A device is an automation identity inside an instance. It avoids embedding personal user API keys in scripts and keeps the audit trail separate from human actions.
You need DEVICE_MODERATOR on at least one role to create devices.
Devices can belong to multiple roles (profiles and groups). Users in the same role can manage the device based on their role permissions:
| User has | Can do |
|---|---|
DEVICE_MODERATOR + DEVICE_DESIGNER |
Full control: delete, configure, manage keys, move to other groups |
DEVICE_MODERATOR only |
Delete, move — but not configure or see keys |
DEVICE_DESIGNER only |
Configure and see keys — but not delete or move |
This depends on the device's role permissions (IS_OWNED, IS_CONFIGURED, IS_MODERATED).
Devices use individual API keys for JSON-RPC and other API access. Each key can restrict permissions below the device's full set.
Devices have narrower permissions than users:
ARCHITECT, ADMIN, ROLE_MODERATOR, ALL_PROJECTS_ACCESS, GROUP_ORGANIZERDATA_SOURCE, DATA_ANALYST, DATA_MANAGER, OBJECT_MANAGERDefault device permissions are configured separately from user defaults at both instance and project level.
Devices use the flag-based deletion pattern — they are marked as deleted (not permanently removed), because deleting all associated records recursively would be too expensive.
See also: Users, Groups & Devices · Permissions · API Overview