon enrollment determining access permissions, policy scope, and administrative responsibility for enrolled endpoints.

Match pattern: ^[a-fA-F0-9]{24}$

{
    "type": "object",
    "children": {
        "sendEmail": {
            "type": "boolean",
            "flags": {
                "insensitive": true,
                "presence": "required"
            },
            "truthy": true,
            "falsy": true
        },
        "displayName": {
            "type": "string",
            "valids": "",
            "rules": {
                "name": "max",
                "arg": 128
            }
        },
        "tags": {
            "type": "array",
            "flags": {
                "sparse": true
            },
            "items": {
                "type": "string",
                "valids": "",
                "rules": {
                    "name": "max",
                    "arg": 128
                }
            }
        },
        "duration": {
            "type": "number",
            "flags": {
                "unsafe": true
            },
            "invalids": null,
            "rules": {
                "name": "integer"
            }
        },
        "language": {
            "type": "string",
            "flags": {
                "allowOnly": true
            },
            "valids": "es",
            "invalids": ""
        },
        "emailText": {
            "type": "string",
            "valids": ""
        },
        "winPolicyId": {
            "type": "string",
            "valids": "",
            "rules": {
                "name": "regex",
                "arg": {
                    "pattern": "string"
                }
            }
        },
        "winPolicyAssignments": {
            "type": "array",
            "flags": {
                "sparse": true
            },
            "items": {
                "type": "object",
                "children": {
                    "winPolicyId": {
                        "type": "string",
                        "invalids": "",
                        "rules": {
                            "name": "regex",
                            "arg": {
                                "pattern": "string"
                            }
                        }
                    },
                    "priority": {
                        "type": "number",
                        "flags": {
                            "unsafe": true,
                            "presence": "required"
                        },
                        "invalids": null,
                        "rules": {
                            "name": "integer"
                        }
                    }
                }
            }
        },
        "segmentId": {
            "type": "number",
            "flags": {
                "unsafe": true
            },
            "invalids": null,
            "rules": {
                "name": "integer"
            }
        }
    },
    "mdmUserId": "698efa6ed851667d9c0aec88"
}

Responses

200 Response application/json

status boolean optional

data object optional

id string optional

Unique enrollment token identifier assigned at creation used throughout platform for referencing token in device registration workflows, admin interfaces, and audit logs.

Match pattern: ^[a-fA-F0-9]{24}$

organizationId string optional

Organization workspace owning this token determining access permissions, billing attribution, and device association enabling multi-tenant isolation and administrative boundaries.

Match pattern: ^[a-fA-F0-9]{24}$

winEnterpriseId string optional

Windows enterprise configuration defining MDM server endpoints, authentication certificates, and enrollment protocols governing device registration and management communication.

Match pattern: ^[a-fA-F0-9]{24}$

winDeviceId string optional

Windows device completing enrollment using this token establishing ownership relationship and enabling tracking which tokens provisioned which devices for audit purposes.

Match pattern: ^[a-fA-F0-9]{24}$

mdmUser object optional

MDM user account receiving token ownership establishing device responsibility, determining permission scope, and enabling user-specific policy application and communication.

id string optional

MDM user account identifier linking enrolled devices to responsible individuals for ownership tracking and administrative accountability.

Match pattern: ^[a-fA-F0-9]{24}$

email string optional

User email address enabling enrollment invitation delivery, account identification, and serving as primary communication channel for device management notifications.

≤ 128 characters

displayName string optional

Human-readable token label appearing in administrative interfaces, email notifications, and management reports helping administrators identify token purpose and target users.

≤ 128 characters

tags array [string] optional

Classification tags automatically applied to enrolled devices enabling organizational grouping, policy targeting, and fleet segmentation for streamlined device management workflows.

state string optional

Token lifecycle status tracking usage and availability with PENDING indicating unused token, DONE after enrollment completion, DELETED when revoked, EXPIRED when time-limited validity elapsed.

PENDING DONE DELETED EXPIRED

config object optional

Platform-specific enrollment configuration parameters containing advanced settings, custom workflows, and integration options tailored to organizational deployment requirements.

type string optional

Token category classification determining enrollment workflow behavior, permission requirements, and processing logic differentiating standard enrollment from specialized provisioning scenarios.

≤ 128 characters

subType string optional

Token variant providing additional workflow context enabling fine-grained categorization and specialized handling for different enrollment scenarios within organization.

≤ 128 characters

updatedAt string optional

Most recent modification timestamp recorded in ISO-8601 format tracking configuration changes, policy updates, and administrative edits for audit compliance and change history.

