Machine enrollment

A Tenant machine is one of your customer's own computers, running the Sai runtime. Your installer adds it to the Tenant with an enrollment code. Your backend creates the code with an Organisation Key and hands it to the installer.

1. Your backend creates an enrollment code for the Tenant.
2. Your installer passes the code to the Sai runtime on the customer's computer.
3. The runtime enrolls the computer once and keeps its own credential. The code is spent.
4. The machine appears in the Tenant's machine list and in GET /v1/agents/machines for a Tenant token.

Create an enrollment code

curl -s -X POST "$SAI_API_URL/v1/tenants/$TENANT_ID/enrollments" \
  -H "Authorization: Bearer $SAI_ORG_KEY"

No body.

{ "enrollmentToken": "senr_...", "expiresAt": 1790000900000 }

• The code enrolls one machine. Create one per computer.
• It expires 15 minutes after it is created. expiresAt is Unix time in milliseconds. Create it when the installer runs, not ahead of time.
• An unused code needs no clean-up: it expires.
• Treat it as a secret until it is used. Anyone holding it can enroll a computer into this Tenant.

Only an Organisation Key can create a code. The console shows a Tenant's machines but does not create codes.

On the machine

The Sai runtime redeems the code and connects the computer. It stores a long-lived machine credential of its own, so it stays enrolled across restarts without a new code.

If the code has expired or was already used, enrollment fails and the installer needs a new code.

After enrollment

List, inspect and revoke the Tenant's machines under /v1/tenants/{tenantId}/machines, or on the Tenant's page in the console.

• Revoke a machine. It is signed out at once and cannot reconnect. To bring it back, enroll it again with a new code.
• Disable the Tenant to stop every machine of it. They stay enrolled and reconnect when the Tenant is enabled again.
• Delete the Tenant to revoke every machine.