---
title: "Issue a single-use host enrollment token"
method: POST
path: "/v1/pools/{id}/enrollment-tokens"
tags: ["Pools"]
---

# Issue a single-use host enrollment token

`POST /v1/pools/{id}/enrollment-tokens`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v1/pools/{id}/enrollment-tokens`
- Auth: HTTP bearer

The secret expires after 24 hours. Observe enrollment is the default. Explicit execute reenrollment binds one existing host and rotates its credential when used. It can be prepared before enabling Route. Requests are not idempotent and must not be automatically replayed.

## Path parameters

- `id` string, required

## Request body

- PoolEnrollmentTokenRequest: Observe is the default, including an omitted body. Execute mode requires an existing host_id and a fresh installation. Token issuance does not activate Route or change host credentials until enrollment.
  - `mode` 'observe' | 'execute'
  - `host_id` string: Existing host in this pool required for execute reenrollment. Rejected for observe mode.

## Response `201`

Issue a single-use host enrollment token

- PoolEnrollmentToken
  - `id` string, required
  - `token` string, required: Secret single-use enrollment token returned only when issued. Keep it out of logs and source control.
  - `mode` 'observe' | 'execute', required
  - `expires_at` string, date-time, required

## Other responses

- `default`: Authentication, disabled feature, invalid input, missing pool or host, rate limits, and transient failures apply.

---

[API](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api.md) - [All operations](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api/revisions/a59210899d95?raw)