To ensure security and compliance with the [Android Management API Terms of
Service](https://developers.google.com/android/management/terms), access to device trust signals is restricted to authorized
applications.

## When allowlist registration is required

Whether your application must be on the allowlist depends on how the device is
managed and where your application runs:

- Companion apps on AMAPI-managed devices (no allowlist registration required): An application assigned the [`COMPANION_APP`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies.md.txt#RoleType.ENUM_VALUES.COMPANION_APP) role in a policy on an Android Management API (AMAPI) can access device trust signals without being on the allowlist on fully managed devices or from inside a work profile (with access limited to signals from the work profile). For details, see [Manage application roles](https://developers.google.com/android/management/app-roles.md.txt), [Policy Configuration](https://developers.google.com/android/management/sdk-local-commands.md.txt#policy), and [Access signals from a companion app](https://developers.google.com/android/management/device-trust-api.md.txt#companion-app-access).
- All other applications and environments (allowlist required): Your application must be on the allowlist to access device trust signals from inside a personal profile, on a non-managed device, on a device managed by a custom DPC, or from any application that isn't assigned the `COMPANION_APP` role.

## Register for device trust signals access

To apply for allowlist access to device trust signals and become a Device Trust
from Android Enterprise solutions provider, submit a request on the
[Android Enterprise Partner Portal](https://www.androidenterprise.dev/s/).