---
title: "Issue a Cloud Connect enrollment token"
method: POST
path: "/v1/cloud-connect/token"
tags: ["Cloud Connect"]
---

# Issue a Cloud Connect enrollment token

`POST /v1/cloud-connect/token`

## Request

- Base URL: `https://api.spice.ai`
- URL: `https://api.spice.ai/v1/cloud-connect/token`
- Auth: HTTP bearer

Issues a one-time standalone or cluster enrollment token. Requires a user-derived bearer, X-Org-Name, the kind-appropriate write scope, and org admin/owner role. Client-credential tokens are rejected because enrollment admission must retain user audit attribution.

## Headers

- `X-Org-Name` string, required

## Request body

- union
  - object
    - `kind` 'standalone', required
    - `ttl_seconds` integer
  - object
    - `kind` 'cluster', required
    - `name` string, required
    - `region` string
    - `cloud_account_id` string
    - `cloud_provider` 'aws'
    - `operations_mode` 'managed' | 'approval_required'
    - `ttl_seconds` integer
  - object
    - `kind` 'cluster', required
    - `connection_id` string, required
    - `ttl_seconds` integer

## Response `201`

Enrollment token issued

- object
  - `kind` 'standalone' | 'cluster', required
  - `token` string, required
  - `expires_at` string, date-time, required
  - `organization` object, required
    - `id` integer, required
    - `name` string, required
  - `target` object, nullable, required: The created cluster or rotated connection identifier.

## Other responses

- `400`: Invalid request or missing organization assertion
- `401`: Unauthorized
- `403`: Insufficient scope, role, or plan
- `409`: Cluster is decommissioned
- `413`: Request body too large
- `429`: Token issuance rate limit exceeded
- `500`: Internal token issuance failure

---

[API](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api.md) - [All operations](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/revisions/5f3b75dd847d?raw)