Format: date-time

createdAt string optional

Token creation timestamp in ISO-8601 format marking generation moment used for calculating age, enforcing retention policies, and providing audit trail foundation.

Format: date-time

expireAt string optional

Token expiration timestamp blocking device enrollment after specified time enforcing time-limited provisioning for security compliance, null value indicating permanent validity without expiration.

Format: date-time

enrollmentLink string optional

Complete enrollment URL sent to end users via email or messaging enabling one-click device registration by embedding authentication credentials and configuration parameters.

≤ 500 characters

enrollCode string optional

Short alphanumeric code facilitating manual token entry during enrollment serving as accessible alternative when link clicking impractical or for phone-based configuration entry.

≤ 128 characters

winPolicyId string optional

Legacy single policy reference maintained for backward compatibility with deprecated enrollment workflows, superseded by winPolicyAssignments enabling multi-policy composition.

Match pattern: ^[a-fA-F0-9]{24}$

winPolicyAssignments array [object] optional

Policy composition assignments including full embedded policy objects with priority values enabling complete configuration preview and conflict resolution analysis.

winPolicyId string optional

Match pattern: ^[a-fA-F0-9]{24}$

winPolicy object optional

id string optional

Unique identifier for this specific resource instance in the system following a standardized format enabling targeted operations, relationship mapping, and tracking across all platform endpoints and data stores.

Match pattern: ^[a-fA-F0-9]{24}$

organizationId string optional

Organization identifier indicating workspace ownership for access control and data isolation across multi-tenant environments.

Match pattern: ^[a-fA-F0-9]{24}$

winEnterpriseId string optional

Windows enterprise configuration identifier linking policy to specific enrollment settings and device management context.

Match pattern: ^[a-fA-F0-9]{24}$

name string optional

Policy display name shown in interfaces and used for identification in listings and device assignments.

≤ 256 characters

config object optional

OMA-DM configuration object containing registry settings, security policies, and device restrictions to apply on managed Windows devices.

applications array [object] optional

Array of application assignments included in policy enabling bundled deployment and management of software packages.

winApplicationId string optional

Windows application identifier for the app to include in policy deployment.

Match pattern: ^[a-fA-F0-9]{24}$

configuration object optional

Application-specific configuration settings applied during deployment enabling customized installation and runtime options.

action string optional

Deployment action specifying whether application is force-installed or made available for optional user installation.

≤ 128 characters

forceInstall available

updatePolicy object optional

Update policy controlling automatic update behavior, scheduling, and version constraints for deployed application.

applicationsInfo array [object] optional

Application metadata array containing name, version, and publisher details for included apps displayed in interfaces.

bookmarks array [object] optional

title string optional

≤ 256 characters

description string optional

≤ 500 characters

url string optional

≤ 500 characters

iconBase64 string optional

iconUrl string optional

≤ 500 characters

scripts array [object] optional

Array of script assignments included in policy enabling automated PowerShell or batch command operations.

type string optional

once loop onDemand

id string optional

≤ 128 characters

loopTime integer optional

≥ 0

resetDate string optional

Format: date-time

arguments string optional

argumentsProcessed string optional

name string optional

≤ 256 characters

description string optional

≤ 500 characters

runner string optional

≤ 256 characters

scriptsInfo array [object] optional

Script metadata array containing name, description, and timing details for included scripts providing comprehensive script information in interfaces.

admxConfigs array [object] optional

Array of ADMX configuration assignments enabling group policy template settings for advanced Windows configurations.

winAdmxConfigId string optional

ADMX configuration identifier for group policy template to include in policy.

Match pattern: ^[a-fA-F0-9]{24}$

admxConfigsInfo array [object] optional

ADMX configuration metadata array containing template details, settings types, and descriptions.

id string optional

Unique identifier for this ADMX configuration template enabling targeted operations and relationship tracking across the platform.

Match pattern: ^[a-fA-F0-9]{24}$

appName string optional

Application name for ADMX template indicating which software or Windows component these settings apply to.

≤ 256 characters

settingType string optional

Setting type classification indicating category such as security, privacy, or functionality for organizational grouping and filtering.

≤ 256 characters

fileName string optional

ADMX template file name indicating original group policy definition source for reference and administrative purposes.

≤ 256 characters

description string optional

Human-readable description explaining purpose and effect of these ADMX settings for administrator understanding and documentation.

≤ 256 characters

agentConfiguration object optional

MDM agent configuration settings controlling agent deployment, permissions, and capabilities on managed devices.

enabled boolean optional

Agent enablement flag controlling whether MDM agent is active on devices and able to perform management operations.

buildTag string optional

Agent build version tag specifying which agent release to deploy on devices for version control and compatibility.

