> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindsight.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Enroll Session

> Enroll the machine using the desktop app's logged-in account session
instead of an MDM-pushed enrollment token.

Creates (or rotates) a per-device token bound to the authenticated user
so the desktop agent is attributed to a real ``device -> user`` pair in
DLP reporting without any enrollment token. Idempotent per
``(workspace, hardware_id)`` like ``/enroll``: a machine the installer
already enrolled is ATTACHED to, never duplicated, so one laptop is one
row in the console and a pause applied to it reaches the machine in front
of the admin. What that reconciliation may and may not carry over is
decided below.



## OpenAPI

````yaml /api-reference/openapi.json post /api/runtime-security/agent/enroll-session
openapi: 3.1.0
info:
  title: Blindsight API
  version: 0.1.0
  description: >-
    The full Blindsight REST surface, generated from the running application.
    Replace the server host with your own deployment.


    For the Runtime Security integration surface (scan, proxy, tool calls) see
    the Runtime Security spec, which is hand written and carries worked
    examples.
servers:
  - url: https://api.your-blindsight.com
    description: Your Blindsight deployment
security: []
paths:
  /api/runtime-security/agent/enroll-session:
    post:
      tags:
        - runtime-security-agent
      summary: Enroll Session
      description: >-
        Enroll the machine using the desktop app's logged-in account session

        instead of an MDM-pushed enrollment token.


        Creates (or rotates) a per-device token bound to the authenticated user

        so the desktop agent is attributed to a real ``device -> user`` pair in

        DLP reporting without any enrollment token. Idempotent per

        ``(workspace, hardware_id)`` like ``/enroll``: a machine the installer

        already enrolled is ATTACHED to, never duplicated, so one laptop is one

        row in the console and a pause applied to it reaches the machine in
        front

        of the admin. What that reconciliation may and may not carry over is

        decided below.
      operationId: enroll_session_api_runtime_security_agent_enroll_session_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SessionEnrollRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnrollResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    SessionEnrollRequest:
      properties:
        hardware_id:
          type: string
          maxLength: 128
          minLength: 4
          title: Hardware Id
        hostname:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Hostname
        platform:
          anyOf:
            - type: string
              maxLength: 32
            - type: 'null'
          title: Platform
        os_version:
          anyOf:
            - type: string
              maxLength: 64
            - type: 'null'
          title: Os Version
        os_user:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Os User
        agent_version:
          anyOf:
            - type: string
              maxLength: 32
            - type: 'null'
          title: Agent Version
      type: object
      required:
        - hardware_id
      title: SessionEnrollRequest
    EnrollResponse:
      properties:
        device_uuid:
          type: string
          title: Device Uuid
        device_token:
          type: string
          title: Device Token
        fail_mode:
          type: string
          title: Fail Mode
        firewall_enabled:
          type: boolean
          title: Firewall Enabled
        host_rules:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Host Rules
        host_rules_version:
          type: string
          title: Host Rules Version
        agentic:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Agentic
        policy_revision:
          type: integer
          title: Policy Revision
          default: 0
        privacy_mode:
          type: string
          title: Privacy Mode
          default: redacted_only
        injection_detection:
          type: boolean
          title: Injection Detection
          default: true
        paused:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Paused
      type: object
      required:
        - device_uuid
        - device_token
        - fail_mode
        - firewall_enabled
        - host_rules
        - host_rules_version
      title: EnrollResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError

````