Sub-accounts and policies

Sub-accounts scope down what can be done with your developer administrator account. The administrator accessToken can operate every device on that account. If you hand it to an app or a third party, a leak compromises the whole account. Give each user their own sub-account; if one leaks, impact is limited to the resources granted to that sub-account.

Definitions

• Sub-account: created under the developer account. Each sub-account has its own Id.
• Policy: a set of permission rules—for example, allowing live preview on a specific device.
• Resource: the object you authorize. A device is dev:{serial number}; a channel is cam:{serial number}:{channel number}.

Channel resources belong to their device. If you grant Real on a device, channels under that device inherit Real by default.

How policies match

Each item in statement has permission and resource. When a request arrives, the platform evaluates each item. If any item matches, the request is allowed; if none match, it is denied.

{
 "statement": [
 {
 "permission": "Ptz,Talk,Config",
 "resource": ["dev:469631729", "cam:544229080:1"]
 },
 {
 "permission": "Real",
 "resource": ["dev:470686804"]
 }
 ]
}

The serial numbers above illustrate syntax only; they are not real devices.

Permission identifiers

To create sub-accounts, issue sub-account tokens, and attach policies, see Account APIs.

Console Alarm policy is not the same as Push configuration callbacks. device.message.* row filtering is described in Permission codes.

Related

• Accounts
• Account APIs