---
title: "The daemon exchanges a one-time code for its own credential"
method: POST
path: "/v1/devices/enroll"
tags: ["devices"]
---

# The daemon exchanges a one-time code for its own credential

`POST /v1/devices/enroll`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/devices/enroll`
- Auth: none declared

A device route; the code is the only authentication, and any request carrying `Origin` is refused. A used, expired or unknown code is 401. A `device_id` registered to another person is 409 and that device's credential is left as it was; a revoked device, or a membership deactivated since the code was issued, is 403. The credential is answered once and stored as its hash; it is accepted by the device routes alone.

## Request body

- object
  - `code` string, required
  - `device_id` string, required
  - `name` string, required
  - `platform` 'macos' | 'windows' | 'ios' | 'android' | 'web', required

## Response `201`

The credential, shown once, the device, and the firm's policy with its version.

- object
  - `credential` string, required
  - `device` object, required
    - `id` string, required
    - `user_id` string, required
    - `name` string, required
    - `platform` 'macos' | 'windows' | 'ios' | 'android' | 'web', required
    - `created_at` string, date-time, required
    - `last_seen_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
  - `account` string
  - `tenant_id` string
  - `policy` object
    - `excluded_bundles` string[], required
    - `raw_archive` boolean, required
    - `swallow_short_pauses` boolean, nullable, required
    - `unit_minutes` integer, required
    - `time_zone` string, nullable
    - `context_retention_days` integer, required
    - `minimum_version` string, nullable, required
    - `always_on` 'member_choice' | 'enforced'
    - `policy_version` string, required

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `401`: No bearer token, or one that does not verify or has expired.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `409`: The id or the email already belongs to something else.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)