- [Resource: EnrollmentToken](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#EnrollmentToken)
  - [JSON representation](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#EnrollmentToken.SCHEMA_REPRESENTATION)
- [GoogleAuthenticationOptions](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#GoogleAuthenticationOptions)
  - [JSON representation](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#GoogleAuthenticationOptions.SCHEMA_REPRESENTATION)
- [AuthenticationRequirement](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#AuthenticationRequirement)
- [Methods](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#METHODS_SUMMARY)

## Resource: EnrollmentToken

An enrollment token.

| JSON representation |
|---|
| ``` { "name": string, "value": string, "duration": string, "expirationTimestamp": string, "policyName": string, "additionalData": string, "qrCode": string, "oneTimeOnly": boolean, "user": { object (`https://developers.google.com/android/management/reference/rest/v1/User`) }, "allowPersonalUsage": enum (`https://developers.google.com/android/management/reference/rest/v1/AllowPersonalUsage`), "googleAuthenticationOptions": { object (`https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#GoogleAuthenticationOptions`) } } ``` |

| Fields ||
|---|---|
| `name` | `string` The name of the enrollment token, which is generated by the server during creation, in the form `enterprises/{enterpriseId}/enrollmentTokens/{enrollmentTokenId}`. |
| `value` | `string` The token value that's passed to the device and authorizes the device to enroll. This is a read-only field generated by the server. |
| `duration` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#duration` format)`` The length of time the enrollment token is valid, ranging from 1 minute to [`Durations.MAX_VALUE`](https://developers.google.com/protocol-buffers/docs/reference/java/com/google/protobuf/util/Durations.html#MAX_VALUE), approximately 10,000 years. If not specified, the default duration is 1 hour. Please note that if requested duration causes the resulting `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#EnrollmentToken.FIELDS.expiration_timestamp` to exceed [`Timestamps.MAX_VALUE`](https://developers.google.com/protocol-buffers/docs/reference/java/com/google/protobuf/util/Timestamps.html#MAX_VALUE), then `expirationTimestamp` is coerced to `Timestamps.MAX_VALUE`. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`. |
| `expirationTimestamp` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` The expiration time of the token. This is a read-only field generated by the server. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |
| `policyName` | `string` The name of the policy initially applied to the enrolled device, in the form `enterprises/{enterpriseId}/policies/{policyId}`. If not specified, the `policyName` for the device's user is applied. If `userName` is also not specified, `enterprises/{enterpriseId}/policies/default` is applied by default. When updating this field, you can specify only the `policyId` as long as the `policyId` doesn't contain any slashes. The rest of the policy name will be inferred. |
| `additionalData` | `string` Optional, arbitrary data associated with the enrollment token. This could contain, for example, the ID of an org unit the device is assigned to after enrollment. After a device enrolls with the token, this data will be exposed in the `enrollmentTokenData` field of the [`Device`](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#Device) resource. The data must be 1024 characters or less; otherwise, the creation request will fail. |
| `qrCode` | `string` A JSON string whose UTF-8 representation can be used to generate a QR code to enroll a device with this enrollment token. To enroll a device using NFC, the NFC record must contain a serialized `java.util.Properties` representation of the properties in the JSON. |
| `oneTimeOnly` | `boolean` Whether the enrollment token is for one time use only. If the flag is set to true, only one device can use it for registration. |
| `user (deprecated)` | ``object (`https://developers.google.com/android/management/reference/rest/v1/User`)`` > [!WARNING] > This item is deprecated! This field is deprecated and the value is ignored. |
| `allowPersonalUsage` | ``enum (`https://developers.google.com/android/management/reference/rest/v1/AllowPersonalUsage`)`` Controls whether personal usage is allowed on a device provisioned with this enrollment token. For company-owned devices: - Enabling personal usage allows the user to set up a work profile on the device. - Disabling personal usage requires the user provision the device as a fully managed device. For personally-owned devices: - Enabling personal usage allows the user to set up a work profile on the device. - Disabling personal usage will prevent the device from provisioning. Personal usage cannot be disabled on personally-owned device. |
| `googleAuthenticationOptions` | ``object (`https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#GoogleAuthenticationOptions`)`` Optional. Options related to Google authentication during the enrollment. |

## GoogleAuthenticationOptions

Options for Google authentication during the enrollment.

When triggering the enrollment with a `https://developers.google.com/android/management/reference/rest/v1/enterprises#SigninDetail`, these options are enforced after the user completes third-party sign-in and an EnrollmentToken is created. If this token's authenticationRequirement is set to `REQUIRED`, these options interact with the `https://developers.google.com/android/management/reference/rest/v1/enterprises#SigninDetail.FIELDS.google_authentication_options` that initiated the flow in the following ways: - If the user skipped Google sign-in earlier (permitted by `SigninDetail.googleAuthenticationOptions`), an error will occur and the user will be prompted to sign in again. - If `requiredAccountEmail` is set on this token and the user signed in with a different email earlier, an error will occur and the user will be asked to sign in again with the correct account.

| JSON representation |
|---|
| ``` { "authenticationRequirement": enum (`https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#AuthenticationRequirement`), "requiredAccountEmail": string } ``` |

| Fields ||
|---|---|
| `authenticationRequirement` | ``enum (`https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#AuthenticationRequirement`)`` Optional. Specifies whether user should authenticate with Google during enrollment. If this is set to any value other than `AUTHENTICATION_REQUIREMENT_UNSPECIFIED`, the enterprise-level setting `https://developers.google.com/android/management/reference/rest/v1/enterprises#Enterprise.FIELDS.google_authentication_settings` is ignored for devices enrolled with this token. |
| `requiredAccountEmail` | `string` Optional. Specifies the managed Google account that the user must use during enrollment. This field can only be set if `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#AuthenticationRequirement` is set to `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens#AuthenticationRequirement.ENUM_VALUES.REQUIRED`. |

## AuthenticationRequirement

Specifies whether user should authenticate with Google during enrollment. This overrides the enterprise-level setting `https://developers.google.com/android/management/reference/rest/v1/enterprises#Enterprise.FIELDS.google_authentication_settings`.

| Enums ||
|---|---|
| `AUTHENTICATION_REQUIREMENT_UNSPECIFIED` | The setting `https://developers.google.com/android/management/reference/rest/v1/enterprises#Enterprise.FIELDS.google_authentication_settings` for the enterprise that this enrollment token belongs to is used to determine whether the user needs to authenticate with Google during enrollment. |
| `OPTIONAL` | Google authentication is optional for the user. This means the user can choose to skip Google authentication during enrollment. |
| `REQUIRED` | Google authentication is required for the user. This means the user must authenticate with a Google account to proceed. |

| ## Methods ||
|---|---|
| ### `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens/create` | Creates an enrollment token for a given enterprise. |
| ### `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens/delete` | Deletes an enrollment token. |
| ### `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens/get` | Gets an active, unexpired enrollment token. |
| ### `https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens/list` | Lists active, unexpired enrollment tokens for a given enterprise. |