---
title: "Enroll a customer-operated machine"
method: POST
path: "/v1/machines/external"
tags: ["machines"]
---

# Enroll a customer-operated machine

`POST /v1/machines/external`

Scope: `machines:write`. Creates an external machine_id for normal Tasks, Workflows, and schedules without provisioning Coasty compute. Authenticate this enrollment with the OWNER API key. Idempotency-Key is required: same key + canonical body safely replays the committed enrollment; a different body conflicts. The response contains a machine-scoped device_token only in this no-store enrollment response/replay, never in list/get; never put an owner API key in the driver.

## Headers

- `Idempotency-Key` string, required

## Request body

- ExternalMachineEnrollRequest
  - `display_name` string, required
  - `protocol_version` '1' — Driver protocol major version. Unsupported major versions fail before enrollment.
  - `capabilities` MachineCapability[], required
  - `platform` 'windows' | 'macos' | 'linux' | 'other', required
  - `screen_width` integer, nullable
  - `screen_height` integer, nullable — screen_width and screen_height must be supplied together when either is present.
  - `metadata` object — Non-secret labels only. Never put device credentials or screenshot data in metadata.

## Response `201`

External machine enrolled. Persist device_token immediately. It is recoverable only by replaying the exact Idempotency-Key/body within the 24-hour enrollment recovery window; list/get never return it.

- ExternalMachineEnrollResponse
  - `machine` MachineRecord, required
    - `proxy` MachineProxyView — Read-side proxy state. Never contains the credential -- a masked username and a fingerprint only.
      - `mode` 'none' | 'managed' | 'custom'
      - `scheme` string, nullable
      - `host` string, nullable
      - `port` integer, nullable
      - `status` 'pending' | 'applying' | 'active' | 'failed' | 'released', nullable
      - `authenticated` boolean, nullable
      - `username_masked` string, nullable
      - `credential_fingerprint` string, nullable
      - `egress_ip` string, nullable — The address the machine was observed leaving from, once proven.
      - `verified_at` string, date-time, nullable
      - `error` string, nullable
    - `id` string, required
    - `display_name` string, required
    - `kind` 'managed' | 'external', required — managed is a Coasty-hosted VM; external is a customer-operated driver that supplies frames and executes typed commands.
    - `capabilities` MachineCapability[], required
    - `protocol_version` string, nullable, required — External-driver protocol version. null for managed machines.
    - `connection_status` 'connected' | 'disconnected' | 'stale' | 'revoked', nullable, required — Liveness of an external driver. null for managed machines; separate from the hosted-VM lifecycle status.
    - `last_seen_at` string, date-time, nullable, required — Most recent authenticated observation, command poll, result, or heartbeat from an external driver.
    - `status` 'creating' | 'provisioning' | 'starting' | 'running' | 'stopping' | 'stopped' | 'restarting' | 'suspended' | 'deleting' | 'terminated' | 'error', required
    - `os_type` 'linux' | 'windows' — Runtime compatibility family. External-driver platform is supplied at enrollment and may be macOS or other even when this compatibility field is linux.
    - `desktop_enabled` boolean
    - `cpu_cores` integer
    - `memory_gb` number
    - `storage_gb` integer
    - `public_ip` string, nullable
    - `is_test` boolean
    - `created_at` string, date-time, nullable
    - `started_at` string, date-time, nullable
    - `auto_destroy_at` string, date-time, nullable
    - `ttl_minutes` integer, nullable
    - `metadata` object
    - `billing` MachineBilling — Per-machine runtime billing state. 1 credit = 1 cent.
      - `billed_to` 'api_wallet'
      - `running_credits_per_hour` integer — Effective API-wallet rate while this machine is running; discover the deployed rate card at GET /v1/machines/pricing.
      - `stopped_credits_per_hour` integer — Effective API-wallet storage rate while stopped/suspended; discover the deployed rate card at GET /v1/machines/pricing.
      - `accrued_cents` integer — Credits owed for the current metering segment so far.
      - `projected_daily_cents` integer — rate_cents_per_hour * 24 — a full day at the current rate.
      - `since` string, date-time, nullable — When the current metering segment started.
      - `total_credits_billed` integer — Lifetime credits this machine has billed.
      - `suspended_for_billing` boolean — true if stopped because the wallet ran dry.
      - `auto_destroy_at` string, date-time, nullable
      - `ttl_minutes` integer, nullable
  - `device_token` string, required — Machine-scoped bearer credential. It is returned only by the initial enrollment or an exact Idempotency-Key replay while the 24-hour recovery secret remains available; it is never present in list/get responses and must be stored in the driver's secret store.
  - `fencing_token` integer, required — Initial device lease generation. Send it on heartbeat and command-result calls.
  - `request_id` string, required

## Other responses

- `400` — Invalid request body or parameters.
- `401` — Missing, invalid, or revoked API key. Pass `X-API-Key: sk-coasty-live-...` (or test).
- `403` — API key lacks the required scope or tier-feature is unavailable on the caller's plan.
- `404` — Resource not found in this key's namespace.
- `409` — The resource state conflicts with this operation.
- `413` — The request body exceeds the endpoint limit.
- `422` — The JSON shape is valid but one or more values violate the endpoint contract.
- `429` — Rate or concurrency limit exceeded.
- `500` — Unexpected server error. Retry with exponential backoff.
- `502` — An upstream dependency returned an invalid response.
- `503` — A required service is temporarily unavailable.
- `504` — An upstream dependency timed out.

---

[API](https://skmtc.net/coasty/apis/coasty-public-api.md) · [All operations](https://skmtc.net/coasty/apis/coasty-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coasty/coasty-public-api/revisions/f50d93b0d8a1/schema)