---
type: api
title: Create enrollment token
description: Creates an enrollment token.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/cloud-enterprise/operation/operation-create-enrollment-token
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/cloud-enterprise/operation/operation-create-enrollment-token
products:
  - Elastic Cloud Enterprise
---

# Create enrollment token

## Paths

- `POST` `/platform/configuration/security/enrollment-tokens`

## Description

Creates an enrollment token.

## Authentication

- Basic: `Authorization: Basic <credentials>`
- Api key: `Authorization: <value>`

## Request body

Request parameters for the enrollment token

`application/json`

- `roles` (string[]) — optional
  The additional services for which this enrollment token applies (empty if not specified, ie system services only)
- `persistent` (boolean) — required
  Whether this token can subsequently to its grant be revoked from the UI
- `validity_in_seconds` (integer · format: int32) — optional
  The time in seconds for which this token is valid (defaults to 1 hour). Currently this can only be set for ephemeral (persistent: false) tokens.

## Responses

#### `200`

A token has been generated that can be used to start new servers with the requested roles

`application/octet-stream`

- `token` (string)
  The requested token
- `token_id` (string)
  An identifier for the requested token (if persistent) that can be used in listing and deletion
#### `400`

The token request format was invalid, details in the error (code: 'enrollment_tokens.invalid_token_request')

`application/octet-stream`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
#### `403`

No signing key is available to generate a token (code: 'enrollment_tokens.signing_key_not_found')

`application/octet-stream`

- `errors` (object[])
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` (string[])
    If the error can be tied to a specific field or fields in the user request, this lists those fields
## Code examples

#### curl

```curl
curl -X POST "${API_URL}/platform/configuration/security/enrollment-tokens" \
  -u "${USERNAME}:${PASSWORD}" \
  -H "Content-Type: application/json" \
  -d '{
    "persistent": false
  }'
```