Permissions

Access to REST API endpoints requires an access token that includes the corresponding permission. This page lists all permissions and their applicable endpoints.

Permission List

Scope	Type	Purpose
device:read	Read-only	List devices, get device detail, get device configuration, list device profiles, and get command results
device:control	Command write	Includes all device:read permissions, plus the ability to send relay, RS485, and other operation commands to devices
device:config	Config write	Includes all device:read permissions, plus the ability to modify device parameter configuration
device:manage	Management	Includes all device:read permissions, plus the ability to add devices, remove devices, and modify device passwords

Endpoint Requirements

Endpoint	Required Permission	Status
GET /wlte/v1/devices	device:read	Available
GET /wlte/v1/devices/{deviceId}	device:read	Available
GET /wlte/v1/devices/{deviceId}/config	device:read	Available
GET /wlte/v1/device-profiles	device:read	Available
GET /wlte/v1/commands/{commandId}	device:read	Available
POST /wlte/v1/devices/{deviceId}/relays/commands	device:control	Available
POST /wlte/v1/devices/{deviceId}/relays/{index}/commands	device:control	Compatibility endpoint, planned for removal
POST /wlte/v1/devices/{deviceId}/rs485/transceive	device:control	Available
PUT /wlte/v1/devices/{deviceId}/rs485/baud-rate	device:config	Available
PUT /wlte/v1/devices/{deviceId}/relays/{index}/jog-config	device:config	Available
POST /wlte/v1/devices	device:manage	Available
DELETE /wlte/v1/devices/{deviceId}	device:manage	Available
PUT /wlte/v1/devices/{deviceId}/password	device:manage	Available

Access Boundaries

• device:control, device:config, and device:manage all include the full permissions of device:read; no need to also grant device:read
• device:control, device:config, and device:manage are independent; grant each based on integration requirements
• When querying command results, a client can only access commands under devices it is authorized to access
• Missing, invalid, or expired authentication returns 401
• Valid authentication with insufficient permission returns 403 AUTH_SCOPE_DENIED