device.password.verify (Verify password)
device.password.verify: Verify password
What it does
Parameter passwordV2 is deviceId-context AES ciphertext (not plaintext). This method does not appear in device.capability.list. On success, data is {}. Same rules as change-password oldPasswordV2 / newPasswordV2. See Change password.
Request URL
POST https://openapi-[DataCenter].easy4ip.com/openapi/v2/device.password.verify
Minimum permission
The administrator does not need an extra permission on a device they bound. A shared device needs the basic configuration permission. A bound sub-user does not. A sub-account needs Config.
Request parameters
| Name | Type | Required | Default | Legal values | Description |
|---|---|---|---|---|---|
token | String | yes | Access token for an administrator, sub-user, or sub-account | ||
deviceId | String | yes | Device serial number | ||
productId | String | no | Optional. If sent and it does not match the device model → DV2009 | ||
passwordV2 | String | yes | Device password v2 ciphertext (see Password field encryption below) |
For common request fields and signing, see Signing conventions and Common request payload.
Password field encryption
Device password field encryption (v2 OpenAPI)
Applies to passwordV2 on device.password.verify and oldPasswordV2 / newPasswordV2 on device.password.set. All three use the same algorithm (same family as bind encryptCodeV2; different field names).
| Step | Description |
|---|---|
| 1. Plaintext | Device password as a UTF-8 string (newPasswordV2 must meet the strength rules below before encryption) |
| 2. Factor | pwdFactor = "op_api_" + appId + "_PWD_KEY_" + deviceId (appId from system.appId; must match derivation) |
| 3. Salt | First 16 bytes of SHA-256(UTF-8(pwdFactor)) |
| 4. PBKDF2 | PBKDF2WithHmacSHA256: password = deviceId, salt as above, 1200 iterations, 256-bit output → kdfRaw |
| 5. AES key | kdfBase64 = Base64(kdfRaw) (standard Base64); aesKey = SHA-256(UTF-8(kdfBase64.toUpperCase())) → 32-byte AES-256 key |
| 6. Nonce | 12 random bytes per encryption (changes each time) |
| 7. Encrypt | AES/GCM/NoPadding, GCM tag 128 bits; cipher block = AES-GCM(plaintext) (includes tag) |
| 8. Wire value | Base64(nonce[12] ‖ cipher block) as the request field string |
appSecret is not used in v2 key derivation.
New password plaintext (before encrypting newPasswordV2 only): length 8–32; at least two of digit, uppercase, lowercase, special; special means visible chars except ', ", ;, :, &, and space; no CJK.
After a successful verify, the full passwordV2 ciphertext from that request may be copied into oldPasswordV2 (same appId, deviceId, same plaintext).
Request example
{
"id": "d5c287b4-5b2f-4f03-baf5-8032c5c354af",
"system": {
"ver": "1.0",
"appId": "lcdxxxxxxxxx",
"sign": "xjhCQBoJ9hRDsCjyDcHjtDNzRZ3ZJezcawsfWeiaoxU=",
"time": 1706511734,
"nonce": "f5a1ae2d-c09c-4d39-a744-83a5c2c653c2"
},
"params": {
"token": "<yourAccessToken>",
"deviceId": "TESTIPC000012345",
"passwordV2": "encrypted-password"
}
}
Response data fields
No business fields. On success, code is "0" and data is {}.
Response example
{
"id": "d5c287b4-5b2f-4f03-baf5-8032c5c354af",
"result": {
"code": "0",
"msg": "Operation is successful",
"data": {}
}
}
Error codes
This API may return the codes below.
| Code | Meaning | Next step |
|---|---|---|
SN1001 | Signature error | Check sign per Development specification |
TK1002 | Token invalid or expired | Refresh accessToken |
OP1002 | Missing required parameter | Add required fields |
OP1003 | Invalid parameter | Match this page’s parameter table |
OP1009 | Permission denied | Check token and device bind/share grants |
OP1013 | Total call limit exceeded | Reduce call rate |
OP1014 | Daily per-interface limit exceeded | See Interface call limits |
DV1007 | Device offline | Wait until the device is online |
See Return codes · OP/SN/TK for the full catalog.
| Code | Meaning | Next step |
|---|---|---|
DV2003 | Property not on device | Use device.capability.list |
DV2004 | Value out of range | Check properties values |
DV2007 | channelId vs scope mismatch | Required for channel scope; omit for device scope |
DV2008 | Mixed device and channel properties | Split the request |
DV2009 | productId mismatch | Omit or set actual model id |
See Capability errors.