Permission codes

Sub-account tokens and administrators acting on shared devices are not “list visible ⇒ writable.” Permissions are granted per capability group, not per HTTP endpoint.

device.capability.list does not trim the list by permission: shared devices still show all items. Unauthorized set/invoke/message detail returns DV2011. Message list/search filters out unauthorized events per row; the whole call does not fail with DV2011 for that reason.

Real-time push is configured in Push configuration (setMessageCallback), separate from sub-account Alarm policy and device.message.* query permissions. Legacy callback msgType values are in Event message types.

Each method page states the minimum permission. Grant APIs: Add sub-account permissions. Full sub-account code tables: Account and authorization API · summary.

Three token types

Caller	Which devices	Permission codes
Administrator token	Devices you bound, and devices shared to you	Bound: none. Shared: permission for that capability (below)
Sub-user token	Devices bound by that user	None
Sub-account token	Devices authorized to the sub-account	Required; codes and resources below

Sub-account permission codes

Full tables: Account and authorization API · summary and sub-account API pages. Common device-capability codes:

Code	Typical capabilities
`Alarm`	Console “alarm message” policy alias. `device.message.list` / `search` / `detail` / `delete` filter per message using the event’s shareAuthCode / subAccountAuthCode from the capability catalog row (often same group as `Config`), not merely whether `Alarm` is checked on the sub-account
`Config`	`detection.*`, imaging, lighting, audio, network, power, privacy, system, algorithm packages, media config; `ptz.preset`, `ptz.cruise`, `ptz.zoom`; `record.plan`
`Ptz`	`ptz.aim`, `ptz.linkage`
`Talk`	Call (`call.*`)
`RecordReplay`	`record.file`
`Format`	`storage.local`
`Upgrade`	`device.upgrade.execute` / `process` (different from `Config` used for upgrade status in the system domain)

Capture, Real, and DevControl follow sub-account feature docs. Standard capability rows do not use those three codes.

Resource syntax

For sub-account policies only—not for administrator or sub-user tokens.

Resource type	Syntax	Example
Device	`dev:serial`	`dev:TESTIPC000012345`
Channel	`cam:serial:channel`	`cam:TESTIPC000012345:0`

Channel resources inherit device scope: authorizing a device for a permission applies to its channels by default. Details: Account and authorization API · summary and Add sub-account permissions.

Each feature page lists its group’s code. Index: Capability usage.

Permissions on shared devices

When an administrator operates a device shared by someone else, business permissions apply. Method pages say “requires ×× permission.” Sharing is configured in the console with the names below. This doc does not list share-API feature strings.

Permission	Used for
Live preview	View live stream
PTZ	PTZ move, gun–ball linkage (`ptz.aim`, `ptz.linkage`)
Talk	Call and intercom (`call.*`)
Local recording view	Local recording files (`record.file`)
Cloud recording view	Cloud playback and view
Cloud recording manage	Cloud recording management
Basic configuration	Detection, imaging, lighting, audio, network, privacy, system; presets, cruise, zoom, recording plan
Advanced configuration	Stricter configuration writes
Alarm messages	Message list, detail, delete
Storage management	Local storage (`storage.local`)
Device upgrade	`device.upgrade.execute` / `process`

Sub-account authorization still uses the normative codes in the previous section—not the console names in this table.

Relation to capability list

Symptom	Meaning
Listed, set returns `DV2011`	Token lacks permission. Sub-account: grant; administrator: check bound vs shared
Listed, set returns `DV2005`	Read-only item—not a permission issue
Administrator on own bound device still `DV2011`	Rare; verify minimum permission on that method page