get:
  summary: List enrollment tokens
  x-auth-scopes: [admin]
  parameters:
    - name: project_id
      in: query
      required: false
      schema:
        type: string
    - name: client_id
      in: query
      required: false
      schema:
        type: string
    - name: status
      in: query
      required: false
      schema:
        type: string
        enum: [active, used, expired, revoked]
  responses:
    '200':
      description: Token list
      content:
        application/json:
          schema:
            type: object
            properties:
              items:
                type: array
                items:
                  $ref: '../schemas/enrollment-token.yaml'
    '401':
      description: Unauthorized
      x-error-codes: [unauthorized]
      content:
        application/json:
          schema:
            $ref: '../schemas/error.yaml'
post:
  summary: Create enrollment token
  x-auth-scopes: [admin]
  requestBody:
    required: true
    content:
      application/json:
        schema:
          $ref: '../schemas/enrollment-token-create-request.yaml'
  responses:
    '201':
      description: Created
      content:
        application/json:
          schema:
            $ref: '../schemas/enrollment-token-create-response.yaml'
    '400':
      description: Bad Request
      x-error-codes: [invalid_payload]
      content:
        application/json:
          schema:
            $ref: '../schemas/error.yaml'
    '401':
      description: Unauthorized
      x-error-codes: [unauthorized]
      content:
        application/json:
          schema:
            $ref: '../schemas/error.yaml'