post:
  summary: Enroll client and issue long-term token
  security: []
  requestBody:
    required: true
    content:
      application/json:
        schema:
          $ref: '../schemas/enroll-request.yaml'
        examples:
          enroll:
            value:
              project_id: demo
              client_id: device-42
              software_id: kiosk
              enroll_token: enroll_6f3d2c...
  responses:
    '200':
      description: Enrollment successful
      content:
        application/json:
          schema:
            $ref: '../schemas/enroll-response.yaml'
          examples:
            issued:
              value:
                token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
                scope: read_manifest report_status
                expires_at: 2026-12-30T10:00:00Z
    '400':
      description: Bad Request
      x-error-codes: [invalid_payload]
      content:
        application/json:
          schema:
            $ref: '../schemas/error.yaml'
          examples:
            invalid_payload:
              value:
                code: invalid_payload
                message: Missing required fields
    '401':
      description: Unauthorized
      x-error-codes: [unauthorized]
      content:
        application/json:
          schema:
            $ref: '../schemas/error.yaml'
          examples:
            unauthorized:
              value:
                code: unauthorized
                message: Invalid or expired enrollment token
    '409':
      description: Conflict
      x-error-codes: [already_enrolled]
      content:
        application/json:
          schema:
            $ref: '../schemas/error.yaml'
          examples:
            already_enrolled:
              value:
                code: already_enrolled
                message: Client already enrolled