---
title: "Enroll an identity via one-time-token"
method: POST
path: "/enroll"
tags: ["Enroll"]
---

# Enroll an identity via one-time-token

`POST /enroll`

present a OTT and CSR to receive a long-lived client certificate

## Query parameters

- `token` string, uuid
- `method` string

## Request body

- GenericEnroll
  - `certCsr` string
  - `clientCsr` string
  - `name` string
  - `password` string
  - `serverCertCsr` string
  - `username` string

## Response `200`

A response containing and identities client certificate chains

- EnrollmentCertsEnvelope
  - `data` EnrollmentCerts
    - `ca` string — A PEM encoded set of CA certificates to trust
    - `cert` string — A PEM encoded set of certificates to use as the client chain
    - `serverCert` string — A PEM encoded set of certificates to use as the servers chain
  - `meta` Meta
    - `apiEnrollmentVersion` string
    - `apiVersion` string
    - `filterableFields` string[]
    - `pagination` Pagination
      - `limit` number, required
      - `offset` number, required
      - `totalCount` number, required

## Other responses

- `400` — The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
- `404` — The requested resource does not exist
- `409` — The request could not be completed due to a conflict of configuration or state
- `410` — The request could not be completed as the resource is no longer available
- `429` — The resource requested is rate limited and the rate limit has been exceeded
- `503` — The request could not be completed due to the server being busy or in a temporarily bad state

---

[API](https://skmtc.net/openziti/apis/ziti-edge-client.md) · [All operations](https://skmtc.net/openziti/apis/ziti-edge-client/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openziti/ziti-edge-client/revisions/25da9a73a095/schema)