Enrolling existing projects

Axiom Control lets a verified enterprise adopt Gateway projects its developers already run, without changing their code. Enrollment changes management ownership; it keeps the project ID, services, operations, action history and SDK integration as they are.

Console: Project enrollment at /control/orgs/:oid/enrollments (org side) and Review enrollment request at /app/enrollments/:id (project owner side).

Before you start: verify the organisation

Inviting projects requires a verified org. Console: Organisation verification at /control/orgs/:oid/verification.

POST /v1/orgs/{oid}/verification
content-type: application/json

{ "legal_name": "Acme Corporation", "domain": "acme.example" }

Verification goes through the CA port (Sectigo organisation validation). The result maps validated → verified, pending → pending, failed → unverified. Only a validated domain joins verified_domains, and a domain verified by another org is refused with 409.

Mock mode and the development override

With Sectigo Certificate Manager in mock mode, validation results come from the local development CA, not from Sectigo's validation team. In a development environment only, setting AXIOM_DEV_AUTO_VERIFY_ORGS=true marks an org verified unless the CA reports failed, so local setups can try enrollment. The org's verification evidence then carries an entry of kind dev_override reading "Development override (AXIOM_DEV_AUTO_VERIFY_ORGS): NOT validated by Sectigo". The variable has no effect in staging or production.

1. Invite the project

You need the project ID from its owner (it is shown on the project overview).

POST /v1/orgs/{oid}/enrollments
content-type: application/json

{
  "project_id": "prj_…",
  "requested_terms": {
    "visibility": "full",
    "retention_days": 2555,
    "policy_changes": ["pol_…", "Refunds above USD 10,000 need two finance approvers"],
    "evidence_transfer": "since_enrollment"
  }
}

Term	Values	Meaning
visibility	metadata, full	metadata withholds summaries, resource IDs and field disclosures from the org.
retention_days	1–3650	Requested evidence retention (recorded; see the note on evidence retention).
policy_changes	up to 50 org policy IDs or descriptions	Policies the owner is asked to accept. IDs of org policies are previewed against the project.
evidence_transfer	none, since_enrollment, all	How much of the project's history the org can see.

The project owners are emailed. The invitation is pending until it is accepted, declined or expires.

An email domain match never grants access: an admin whose address shares a domain with a project owner cannot see or claim the project without this invitation and the owner's acceptance.

2. The owner reviews

GET /v1/enrollments/{id} (project owner of that project) returns the invitation, the project, the org, the conflicts ({ rule_id, layer, detail }) between the requested org policies and the project's own, and a preview ({ sampled, changed[] }) of how recent actions would have been decided under the combined policies.

3. Accept or decline

POST /v1/enrollments/{id}/accept
content-type: application/json

{ "note": "Accepted after review with the security team" }

Requires project.admin on the project. Acceptance sets the project's org, records acceptance in the audit log and starts enforcement of the org's active policies. The inviting org must still be verified at acceptance time. …/decline closes the invitation.

After acceptance:

• Org policies apply to the project as the enterprise layer. The project can tighten but not relax them.
• Org roles reach the project (for example org auditors can read its evidence, subject to the accepted visibility and evidence_transfer).
• Direct project members keep their access.
• The project appears in Fleet and gateways; pending invitations appear there with enrollment_state: "invited" and only the project ID.

Migrating with pending work

Enrollment does not touch action records. A pending approval from before enrollment still resolves and executes once, and earlier receipts stay verifiable. If enrollment is followed by moving enforcement to a customer-hosted gateway, follow the cutover steps in Fleet, gateways and cutover.