---
title: "POST /androidenterprise/v1/enterprises/{enterpriseId}/enrollmentTokens"
method: POST
path: "/androidenterprise/v1/enterprises/{enterpriseId}/enrollmentTokens"
tags: ["enrollmentTokens"]
---

# POST /androidenterprise/v1/enterprises/{enterpriseId}/enrollmentTokens

`POST /androidenterprise/v1/enterprises/{enterpriseId}/enrollmentTokens`

## Request

- Base URL: `https://androidenterprise.googleapis.com`
- URL: `https://androidenterprise.googleapis.com/androidenterprise/v1/enterprises/{enterpriseId}/enrollmentTokens`
- Auth: OAuth 2 and OAuth 2
  - Implicit: `https://accounts.google.com/o/oauth2/auth`
  - Scopes: `https://www.googleapis.com/auth/androidenterprise`
  - Authorization code: `https://accounts.google.com/o/oauth2/auth`
  - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/androidenterprise`
- TypeScript: <https://skmtc.dev/google/apis/androidenterprise/docs/androidenterprise/v1/enterprises/:enterpriseId/enrollmentTokens/post.ts> (a function with typed inputs; its response is checked against the schema)

Returns a token for device enrollment. The DPC can encode this token within the QR/NFC/zero-touch enrollment payload or fetch it before calling the on-device API to authenticate the user. The token can be generated for each device or reused across multiple devices.

## Path parameters

- `enterpriseId` string, required

## Request body

- EnrollmentToken: A token used to enroll a device.
  - `duration` string, google-duration: [Optional] The length of time the enrollment token is valid, ranging from 1 minute to [`Durations.MAX_VALUE`](https://developers.google.com/protocol-buffers/docs/reference/java/com/google/protobuf/util/Durations.html#MAX_VALUE), approximately 10,000 years. If not specified, the default duration is 1 hour. In the JSON REST API, this is represented as a string (e.g., `3600s`).
  - `enrollmentTokenType` 'enrollmentTokenTypeUnspecified' | 'userlessDevice' | 'userDevice': [Required] The type of the enrollment token.
  - `googleAuthenticationOptions` EnrollmentTokenGoogleAuthenticationOptions: Options for Google authentication during the enrollment.
    - `authenticationRequirement` 'authenticationRequirementUnspecified' | 'optional' | 'required': [Optional] Specifies whether user should authenticate with Google during enrollment. This setting, if specified,`GoogleAuthenticationSettings` specified for the enterprise resource is ignored for devices enrolled with this token.
    - `requiredAccountEmail` string: [Optional] Specifies the managed Google account that the user must use during enrollment.`AuthenticationRequirement` must be set to`REQUIRED` if this field is set.
  - `token` string: The token value that's passed to the device and authorizes the device to enroll. This is a read-only field generated by the server.

## Response `200`

Successful response

- EnrollmentToken: A token used to enroll a device.
  - `duration` string, google-duration: [Optional] The length of time the enrollment token is valid, ranging from 1 minute to [`Durations.MAX_VALUE`](https://developers.google.com/protocol-buffers/docs/reference/java/com/google/protobuf/util/Durations.html#MAX_VALUE), approximately 10,000 years. If not specified, the default duration is 1 hour. In the JSON REST API, this is represented as a string (e.g., `3600s`).
  - `enrollmentTokenType` 'enrollmentTokenTypeUnspecified' | 'userlessDevice' | 'userDevice': [Required] The type of the enrollment token.
  - `googleAuthenticationOptions` EnrollmentTokenGoogleAuthenticationOptions: Options for Google authentication during the enrollment.
    - `authenticationRequirement` 'authenticationRequirementUnspecified' | 'optional' | 'required': [Optional] Specifies whether user should authenticate with Google during enrollment. This setting, if specified,`GoogleAuthenticationSettings` specified for the enterprise resource is ignored for devices enrolled with this token.
    - `requiredAccountEmail` string: [Optional] Specifies the managed Google account that the user must use during enrollment.`AuthenticationRequirement` must be set to`REQUIRED` if this field is set.
  - `token` string: The token value that's passed to the device and authorizes the device to enroll. This is a read-only field generated by the server.

## Changes

- **2026-10-10** `88ef8ac4f0e1`: 2 breaking
  - removed the request body
  - removed the media type `*/*` for the response with the status `200`

[Operation history](https://skmtc.dev/google/apis/androidenterprise/changes/androidenterprise/v1/enterprises/:enterpriseId/enrollmentTokens/post.md)

---

[API](https://skmtc.dev/google/apis/androidenterprise.md) - [All operations](https://skmtc.dev/google/apis/androidenterprise/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/androidenterprise/revisions/bb41187f2ce4?raw)