---
title: "Enroll a Cloud Connect cluster or standalone runtime"
method: POST
path: "/v1/cloud-connect/enroll"
tags: ["Cloud Connect"]
---

# Enroll a Cloud Connect cluster or standalone runtime

`POST /v1/cloud-connect/enroll`

## Request

- Base URL: `https://api.spice.ai`
- URL: `https://api.spice.ai/v1/cloud-connect/enroll`
- Auth: one of:
  - none
  - HTTP bearer

Token enrollment accepts a canonical kind-bound enrollment token. Standalone enrollment may instead use user Authorization plus X-Org-Name. Idempotency-Key is required for standalone enrollment.

## Headers

- `Idempotency-Key` string, uuid
- `X-Org-Name` string

## Request body

- union
  - object
    - `kind` 'standalone', required
    - `token` string, required
    - `expected_org` string
    - `csr_pem` string, required
    - `enc_pubkey_pem` string, required
    - `instance` object, required
    - `region` string
  - object
    - `kind` 'cluster', required
    - `token` string, required
    - `expected_org` string
    - `csr_pem` string, required
    - `enc_pubkey_pem` string, required
  - object
    - `kind` 'standalone', required
    - `csr_pem` string, required
    - `enc_pubkey_pem` string, required
    - `instance` object, required
    - `region` string

## Response `200`

Enrollment completed or exactly replayed

- union
  - object
    - `kind` 'standalone', required
    - `instance_id` string, required
    - `identity_cert_pem` string, required
    - `ca_bundle_pem` string, required
    - `gateway_addr` string, required
    - `not_after` string, date-time, required
    - `organization` object, required
      - `id` integer, required
      - `name` string, required
    - `region` string, required
    - `portal` object, required
      - `new_project_url` string, uri, required
    - `attachment` unknown, required
    - `recovered` boolean, required
  - object
    - `kind` 'cluster', required
    - `connection_id` string, required
    - `identity_cert_pem` string, required
    - `ca_bundle_pem` string, required
    - `gateway_addr` string, required
    - `not_after` string, date-time, required
    - `organization` object, required
      - `id` integer, required
      - `name` string, required
    - `region` string, required
    - `attachment` unknown, required

## Other responses

- `400`: Invalid request, kind mismatch, or unsupported project field
- `401`: Invalid credential or authorization
- `403`: Authenticated caller lacks the required scope or organization role
- `409`: Consumed token, connection already enrolled, unavailable connection, organization mismatch, or idempotency mismatch
- `410`: Enrollment token or authenticated recovery window expired
- `413`: Request body too large
- `500`: Internal or identity-provider failure; use the retryable response field

---

[API](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api.md) - [All operations](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/revisions/5f3b75dd847d?raw)