issue_enrollment_ticket

Category: auth
Access: write
Audience: administrative (ordinary users do not normally call this directly)

Purpose

Issues a one-time enrolment ticket binding a server-side grant to a single secret. Call it to enrol a new principal without sharing credentials.

Arguments

Required: user, projects.

Optional: reason, role, ticket_kind, ttl_seconds.

user. Note: Server-side grant subject, required.
projects. Note: Server-side grant, required; bound into the ticket and never taken from the later handshake caller.
reason.
role. Note: agent or conductor; defaults agent.
ticket_kind. Note: Optional designation for spoke enrolment (spoke or standard, default standard); stored on the ticket. Installations that disallow spokes refuse spoke-kind issuance.
ttl_seconds. Note: Defaults 3600.

Result

Object with ticket_id, secret (shown once; deliver out-of-band), and a note.

Boundaries

Conductor role required. The grant (user, role, projects) is fixed server-side at issue; the secret travels only inside the later encrypted bootstrap envelope.

Lifecycle / side effects

Persists a one-time ticket bound to the grant. The secret is shown once at issue; redemption burns the ticket and provisions the principal.

Errors

Non-conductor callers get a requires-conductor error payload. Missing user/projects, bad role/TTL/kind, or spoke-kind issuance where spokes are disallowed fail as a ticket issue failed payload.

Example

{
  "projects": "shared-ops",
  "user": "field-agent"
}

Result shape:

{
  "note": "secret shown once; deliver out-of-band",
  "secret": "<secret-once>",
  "ticket_id": "<uuid>"
}