Enrollment

9 routes de l'API publique. Textes de la source : openapi-csp.json du dépôt platform.

List enrollment tokens

GET /enrollment-tokens

Accès : Clé API du MSP, portée read.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
limit	requête	integer	non	Défaut : 50. Valeur : 1 à 100.
cursor	requête	string	non	Longueur minimum : 1.
client_id	requête	string (uuid)	non
status	requête	"pending" | "used" | "revoked" | "expired"	non
origin	requête	"portal" | "mcp"	non
used_by_endpoint_id	requête	string (uuid)	non	Only the token that enrolled this endpoint. With origin=mcp: the endpoint page shows its restore quarantine.

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
items	array of object	oui
items[].id	string (uuid)	oui
items[].client_id	string (uuid)	oui
items[].type	"agent" | "m365"	oui
items[].endpoint_id	string (uuid) | null	oui	Reattach token: its agent endpoint. Null: the token enrolls a new endpoint.
items[].status	"pending" | "used" | "revoked" | "expired"	oui	pending: can still enroll. A used token stays used, even if revoked later.
items[].created_at	string (date-time)	oui
items[].expires_at	string (date-time)	oui
items[].used_at	string (date-time) | null	oui
items[].used_by_endpoint_id	string (uuid) | null	oui
items[].revoked_at	string (date-time) | null	oui
items[].tags	array of object	oui	Tags the token gives to the endpoint it enrolls, by key. A used token keeps the tags it gave.
items[].origin	"portal" | "mcp"	oui	portal: made in the portal (or with an API key). mcp: made by an AI assistant with an MCP access
items[].oauth_client_id	string (uuid) | null	oui	mcp token: the OAuth client of the MCP access. Null otherwise.
items[].oauth_client_name	string | null	oui	mcp token: the name the OAuth client gave at its registration (RFC 7591 client_name), for example Claude. Text of the client, not checked: show it as text. Null for a portal token or a client without a name.
items[].created_by	string (uuid) | null	oui	The user who made the token (for an mcp token, the person of the MCP access)
items[].restore_quarantine_until	string (date-time) | null	oui	Used mcp token: until then, its endpoint is no restore target for an MCP access, unless a person approves it in the portal (POST /endpoints/:id/mcp-approval). Null: no quarantine (any other token, approved, or over)
items[].restore_approved_at	string (date-time) | null	oui	Used mcp token: when a person approved its endpoint as a restore target.
next_cursor	string | null	oui

Create enrollment token

POST /enrollment-tokens

Accès : Clé API du MSP, portée operate.

Corps de la requête (application/json)

Nom	Type	Obligatoire	Description
client_id	string (uuid)	oui	Client of the caller's MSP, else 404.
type	"agent" | "m365"	non	Type of the endpoint the token enrolls.
tags	array of object	non	agent token only: tags the enrolled endpoint gets. Éléments maximum : 20.
tags[].key	string	oui	Longueur : 1 à 64.
tags[].value	string	oui	Longueur : 1 à 128.

Réponses

Code	Description
201	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 201 (application/json)

Nom	Type	Obligatoire	Description
id	string (uuid)	oui
client_id	string (uuid)	oui
type	"agent" | "m365"	oui
endpoint_id	string (uuid) | null	oui	Reattach token (POST /endpoints/:id/reattach-token): the agent endpoint it gives back to its machine. Null: the token enrolls a new endpoint.
token	string	oui
expires_at	string (date-time)	oui	Creation + 7 days; with an MCP access, creation + 1 h (MCP_ENROLLMENT_TOKEN_TTL_S, fixed)
install_command	string | null	oui	agent token: one-liner to paste as root: downloads the agent, installs the systemd unit, runs baastide agent enroll. The token is passed as BAASTIDE_ENROLL_TOKEN on the sh command only, never in argv. Null for an m365 token.
install_command_windows	string | null	oui	agent token: PowerShell one-liner to paste in an elevated PowerShell (Windows): downloads the agent, installs the Windows service, runs baastide agent enroll. The token is set in BAASTIDE_ENROLL_TOKEN of the session, never in argv; the installer removes it. Null for an m365 token.
tags	array of object	oui	Stored tags of the token, by key, in the form the endpoint will get. Not in the install commands.
tags[].key_id	string (uuid)	oui
tags[].key	string	oui
tags[].value	string	oui

Revoke enrollment token

DELETE /enrollment-tokens/{id}

Accès : Clé API du MSP, portée operate.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
id	chemin	string (uuid)	oui

