---
title: "Enroll an identity via one-time-token"
method: POST
path: "/enroll/ott"
tags: ["Enroll"]
---

# Enroll an identity via one-time-token

`POST /enroll/ott`

## Request

- Base URL: `https://demo.ziti.dev/edge/client/v1`
- URL: `https://demo.ziti.dev/edge/client/v1/enroll/ott`
- Auth: none declared
- TypeScript: <https://skmtc.dev/openziti/apis/ziti-edge-client/docs/enroll/ott/post.ts> (a function with typed inputs; its response is checked against the schema)

Enroll an identity via a one-time-token which is supplied via a query string parameter. This enrollment method
expects a PEM encoded CSRs to be provided for fulfillment. It is up to the enrolling identity to manage the
private key backing the CSR request.

## Request body

- OttEnrollmentRequest
  - `clientCsr` string
  - `token` string

## Response `200`

A response containing and identities client certificate chains

- EnrollmentCertsEnvelope
  - `data` EnrollmentCerts: Common data returned on any successful enrollment, regardless of method. The controllers field carries the set of controllers in the cluster the enrolling client may connect to.
    - `controllers` ControllerDetail[]: An array of controller resources
      - `_links` object, required: A map of named links
      - `createdAt` string, date-time, required
      - `id` string, required
      - `tags` Tags
      - `updatedAt` string, date-time, required
      - `apiAddresses` ApiAddressList
      - `certPem` string, required
      - `ctrlAddress` string, nullable
      - `fingerprint` string, required
      - `isOnline` boolean, required
      - `isPreferredLeader` boolean
      - `lastJoinedAt` string, date-time, required
      - `name` string, required
    - `ca` string: A PEM encoded set of CA certificates to trust
    - `cert` string: A PEM encoded set of certificates to use as the client chain
    - `serverCert` string: A PEM encoded set of certificates to use as the servers chain
  - `meta` Meta
    - `apiEnrollmentVersion` string
    - `apiVersion` string
    - `filterableFields` string[]
    - `pagination` Pagination
      - `limit` number, required
      - `offset` number, required
      - `totalCount` number, required

## Other responses

- `400`: The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
- `404`: The requested resource does not exist
- `429`: The resource requested is rate limited and the rate limit has been exceeded
- `503`: The request could not be completed due to the server being busy or in a temporarily bad state

## Changes

- **2026-10-14** `f7b51eaafbbb`: 1 breaking, 3 warning, 1 info
  - the `data` response's property type changed from `object` to no type for status `200`
  - removed the optional property `data/ca` from the response with the `200` status
  - removed the optional property `data/cert` from the response with the `200` status
  - removed the optional property `data/serverCert` from the response with the `200` status
  - …1 more
- **2025-03-17** `058711718149`: 1 info
  - added the non-success response with the status `400`
- **2025-01-24** `19dfd92f02a2`: 1 info
  - added the non-success response with the status `503`
- **2024-06-07** `26670d8bbc37`: 4 breaking, 1 warning, 1 info
  - added required request body
  - removed the media type `application/x-x509-user-cert` for the response with the status `200`
  - removed the media type `application/x-x509-user-cert` for the response with the status `404`
  - removed the media type `application/x-x509-user-cert` for the response with the status `429`
  - …2 more
- **2024-05-29** `cce2800c1357`: 3 breaking, 3 warning, 5 info
  - added the new required `query` request parameter `token`
  - removed the request body
  - removed the media type `application/json` for the response with the status `200`
  - the optional response header `WWW-Authenticate` removed for the status `200`
  - …7 more

[Operation history](https://skmtc.dev/openziti/apis/ziti-edge-client/changes/enroll/ott/post.md)

---

[API](https://skmtc.dev/openziti/apis/ziti-edge-client.md) - [All operations](https://skmtc.dev/openziti/apis/ziti-edge-client/llms.txt) - [OpenAPI document](https://skmtc.dev/openziti/apis/ziti-edge-client/revisions/f7b51eaafbbb?raw)