Skip to content

Menu

API reference · Tunnels

Mint a one-time token that enrolls one agent

POST/v1/orgs/{org}/connectors/enrollment-tokens

Mint a one-time token that enrolls one agent. Shown once

Permission: tunnels.connectors.manage
Audit log: tunnels.enrollment_token.create
Operation: tunnels.enrollment_tokens.create

Parameters

Name	In	Type	Required	Notes
`org`	path	string	yes	for example `"org_01h455vb4pex5vsknk084sn02q"`
`Idempotency-Key`	header	string	no	One key per intended mutation. A retry with the key never executes twice; its response carries a secret and is not replayed: a duplicate answers 409 idempotency_outcome_committed. For example `"01h455vb4pex5vsknk084sn02q"`
`x-obhut-management-assignment`	header	string	no	Select one staff assignment. Direct membership remains the default. Bound API tokens use their stored source and ignore this selector. For example `"masg_01h455vb4pex5vsknk084sn02q"`

Request body

Field	Type	Required	Notes
`ttlHours`	integer	no	1 to 168; default `24`

Response 201

Field	Type	Required	Notes
`id`	string	yes	for example `"tunnel_01h455vb4pex5vsknk084sn02q"`
`token`	string	yes
`expiresAt`	string (date-time)	yes	UTC, ISO 8601.
`downloadOrigin`	string (uri) or null	yes

Request shaped from the schemas

curl

curl -X POST 'https://api.obhut.io/v1/orgs/org_01h455vb4pex5vsknk084sn02q/connectors/enrollment-tokens' \
  -H "Authorization: Bearer $OBHUT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "ttlHours": 24
}'

Response 201

{
  "id": "tunnel_01h455vb4pex5vsknk084sn02q",
  "token": "string",
  "expiresAt": "2026-01-01T12:00:00.000Z",
  "downloadOrigin": "https://www.example.com/"
}