Documentation Index
Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt
Use this file to discover all available pages before exploring further.
Fleet enrollment lets an org admin roll Shadow AI out to many employees and see
the whole fleet in one dashboard — with least-privilege, per-device credentials
that can be revoked individually.
How it works
Admin mints an enrollment token
In the dashboard (Fleet → Enrollment Tokens) an admin creates a token,
optionally restricted by platform and with a max-use / expiry. The raw
token is shown once.
Each device redeems it
The agent calls
POST /api/v1/enroll (or pgshadow enroll <token>) and
receives a scan-only credential bound to the org’s fleet project. The
browser extension is configured with the same credential.Events roll up to the dashboard
Every scan is tagged with the device and
surface=desktop|browser. Admins
see all enrolled employees’ activity; non-admins never see colleagues’ data.Security properties
- Least privilege — device credentials carry a
scanscope only; they cannot reach proxy or management endpoints even if stolen. - Per-employee attribution — via an end-user label, without requiring a user account per employee.
- Org-scoped visibility — fleet events are visible to org admins only; the read path is bound to the organization, never a shared key.
API
| Action | Endpoint |
|---|---|
| Mint enrollment token | POST /dashboard/fleet/enrollment-tokens (admin) |
| Redeem (device) | POST /api/v1/enroll |
| List / revoke devices | GET / DELETE /dashboard/fleet/devices |
| Register a self-hosted instance | POST /dashboard/fleet/instances (admin) |