Set up a sub-account
Set up a sub-account
App users must not hold the administrator accessToken. Create a sub-account, grant devices, then call APIs with that token. Concept: Sub-accounts and policies. Parameter tables stay on the account method pages.
createSubAccount
POST https://openapi-[DataCenter].easy4ip.com/openapi/createSubAccount
Required: administrator token, and account (mobile number or email). Returns openid. Page: createSubAccount.
addPolicy
POST https://openapi-[DataCenter].easy4ip.com/openapi/addPolicy
Required: administrator token, openid, and policy. One request may authorize at most 10 devices or channels (statement or resource length). Policy shape: Sub-account function. Permission identifiers (Real, Talk, Config, …): Sub-accounts and policies.
Page: addPolicy. Invalid openid or policy: OP1003 in Return codes.
subAccountToken
POST https://openapi-[DataCenter].easy4ip.com/openapi/subAccountToken
Required: administrator token and openid. Returns a sub-account accessToken (St_ in the sample) and expireTime in seconds. Page: subAccountToken.
Call device APIs with least privilege
Use the sub-account token as params.token. Paged device detail also needs openid for a sub-account. The list is only devices the policy can see — not every device on the developer account.
Grant only the identifiers the user needs (Real for preview, Config for settings). Capability calls still need the device to support the leaf; see Capability usage.
clear or revoke policy
- Clear the policy: clearPolicy.
- Remove one device grant: deleteDevicePermission.
- Inspect: queryPolicy, queryDevicePermission.
This is not device hosting. End users cannot host consumer-app devices onto your developer account. User-owned devices use OAuth for user devices.