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
id	string (uuid)	oui
client_id	string (uuid)	oui
type	"agent" | "m365"	oui
endpoint_id	string (uuid) | null	oui	Reattach token: its agent endpoint. Null: the token enrolls a new endpoint.
status	"pending" | "used" | "revoked" | "expired"	oui	pending: can still enroll. A used token stays used, even if revoked later.
created_at	string (date-time)	oui
expires_at	string (date-time)	oui
used_at	string (date-time) | null	oui
used_by_endpoint_id	string (uuid) | null	oui
revoked_at	string (date-time) | null	oui
tags	array of object	oui	Tags the token gives to the endpoint it enrolls, by key. A used token keeps the tags it gave.
tags[].key_id	string (uuid)	oui
tags[].key	string	oui
tags[].value	string	oui
origin	"portal" | "mcp"	oui	portal: made in the portal (or with an API key). mcp: made by an AI assistant with an MCP access
oauth_client_id	string (uuid) | null	oui	mcp token: the OAuth client of the MCP access. Null otherwise.
oauth_client_name	string | null	oui	mcp token: the name the OAuth client gave at its registration (RFC 7591 client_name), for example Claude. Text of the client, not checked: show it as text. Null for a portal token or a client without a name.
created_by	string (uuid) | null	oui	The user who made the token (for an mcp token, the person of the MCP access)
restore_quarantine_until	string (date-time) | null	oui	Used mcp token: until then, its endpoint is no restore target for an MCP access, unless a person approves it in the portal (POST /endpoints/:id/mcp-approval). Null: no quarantine (any other token, approved, or over)
restore_approved_at	string (date-time) | null	oui	Used mcp token: when a person approved its endpoint as a restore target.

Set enrollment token tags

PUT /enrollment-tokens/{id}/tags

Accès : Clé API du MSP, portée operate.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
id	chemin	string (uuid)	oui

Corps de la requête (application/json)

Nom	Type	Obligatoire	Description
tags	array of object	oui	Éléments maximum : 20.
tags[].key	string	oui	Longueur : 1 à 64.
tags[].value	string	oui	Longueur : 1 à 128.

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
id	string (uuid)	oui
client_id	string (uuid)	oui
type	"agent" | "m365"	oui
endpoint_id	string (uuid) | null	oui	Reattach token: its agent endpoint. Null: the token enrolls a new endpoint.
status	"pending" | "used" | "revoked" | "expired"	oui	pending: can still enroll. A used token stays used, even if revoked later.
created_at	string (date-time)	oui
expires_at	string (date-time)	oui
used_at	string (date-time) | null	oui
used_by_endpoint_id	string (uuid) | null	oui
revoked_at	string (date-time) | null	oui
tags	array of object	oui	Tags the token gives to the endpoint it enrolls, by key. A used token keeps the tags it gave.
tags[].key_id	string (uuid)	oui
tags[].key	string	oui
tags[].value	string	oui
origin	"portal" | "mcp"	oui	portal: made in the portal (or with an API key). mcp: made by an AI assistant with an MCP access
oauth_client_id	string (uuid) | null	oui	mcp token: the OAuth client of the MCP access. Null otherwise.
oauth_client_name	string | null	oui	mcp token: the name the OAuth client gave at its registration (RFC 7591 client_name), for example Claude. Text of the client, not checked: show it as text. Null for a portal token or a client without a name.
created_by	string (uuid) | null	oui	The user who made the token (for an mcp token, the person of the MCP access)
restore_quarantine_until	string (date-time) | null	oui	Used mcp token: until then, its endpoint is no restore target for an MCP access, unless a person approves it in the portal (POST /endpoints/:id/mcp-approval). Null: no quarantine (any other token, approved, or over)
restore_approved_at	string (date-time) | null	oui	Used mcp token: when a person approved its endpoint as a restore target.

List deployment tokens

GET /deployment-tokens

Accès : Clé API du MSP, portée read.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
limit	requête	integer	non	Défaut : 50. Valeur : 1 à 100.
cursor	requête	string	non	Longueur minimum : 1.
client_id	requête	string (uuid)	non
status	requête	"active" | "exhausted" | "revoked" | "expired"	non

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
items	array of object	oui
items[].id	string (uuid)	oui
items[].client_id	string (uuid)	oui
items[].kind	"deployment"	oui
items[].status	"active" | "exhausted" | "revoked" | "expired"	oui
items[].max_uses	integer | null	oui	Null: no limit.
items[].use_count	integer	oui	Machines enrolled with the token. Never above max_uses, also with many enrollments at the same time. Valeur minimum : 0.
items[].allowed_cidrs	array of string (cidrv4) | string (cidrv6)	oui
items[].tags	array of object	oui	Tags each enrolled endpoint gets, by key.
items[].created_at	string (date-time)	oui
items[].created_by	string (uuid) | null	oui	The user who made the token. Null: the user was deleted.
items[].expires_at	string (date-time)	oui
items[].revoked_at	string (date-time) | null	oui
items[].last_used_at	string (date-time) | null	oui	Last enrollment with the token. Null: never used.
next_cursor	string | null	oui