≤ 128 characters

allowLocation boolean optional

Location permission flag controlling whether agent can access device location data for tracking features.

allowNetworkStatus boolean optional

Network status permission flag controlling whether agent can monitor network connectivity for reporting.

allowPackageTime boolean optional

Package time tracking permission flag controlling whether agent reports application usage statistics.

allowPackageTransfer boolean optional

Package transfer permission flag controlling whether agent can facilitate file transfers between devices.

assets array [object] optional

Array of file asset assignments included in policy enabling deployment of certificates, configuration files, or resources.

mdmAssetId string optional

Match pattern: ^[a-fA-F0-9]{24}$

location string optional

≤ 256 characters

assetName string optional

≤ 256 characters

scope string optional

user system all-users

assetsInfo array [object] optional

Asset metadata array containing file names, types, and sizes for included resources displayed in administrative interfaces.

version integer optional

Internal version counter for policy changes enabling conflict detection and synchronization tracking across device updates and modifications.

≥ 0

segmentId integer optional

Segment identifier for scoping policy into an specific segment

≥ 0

updatedAt string optional

ISO 8601 timestamp indicating the last time this record was modified in the database useful for tracking changes, synchronization processes, and maintaining audit trails of all modifications.

Format: date-time

createdAt string optional

ISO 8601 timestamp indicating when this record was initially created in the database providing historical context, chronological ordering capabilities, and analytics for lifecycle tracking and reporting.

Format: date-time

priority integer optional

≥ 0

summary object optional

Computed metadata aggregating token status information for UI display, dashboard visualization, and business logic evaluation without requiring field-by-field calculations.

expirationTimestamp string optional

Calculated expiration time combining creation timestamp and duration for streamlined validity checks and countdown displays in administrative interfaces.

Format: date-time

sendEmail boolean optional

Automated enrollment invitation email delivery flag triggering immediate notification to MDM user upon token creation containing enrollment instructions and access credentials.

emailText string optional

Custom message body embedded in enrollment invitation email providing personalized instructions, organizational context, and user-specific guidance enhancing onboarding experience.

segmentId integer optional

Segment identifier for scoping enrollment token into an specific segment

≥ 0

{
    "status": true,
    "data": {
        "id": "698efa6ed851667d9c0aec88",
        "organizationId": "698efa6ed851667d9c0aec88",
        "winEnterpriseId": "698efa6ed851667d9c0aec88",
        "winDeviceId": "698efa6ed851667d9c0aec88",
        "mdmUser": {
            "id": "698efa6ed851667d9c0aec88",
            "email": "[email protected]"
        },
        "displayName": "Engineering Laptop - John Doe",
        "tags": [
            "engineering",
            "laptop",
            "corporate"
        ],
        "state": "PENDING",
        "config": {},
        "type": "enrollment",
        "subType": "standard",
        "updatedAt": "2026-02-10T12: 00:00Z",
        "createdAt": "2026-01-15T09: 30:00Z",
        "expireAt": "2026-03-15T09: 30:00Z",
        "enrollmentLink": "https://mdm.company.com/enroll?token=abc123def456",
        "enrollCode": "ABC123",
        "winPolicyId": "698efa6ed851667d9c0aec88",
        "winPolicyAssignments": [
            {
                "winPolicyId": "698efa6ed851667d9c0aec88",
                "winPolicy": {
                    "id": "698efa6ed851667d9c0aec88",
                    "name": "Corporate Security Policy"
                },
                "priority": 100
            }
        ],
        "summary": {
            "expirationTimestamp": "2026-03-15T09: 30:00Z"
        },
        "sendEmail": true,
        "emailText": "Welcome to the corporate device management program. Click the link to enroll your device.",
        "segmentId": "1"
    }
}

400 Response application/json

status boolean optional

false

error object optional

code number optional

5145

message string optional

Error creating winEnrollmentToken

{
    "status": false,
    "error": {
        "code": 5050,
        "message": "Feature not allowed for you billing plan"
    }
}

401 Response application/json

status boolean optional

false

error object optional

code number optional

4004

message string optional

Invalid Token

{
    "status": false,
    "error": {
        "code": 4002,
        "message": "No auth token"
    }
}

404 Response application/json

status boolean optional

false

error object optional

code number optional

3001

message string optional

Entity not found

{
    "status": false,
    "error": {
        "code": 3001,
        "message": "Entity not found"
    }
}