Enroll a device

post

https://api.portal.saymine.com/enroll

First enrollment and resident-token re-enroll. Anonymous — the device holds no cert yet; the
token in the body is the credential. Returns 201 with the issued cert (auto-approve MVP
default), 202 if held for approval (a future held policy; MVP auto-approves), 401 for any token failure
(indistinguishable), 400 for a malformed body/CSR, 429 if a per-tenant enrollment cap is reached (T9),
503 if CAS is unavailable.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Request body for POST /enroll: the enrollment token credential + a PEM PKCS#10 csr.

token

string | null

The {TokenId}.{secret} enrollment credential. Validated by the service; a bad token is a 401.

csr

string | null

A PEM PKCS#10 CSR whose Subject CN is the device_id. Carries no tenant SAN (injected server-side).

deviceIdSource

string | null

Optional (T169, device-identity.md §3.2): which OS input the scanner derived the CSR's
CN deviceId from — smbios-uuid｜machine-guid｜platform-uuid｜hardware-serial. Purely
observability metadata so a silent derivation fallback cannot go unnoticed; it is
self-reported and never trusted for anything (REQ-AISPM-033 — identity comes from the CSR CN
and the token-resolved tenant, exactly as before). Absent, unknown, or over-length values are all
tolerated and never 400 (REQ-AISPM-064), so a scanner shipping this field before or after the
backend deploys is safe in either order.

Headers

content-type

string

enum

Defaults to application/json-patch+json

Generated from available request content types

Allowed:

Response

200

Success