---
title: "Enrol a serving plugin"
method: POST
path: "/query/serve/enrol"
tags: ["query"]
---

# Enrol a serving plugin

`POST /query/serve/enrol`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in header `Authorization`

Issues a short-lived client certificate for a plugin running outside Marmot to connect and serve queries for the named sources. The caller must hold ingestion:serve, and each source must be free or already served by the caller.

## Request body

- PluginserveEnrolInput
  - `csr` string
  - `sources` PluginserveEnrolSource[]
    - `config` object
    - `name` string
    - `plugin_id` string

## Response `200`

OK

- PluginserveEnrolResult
  - `address` string: Address is the host:port to dial; when empty the serving process uses its Marmot host name with Port.
  - `ca_bundle` string
  - `certificate` string
  - `enrolment_id` string
  - `expires_at` string
  - `instance_id` string
  - `port` string
  - `signing_keys` string[]

## Other responses

- `400`: Bad Request
- `403`: Forbidden

## Changes

> 65 revisions in range; 1 not diffed.

- **2026-10-22** `b5eb291dd2fe`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/marmotdata/apis/marmot-api/changes/query/serve/enrol/post.md)

---

[API](https://skmtc.dev/marmotdata/apis/marmot-api.md) - [All operations](https://skmtc.dev/marmotdata/apis/marmot-api/llms.txt) - [OpenAPI document](https://skmtc.dev/marmotdata/apis/marmot-api/revisions/18c57b576cb6?raw)