Enrollment

Generating enrollment tokens and onboarding new devices.

Overview

Enrollment tokens are used to register new devices with the central server. Each token can be configured with expiry dates and usage limits.

Generating Tokens

  1. Navigate to Enrollment
  2. Click Generate Token
  3. Configure:

- Expiry date — When the token expires

- Max uses — Maximum number of devices that can use this token (0 = unlimited)

- Description — Label for tracking purposes

Token Validation

A token is valid when:

  • It has not expired
  • Its use count has not reached max_uses (if set)
  • It has not been manually revoked

Enrollment Flow

1. Admin generates enrollment token
2. IT installs agent on endpoint with the token
3. Agent sends POST /api/v1/enroll with token + device info
4. Server validates token, creates device record
5. Server returns device_id, API key, tenant_id, and full policy
6. Agent saves credentials and begins heartbeat loop

Enrollment Request

The agent sends these fields during enrollment:

  • enrollment_token — The token string
  • hostname — Device hostname
  • os — Operating system (Windows/macOS)
  • os_version — Detailed OS version
  • device_model — Hardware model
  • serial_number — Device serial number
  • mac_address — Network MAC address
  • agent_version — BlueSentinel agent version

Post-Enrollment

After successful enrollment, the device:

  • Receives a unique device_id (UUID)
  • Receives an api_key (48-byte URL-safe token) for all future API calls
  • Is assigned to the tenant's default group and policy
  • Begins sending heartbeats every 60 seconds