Chrome Management Enrollment Tokens API

The Chrome Management Enrollment Tokens API allows administrators to manage enrollment tokens used for enrolling Chrome browsers in Chrome Enterprise Core. This set of APIs can be used to create, retrieve, list, and revoke enrollment tokens for their devices.

Quick overview of API methods

URLs are relative to https://chromemanagement.googleapis.com/v1/customers/{customer_id}

Description	Relative URL	Http method
Create an enrollment token	/enrollmentTokens	POST
Retrieve an enrollment token	/enrollmentTokens/{token_permanent_id}	GET
List enrollment tokens	/enrollmentTokens	GET
Revoke an enrollment token	/enrollmentTokens/{token_permanent_id}:revoke	POST

See code samples for example requests and responses.

Filtering results

When listing enrollment tokens with the /enrollmentTokens method, you can narrow down the results using the filter query parameter. All filter parameters must be URL-escaped when sent in HTTP requests. Multiple conditions can be combined using the AND operator.

• String and Enum fields: Support = and : comparison operators.
• Organizational Unit filtering: You can filter tokens created for a specific Organizational Unit by specifying org_unit_path or org_unit_id.

Filterable fields

Field	Description
device_type	The device type the enrollment tokens are used for (currently CHROME_BROWSER).
token_state	The state of the enrollment token (ACTIVE, EXPIRED, REVOKED).
org_unit_path	The Organizational Unit path for the enrollment token (e.g. /Marketing).
org_unit_id	The Organizational Unit obfuscated ID for the enrollment token.

Admin Privileges

Chrome Management Enrollment Tokens API respects administrator role delegation.

Method	Admin privileges required
CreateEnrollmentToken	"Services -> Chrome Management -> Settings -> Managed Browsers"
GetEnrollmentToken	"Services -> Chrome Management -> Settings -> Managed Browsers" or "Services -> Chrome Management -> Settings -> Managed Browsers -> Read"
ListEnrollmentTokens	"Services -> Chrome Management -> Settings -> Managed Browsers" or "Services -> Chrome Management -> Settings -> Managed Browsers -> Read"
RevokeEnrollmentToken	"Services -> Chrome Management -> Settings -> Managed Browsers"

To manage administrator roles and privileges visit "Admin Console -> Admin Roles".

Note: administrator roles can be assigned directly to a Service Account.

API scopes

Chrome Management Enrollment Tokens API requires the following OAuth scopes:

Method	OAuth scopes required
CreateEnrollmentToken	https://www.googleapis.com/auth/chrome.management.enrollmenttokens
GetEnrollmentToken	https://www.googleapis.com/auth/chrome.management.enrollmenttokens or https://www.googleapis.com/auth/chrome.management.enrollmenttokens.readonly
ListEnrollmentTokens	https://www.googleapis.com/auth/chrome.management.enrollmenttokens or https://www.googleapis.com/auth/chrome.management.enrollmenttokens.readonly
RevokeEnrollmentToken	https://www.googleapis.com/auth/chrome.management.enrollmenttokens

For more information, see the Authentication Overview.