# Issue a Cloud Connect enrollment token

`POST /v1/cloud-connect/token`

Issues a one-time standalone or cluster enrollment token. Requires a user-derived bearer, X-Org-Name, the kind-appropriate write scope, and org admin/owner role. Client-credential tokens are rejected because enrollment admission must retain user audit attribution.

## Header parameters

- `Authorization` (string, required): `Bearer <token>`. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts.
- `X-Org-Name` (string, required)

## Request body

Required.

Content type: `application/json`

One of:

- **kind: standalone** (object)
  - `kind` (string, required): Value: `standalone`.
  - `ttl_seconds` (integer): Default: `3600`. Minimum: `1`. Maximum: `86400`.
- **kind: cluster, with name** (object)
  - `kind` (string, required): Value: `cluster`.
  - `name` (string, required)
  - `region` (string)
  - `cloud_account_id` (string)
  - `cloud_provider` (string): Value: `aws`.
  - `operations_mode` (string): Allowed values: `managed`, `approval_required`.
  - `ttl_seconds` (integer): Default: `3600`. Minimum: `1`. Maximum: `86400`.
- **kind: cluster, with connection\_id** (object)
  - `kind` (string, required): Value: `cluster`.
  - `connection_id` (string, required)
  - `ttl_seconds` (integer): Default: `3600`. Minimum: `1`. Maximum: `86400`.

## Example request

```bash
curl -X POST "https://api.spice.ai/v1/cloud-connect/token" \
  -H "Authorization: Bearer <token>" \
  -H "X-Org-Name: <X-Org-Name>" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "standalone"
  }'
```

```http
POST /v1/cloud-connect/token HTTP/1.1
Host: api.spice.ai
Authorization: Bearer <token>
X-Org-Name: <X-Org-Name>
Content-Type: application/json
Content-Length: 26

{
  "kind": "standalone"
}
```

## Responses

**201 Created**

Enrollment token issued

Content type: `application/json`

- `kind` (string, required): Allowed values: `standalone`, `cluster`.
- `token` (string, required): Pattern: `^spice-enroll-[A-Za-z0-9_-]{32}$`.
- `expires_at` (string (date-time), required)
- `organization` (object, required)
  - `id` (integer, required)
  - `name` (string, required)
- `target` (object | null, required): The created cluster or rotated connection identifier.

**400 Bad Request**

Invalid request or missing organization assertion

**401 Unauthorized**

Unauthorized

**403 Forbidden**

Insufficient scope, role, or plan

**409 Conflict**

Cluster has already enrolled

**413 Content Too Large**

Request body too large

**429 Too Many Requests**

Token issuance rate limit exceeded

**500 Internal Server Error**

Internal token issuance failure

OpenAPI: [api.spice.ai/openapi.json](https://api.spice.ai/openapi.json)