Management APIs / Cloud Connect

Issue a Cloud Connect enrollment token

POSThttps://api.spice.ai/v1/cloud-connect/token

Issues a one-time standalone or cluster enrollment token. Requires a user-derived bearer, X-Org-Name, the kind-appropriate write scope, and org admin/owner role. Client-credential tokens are rejected because enrollment admission must retain user audit attribution.

Authorizations

  • AuthorizationstringRequired

    Bearer <token>. Authentication lists the tokens it accepts.

Header parameters

  • X-Org-NamestringRequired

Body

application/jsonRequired

One of

kind: standaloneobject

  • kindstringRequired

    • Value: standalone

  • ttl_secondsinteger

    • Default: 3600
    • Minimum: 1
    • Maximum: 86400
kind: cluster, with nameobject

  • kindstringRequired

    • Value: cluster

  • namestringRequired

  • regionstring

  • cloud_account_idstring

  • cloud_providerstring

    • Value: aws

  • operations_modestring

    • Allowed values: managed, approval_required

  • ttl_secondsinteger

    • Default: 3600
    • Minimum: 1
    • Maximum: 86400
kind: cluster, with connection_idobject

  • kindstringRequired

    • Value: cluster

  • connection_idstringRequired

  • ttl_secondsinteger

    • Default: 3600
    • Minimum: 1
    • Maximum: 86400

Responses

201Enrollment token issuedapplication/json

  • kindstringRequired

    • Allowed values: standalone, cluster

  • tokenstringRequired

    • Pattern: ^spice-enroll-[A-Za-z0-9_-]{32}$

  • expires_atstring (date-time)Required

  • organizationobjectRequired

    2 properties

    • idintegerRequired

    • namestringRequired

  • targetobject | nullRequired

    The created cluster or rotated connection identifier.

400Invalid request or missing organization assertion

401Unauthorized

403Insufficient scope, role, or plan

409Cluster has already enrolled

413Request body too large

429Token issuance rate limit exceeded

500Internal token issuance failure

OpenAPIapi.spice.ai/openapi.json

curl -X POST "https://api.spice.ai/v1/cloud-connect/token" \
  -H "Authorization: Bearer <token>" \
  -H "X-Org-Name: <X-Org-Name>" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "standalone"
  }'
{
  "kind": "standalone",
  "token": "string",
  "expires_at": "2026-01-01T00:00:00Z",
  "organization": {
    "id": 0,
    "name": "string"
  },
  "target": {}
}

application/json