Get deployment token

GET /deployment-tokens/{id}

Accès : Clé API du MSP, portée read.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
id	chemin	string (uuid)	oui

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
id	string (uuid)	oui
client_id	string (uuid)	oui
kind	"deployment"	oui
status	"active" | "exhausted" | "revoked" | "expired"	oui
max_uses	integer | null	oui	Null: no limit.
use_count	integer	oui	Machines enrolled with the token. Never above max_uses, also with many enrollments at the same time. Valeur minimum : 0.
allowed_cidrs	array of string (cidrv4) | string (cidrv6)	oui
tags	array of object	oui	Tags each enrolled endpoint gets, by key.
tags[].key_id	string (uuid)	oui
tags[].key	string	oui
tags[].value	string	oui
created_at	string (date-time)	oui
created_by	string (uuid) | null	oui	The user who made the token. Null: the user was deleted.
expires_at	string (date-time)	oui
revoked_at	string (date-time) | null	oui
last_used_at	string (date-time) | null	oui	Last enrollment with the token. Null: never used.

List deployment token endpoints

GET /deployment-tokens/{id}/endpoints

Accès : Clé API du MSP, portée read.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
id	chemin	string (uuid)	oui
limit	requête	integer	non	Défaut : 50. Valeur : 1 à 100.
cursor	requête	string	non	Longueur minimum : 1.

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
items	array of object	oui
items[].endpoint_id	string (uuid)	oui
items[].name	string	oui	Hostname at enrollment.
items[].display_name	string | null	oui
items[].status	"active" | "deleted"	oui
items[].machine_id	string | null	oui	Null: the agent did not send one.
items[].source_ip	string (ipv4) | string (ipv6) | null	oui	Address the enrollment came from. Null: unknown.
items[].enrolled_at	string (date-time)	oui
next_cursor	string | null	oui

Create reattach token

POST /endpoints/{id}/reattach-token

Accès : Clé API du MSP, portée operate.

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
id	chemin	string (uuid)	oui

Réponses

Code	Description
201	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 201 (application/json)

Nom	Type	Obligatoire	Description
id	string (uuid)	oui
client_id	string (uuid)	oui
type	"agent" | "m365"	oui
endpoint_id	string (uuid) | null	oui	Reattach token (POST /endpoints/:id/reattach-token): the agent endpoint it gives back to its machine. Null: the token enrolls a new endpoint.
token	string	oui
expires_at	string (date-time)	oui	Creation + 7 days; with an MCP access, creation + 1 h (MCP_ENROLLMENT_TOKEN_TTL_S, fixed)
install_command	string | null	oui	agent token: one-liner to paste as root: downloads the agent, installs the systemd unit, runs baastide agent enroll. The token is passed as BAASTIDE_ENROLL_TOKEN on the sh command only, never in argv. Null for an m365 token.
install_command_windows	string | null	oui	agent token: PowerShell one-liner to paste in an elevated PowerShell (Windows): downloads the agent, installs the Windows service, runs baastide agent enroll. The token is set in BAASTIDE_ENROLL_TOKEN of the session, never in argv; the installer removes it. Null for an m365 token.
tags	array of object	oui	Stored tags of the token, by key, in the form the endpoint will get. Not in the install commands.
tags[].key_id	string (uuid)	oui
tags[].key	string	oui
tags[].value	string	oui

Get install profile

GET /install-profile

Accès : Clé API du MSP, portée read.

Réponses

Code	Description
200	Success
default	Error (400, 401, 403, 404, 409, 415, 422, 429, 500, 502, 503 or 504)

Réponse 200 (application/json)

Nom	Type	Obligatoire	Description
profile_id	string (uuid) | null	oui	Public id of the profile, in the install URLs. Not a secret, gives no right. Null: no saved profile, the BaaStide profile applies.
profile	object	oui	The saved profile, or the BaaStide profile (revision 0) when profile_id is null.
profile.productName	string	oui	Longueur : 1 à 64.
profile.publisher	string	oui	Longueur : 1 à 64.
profile.shortName	string	oui
profile.serviceName	string	oui
profile.serviceDescription	string	oui	Longueur : 0 à 256.
profile.supportUrl	string	non	Longueur maximum : 2048.
profile.publicHost	string	non	Longueur maximum : 253.
profile.revision	integer	oui	Valeur minimum : 0.
install_url_linux	string	oui	URL of install.sh that the install command of an agent token fetches.
install_url_windows	string	oui	URL of install.ps1 that the Windows install command fetches.
updated_at	string (date-time) | null	oui	Last change; null without a saved profile.
platform_host	string	oui	Host of the platform URL (PUBLIC_URL): the target of the CNAME of profile.publicHost. Never a request header.