Enrollmenttokens: create

  • This method, part of the EnrollmentTokensService, is used to create an enrollment token for an enterprise.

  • The request requires authorization with thehttps://www.googleapis.com/auth/androidenterprise scope.

  • The request body includes fields likeenrollmentTokenType (required),duration (optional for the token's validity), andgoogleAuthenticationOptions (optional for controlling Google authentication during enrollment).

  • The response body mirrors the request body structure and includes the generated read-onlytoken value.

Note:Requiresauthorization.

Creates an enrollment token for the enterprise.This method is part of the EnrollmentTokensService.

Request

HTTP request

POST https://www.googleapis.com/androidenterprise/v1/enterprises/enterpriseId/enrollmentTokens

Parameters

Parameter nameValueDescription
Path parameters
enterpriseIdstring The ID of the enterprise.

Authorization

This request requires authorization with the following scope:

Scope
https://www.googleapis.com/auth/androidenterprise

For more information, see theauthentication and authorization page.

Request body

In the request body, supply data with the following structure:

{  "kind": "androidenterprise#enrollmentToken",  "token":string,  "enrollmentTokenType":string,  "duration": {    "seconds":long,    "nanos":integer  },  "googleAuthenticationOptions": {    "authenticationRequirement":string,    "requiredAccountEmail":string  }}
Property nameValueDescriptionNotes
kindstring
tokenstringThe token value that's passed to the device and authorizes the device to enroll. This is a read-only field generated by the server.
enrollmentTokenTypestring[Required] The type of the enrollment token.

Acceptable values are:
  • "enrollmentTokenTypeUnspecified"
  • "userDevice"
  • "userlessDevice"
durationnested object[Optional] The length of time the enrollment token is valid, ranging from 1 minute toDurations.MAX_VALUE, approximately 10,000 years. If not specified, the default duration is 1 hour.
duration.secondslongSigned seconds of the span of time.
googleAuthenticationOptionsnested object[Optional] Provides options related to Google authentication during the enrollment.
googleAuthenticationOptions.authenticationRequirementstring[Optional] Specifies whether user should authenticate with Google during enrollment. If provided, overrides theGoogleAuthenticationSettings for theenterprise resource when devices are enrolled with this token.

Acceptable values are:
  • "authenticationRequirementUnspecified"
  • "optional"
  • "required"
googleAuthenticationOptions.requiredAccountEmailstring[Optional] Specifies the managed Google Account that the user must use during enrollment.AuthenticationRequirement must be set toREQUIRED if this field is set.

Response

If successful, this method returns a response body with the following structure:

{  "kind": "androidenterprise#enrollmentToken",  "token":string,  "enrollmentTokenType":string,  "duration": {    "seconds":long,    "nanos":integer  },  "googleAuthenticationOptions": {    "authenticationRequirement":string,    "requiredAccountEmail":string  }}
Property nameValueDescriptionNotes
kindstring
tokenstringThe token value that's passed to the device and authorizes the device to enroll. This is a read-only field generated by the server.
enrollmentTokenTypestring[Required] The type of the enrollment token.

Acceptable values are:
  • "enrollmentTokenTypeUnspecified"
  • "userDevice"
  • "userlessDevice"
durationnested object[Optional] The length of time the enrollment token is valid, ranging from 1 minute toDurations.MAX_VALUE, approximately 10,000 years. If not specified, the default duration is 1 hour.
duration.secondslongSigned seconds of the span of time.
googleAuthenticationOptionsnested object[Optional] Provides options related to Google authentication during the enrollment.
googleAuthenticationOptions.authenticationRequirementstring[Optional] Specifies whether user should authenticate with Google during enrollment. This setting, if specified,GoogleAuthenticationSettings specified for the enterprise resource is ignored for devices enrolled with this token.

Acceptable values are:
  • "authenticationRequirementUnspecified"
  • "optional"
  • "required"
googleAuthenticationOptions.requiredAccountEmailstring[Optional] Specifies the managed Google Account that the user must use during enrollment.AuthenticationRequirement must be set toREQUIRED if this field is set.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-10-02 UTC.