Pending Approvals

When tenant policy requires manual approval, new hosts wait in Pending Approvals until you explicitly approve them. Credentials are issued only after approval.

Parent: Automation Platform
Related: Getting Started with DAP | Inventory Groups | Insights Nodes

Overview

Enrollment no longer always completes instantly. When a host registers with an enrollment token, the platform creates a pending enrollment request. Tenant policy decides whether the request is auto-approved (typical for Insights nodes) or held for operator review (default for Worker nodes on enterprise tenants).

Navigate to Automation Platform → Pending Approvals to see every host waiting to join.

What You See

The page lists pending requests in a table with:

Column	Description
Host	Requested hostname or host identifier
Type	Insights (Splunk add-on enrollment) or Worker (automation worker node)
Source IP	IP address captured when the host registered
Splunk version	Version reported by the enrolling host, when available
Requested	Timestamp of the enrollment request

Expand any row to see host facts in a structured layout:

Section	Contents
Server-captured	Source IP, enrollment token purpose, and API key TTL observed when the host registered
Self-reported	Hostname, architecture, Splunk version, and network addresses supplied by the enrolling host

Self-reported facts appear distinctly from server metadata so you can compare what the host claims against what the platform observed at registration time.

Approving or Rejecting

For each pending request you can:

Approve — mint credentials and allow the host to complete enrollment
Reject — deny the request; the host does not join your fleet

Use the search box to filter by hostname or IP address. Select multiple rows and use Approve selected to process a batch at once.

After you approve hosts, a banner links you to Inventory Groups so you can assign roles before running compliance or change plans.

Recently Approved

Below the pending table, the Recently approved section shows the latest approvals, rejections, and expired requests with status badges:

Status	Meaning
Awaiting host	Approved but the host has not finished check-in yet
Enrolled	Host completed enrollment and appears on the Nodes page
Rejected	Request was denied

When to Use This Page

A new Splunk host enrolled but does not appear on Nodes — check whether it is waiting here
You onboard Worker nodes that require manual approval under enterprise policy
You want to verify hostname, Splunk version, and source IP before granting fleet access

Worker enrollment is enterprise-only. You need the dap:platform:manage capability to approve or reject requests.

Worker install commands and enrollment tokens

Worker enrollment snippets generated in DAI may embed the one-time enrollment token in a ready-to-run shell command (printf … | deslicer-install.sh --token-stdin). The token is streamed to the installer over stdin and does not appear on the installer's process argv, but it may appear in shell history, clipboard, or saved runbooks if the operator copies the snippet.

That pattern is intentional for operator UX. It is paired with the manual approval gate above: the token alone does not grant fleet access. After the host runs the install command, enrollment stays pending until a platform operator reviews the request on this page and approves hostname, source IP, architecture, and Splunk version. Credentials are issued only on approval.

When no token is available at snippet render time, DAI falls back to an interactive hidden prompt instead of embedding a literal token.

Create an enrollment token on the Enrollment page (Insights or Worker type)
Run the install command on the target host
If policy requires approval, review the request on Pending Approvals
After approval, assign the host on Inventory Groups and confirm it on Nodes