---
title: "Enroll an identity with a pre-exchanged certificate"
method: POST
path: "/enroll/ca"
tags: ["Enroll"]
---

# Enroll an identity with a pre-exchanged certificate

`POST /enroll/ca`

## Request

- Base URL: `https://demo.ziti.dev/edge/client/v1`
- URL: `https://demo.ziti.dev/edge/client/v1/enroll/ca`
- Auth: none declared
- TypeScript: <https://skmtc.dev/openziti/apis/ziti-edge-client/docs/enroll/ca/post.ts> (a function with typed inputs; its response is checked against the schema)

For CA auto enrollment, an identity is not created beforehand.
Instead one will be created during enrollment. The client will present a client certificate that is signed by a
Certificate Authority that has been added and verified (See POST /cas and POST /cas/{id}/verify).

During this process no CSRs are requires as the client should already be in possession of a valid certificate.

## Response `200`

Base empty response

- Empty
  - `data` object, required
  - `meta` Meta, required
    - `apiEnrollmentVersion` string
    - `apiVersion` string
    - `filterableFields` string[]
    - `pagination` Pagination
      - `limit` number, required
      - `offset` number, required
      - `totalCount` number, required

## Other responses

- `400`: The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
- `404`: The requested resource does not exist
- `429`: The resource requested is rate limited and the rate limit has been exceeded
- `503`: The request could not be completed due to the server being busy or in a temporarily bad state

## Changes

- **2025-03-17** `058711718149`: 1 info
  - added the non-success response with the status `400`
- **2025-01-24** `19dfd92f02a2`: 1 info
  - added the non-success response with the status `503`
- **2024-05-29** `cce2800c1357`: 3 warning, 2 info
  - the optional response header `WWW-Authenticate` removed for the status `200`
  - the optional response header `WWW-Authenticate` removed for the status `404`
  - the optional response header `WWW-Authenticate` removed for the status `429`
  - removed the non-success response with the status `400`
  - …1 more

[Operation history](https://skmtc.dev/openziti/apis/ziti-edge-client/changes/enroll/ca/post.md)

---

[API](https://skmtc.dev/openziti/apis/ziti-edge-client.md) - [All operations](https://skmtc.dev/openziti/apis/ziti-edge-client/llms.txt) - [OpenAPI document](https://skmtc.dev/openziti/apis/ziti-edge-client/revisions/f7b51eaafbbb?raw)