Grade 1
Scan a QR code
Scan the registrar’s private QR code on a phone or computer. Claim the invite to submit an application for review.
Open https://enroll.intrikata.com/register/us/pilot
DEVICE TRUST
Device enrollment
Find the right path for a device, automation client or reviewer. Your registrar sets the minimum assurance grade.
Open a private invitation ↗Invitation paths
Grade 1
Open an invite link
Open the private link from your registrar and claim it in your browser. Use the device certificate later to activate.
Open https://enroll.intrikata.com/register/us/pilot
Grade 1
HTTPS JSON
Submit the invitation token from an automation client. Review and mTLS activation follow the claim.
POST https://enroll.intrikata.com/v1/us/pilot/registration
Request body
{ "token": "<invitation token>" }Grade 2
Device certificate
Send the token from the enrolled device over mTLS with the client certificate named by the registrar.
POST https://trust.leapautomata.com/v1/us/pilot/registration
Request body
{ "token": "<invitation token>" }Grade 3
P-256 enrollment proof
Present the device certificate and sign the invitation challenge with the P-256 key pinned by the registrar.
POST https://trust.leapautomata.com/v1/us/pilot/registration
Request body
{ "token": "<invitation token>", "proof": "<base64url ES256 signature>" }Grade 3
Zero-knowledge enrollment
Present the device certificate and prove possession of the secret behind the registrar-pinned BIP340 commitment.
POST https://trust.leapautomata.com/v1/us/pilot/registration
Request body
{ "token": "<invitation token>", "proof": "<128 hex characters>" }Registrar submission
Registrar submission
Submit a device application from the operator console. Available for legacy tenants without managed device groups.
POST https://trust.leapautomata.com/v1/us/pilot/applications
Peer enrollment
Direct mTLS endorsement
Use a reviewer grant and an active same-zone validator. The devices bind the proof to their direct mTLS session.
POST https://trust.leapautomata.com/v1/us/pilot/peer-endorsements
Signed relay endorsement
Use a reviewer grant and a signed candidate proof when direct pairing is unavailable. A reviewer still approves admission.
POST https://trust.leapautomata.com/v1/us/pilot/peer-endorsements
Attested mTLS admission
Use direct mTLS, an active same-zone validator, and a fresh appraisal from a configured trusted-module verifier under a reviewer grant.
POST https://trust.leapautomata.com/v1/us/pilot/peer-endorsements
A reviewer creates a grant at . The validator submits the proof. Signed relay supports endorsement.
Invitation claims and registrar submissions go to review. The approved device then presents its client certificate to over mTLS.