Devices
Concept: Devices. Base path: /api/org/{slug}/devices (authenticated). The current device is identified by the session’s device_id claim (= TPM credentialId).
Every route below requires an org-scoped permission in addition to authentication. The
organization Owner and Admin bypass these checks; any other member must hold the listed
scope. Missing permission returns 403 with errorCode = "PERMISSION_DENIED" and the required
scope in required.
| Method · Route | Purpose | Required scope |
|---|---|---|
GET / | List devices (?ownership=asset), with IsCurrent per row | org.device_identity.list |
POST /register | Register a device | org.device_identity.create |
PUT /{deviceId}/status | Change status (block/activate/…) | org.device_identity.update |
DELETE /{deviceId} | Delete a device | org.device_identity.delete |
POST /{deviceId}/notify-tpm | Send TPM-match notification | org.device_identity.update |
PUT /{deviceId}/geofence | Set allowed countries (CSV) | org.device_identity.device_binding.update |
POST /{deviceId}/assign | Assign device to a member by email | org.device_identity.device_binding.update |
POST /assign-by-key | Assign by DeviceKey (= credentialId; body, not URL) | org.device_identity.device_binding.update |
POST /check-assignable | Check whether a DeviceKey can be assigned (no side effect) | org.device_identity.device_binding.read |
Anti-lockout
Section titled “Anti-lockout”Status-change and delete enforce anti-lockout: you cannot block/delete your own current or last device. Such attempts return 409 Conflict (ErrorCode = "lockout"); a precondition failure (e.g. delete requires prior block) returns 400.
Device modes (paid)
Section titled “Device modes (paid)”Restricting logins to pre-registered devices is a paid capability, gated at the org
security-settings save (OrgSettingsEndpoints.cs):
- Fortress (only pre-registered devices may log in) — requires the Advanced Device Trust
add-on (
addon.device_trust); otherwise 402ADDON_REQUIRED. Plan-independent. - Hybrid (pre-register / distinguish corporate devices) — requires the Pro+ plan feature
feature.device.hybridor the Device Trust add-on; otherwise 403.
The same entitlement is also enforced at the pre-registration entrances themselves
(DeviceManagementService.cs), so it cannot be bypassed by calling the API directly:
- POST
/registerwithOwnership = "Asset"(admin pre-registration) → 403 without the entitlement. Registering your own device (BYOD / owner auto-registration) stays free. - POST
/{deviceId}/assign,/assign-by-key, and/check-assignable(company-device assignment, including the device picked in a member invite) → rejected with the same upgrade message.
Registering a personal seal (passkey) on any device is always free. There is currently no per-organization device-count limit or per-device charge — the Device Trust add-on is billed per user, not per device.