Workstation Enrollment

BitDrip uses enrollment tokens to register workstations with your policy engine. Each enrolled workstation runs the proxy daemon and reports heartbeat status, daemon version, and violation counts to the fleet health dashboard.

Enrollment Tokens

Create enrollment tokens in the Admin Dashboard under Workstations → Enrollment Tokens, or via the API:

# Create a single-use token
curl -X POST https://your-policy-engine/api/v1/organizations/<orgId>/workstations/tokens \
  -H "Authorization: Bearer <admin-jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "label": "Engineering laptop", "maxUses": 1 }'

# Create a bulk token for fleet deployment
curl -X POST https://your-policy-engine/api/v1/organizations/<orgId>/workstations/tokens \
  -H "Authorization: Bearer <admin-jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "label": "Engineering fleet Q2", "maxUses": 100 }'

Token fields:

Field	Description
label	Human-readable name shown in the dashboard
maxUses	Maximum number of enrollments per token (1 for single-use; higher for bulk fleet deployments)
expiresAt	Optional ISO 8601 expiry timestamp

Enrolling a Workstation

Interactive (end-user or IT-managed)

bash <(curl -fsSL https://your-policy-engine/install-agent.sh) --token <token>

This script:

1. Downloads the appropriate BitDrip bundle for the OS
2. Installs the proxy daemon and tray app
3. Calls POST /workstations/enroll with the token
4. Writes the config bundle (policyEngineUrl, apiKey, orgId, workstationId) to ~/.bitdrip/config.json
5. Generates and installs the CA certificate
6. Starts the proxy daemon and tray app

MDM / Zero-Touch Enrollment

For Jamf Pro, Microsoft Intune, or Ansible-managed fleets, stage the enrollment token as a file before running the installer. The proxy daemon reads the token at startup and self-enrolls without user interaction.

1. Deploy the token file via MDM to /etc/bitdrip/enrollment-token (Linux/macOS) or %PROGRAMDATA%\BitDrip\enrollment-token (Windows)
2. Deploy the installer package
3. The daemon reads BITDRIP_ENROLLMENT_TOKEN_PATH (or the default path) at first start and completes enrollment automatically

See the MDM deployment guides for platform-specific configuration (Jamf Pro, Intune, Ansible).

Revoking a Workstation

In the dashboard: Workstations → [workstation] → Revoke. The workstation's API key is invalidated immediately; the proxy daemon will fail open (or closed, depending on BITDRIP_OFFLINE_POLICY) until the operator updates or re-enrolls the device.

Token Lifecycle

State	Description
Active	Token is valid; useCount < maxUses
Exhausted	useCount >= maxUses; usedAt timestamp set
Revoked	Manually invalidated by an admin
Expired	Past expiresAt timestamp

Exhausted tokens cannot be used for new enrollments. Create a new token for additional workstations.