verifyPassword (Verify Device Password Documentation - Imou Open Platform)

verifyPassword: Verify Device Password Documentation - Imou Open Platform

Deprecated: Use Verify password (device.password.verify). This legacy HTTP page is retained for existing integrations.

Function details

Verify the device password.

Note: This interface is only valid for devices with "TCM" device capability set.

Request address

https://openapi-[DataCenter].easy4ip.com/openapi/verifyPassword

Request format

HTTP POST. JSON body layout: Request conventions. Sign with Signature.

Incoming parameter description

Parameter name	Parameter type	Required or not	Legal value	Parameter description
token	String	Yes		Administrator accessToken
deviceId	String	Yes		Device serial number
password	String	conditional	Use either V1 or V2; encrypted per algorithm below	Device password (V1 encryption)
passwordV2	String	conditional	Use either V1 or V2; encrypted per algorithm below	Device password (V2 encryption)

password encryption algorithm detailed description： password formula for calculating the value is：Base64(AES256_CBC(sourcePassword，key[]，iv[]))； THE ENCRYPTION RULES ARE AS FOLLOWS： 1、Using CBC block encryption，Algorithm is AES/CBC/PKCS5Padding； 2、sourcePassword is the clear text password of the device； 3、Key[] is a binary array of keys (key)； 4、The key is: LowerCase(MD5(UpperCase(Base64(KDF(deviceId,MD5(appsecret)))))), the KDF algorithm is PBKDF2WithHmacSHA256, iterates 1200 times, and the derived key length is 256； 5、iv[] is the binary array of the initialization vector, which is MD5 (appSecret), which is encrypted using the MD5 algorithm of MessageDigest that comes with Java。 The new password rule requirements for the device are： 1、 The password composition must contain at least two of numbers, uppercase letters, lowercase letters and special characters, and the length is 8~32 characters. Among them, special characters are any visible characters except for the six characters [']["][;][:][&][space]; 2、The password cannot have Chinese characters.

passwordV2 encryption (V2)

Same algorithm as v2 capability device.password.verify:

Device password field encryption (v2 OpenAPI)

Applies to passwordV2 on device.password.verify and oldPasswordV2 / newPasswordV2 on device.password.set. All three use the same algorithm (same family as bind encryptCodeV2; different field names).

Step	Description
1. Plaintext	Device password as a UTF-8 string (`newPasswordV2` must meet the strength rules below before encryption)
2. Factor	`pwdFactor = "op_api_" + appId + "_PWD_KEY_" + deviceId` (`appId` from `system.appId`; must match derivation)
3. Salt	First 16 bytes of `SHA-256(UTF-8(pwdFactor))`
4. PBKDF2	`PBKDF2WithHmacSHA256`: password = `deviceId`, salt as above, 1200 iterations, 256-bit output → `kdfRaw`
5. AES key	`kdfBase64 = Base64(kdfRaw)` (standard Base64); `aesKey = SHA-256(UTF-8(kdfBase64.toUpperCase()))` → 32-byte AES-256 key
6. Nonce	12 random bytes per encryption (changes each time)
7. Encrypt	`AES/GCM/NoPadding`, GCM tag 128 bits; cipher block = `AES-GCM(plaintext)` (includes tag)
8. Wire value	`Base64(nonce[12] ‖ cipher block)` as the request field string

appSecret is not used in v2 key derivation.

New password plaintext (before encrypting newPasswordV2 only): length 8–32; at least two of digit, uppercase, lowercase, special; special means visible chars except ', ", ;, :, &, and space; no CJK.

After a successful verify, the full passwordV2 ciphertext from that request may be copied into oldPasswordV2 (same appId, deviceId, same plaintext).

Sample input

{
 "id":"d5c287b4-5b2f-4f03-baf5-8032c5c354af",
 "system":{
 "ver":"1.0",
 "appId":"lcdxxxxxxxxx",
 "sign": "xjhCQBoJ9hRDsCjyDcHjtDNzRZ3ZJezcawsfWeiaoxU=",
 "time":1599031074,
 "nonce":"8ec8a7bd1d1c95420de20d92422d457d"
 },
 "params":{
 "token":"At_00006acr3456d12312d3grf60147de7ec",
 "deviceId":"TESTQWERXXXX",
 "password":"jdueu37ajusdii3873jsc8"
 }
}

Return data field description

No data returned

Sample output

{
 "result":{
 "msg":"The operation was successful.",
 "code":"0"
 },
 "id":"d5c287b4-5b2f-4f03-baf5-8032c5c354af"
}

Error codes

This method may return the codes below. See Return codes and Capability errors for the full catalog.

Gateway and auth (SN / TK / OP)

Code	Meaning	Next step
`SN1001`	Signature error	Check `sign` per Development specification
`TK1002`	Token invalid or expired	Refresh accessToken
`OP1002`	Missing required parameter	Add required fields
`OP1003`	Invalid parameter	Match this page’s parameter table
`OP1009`	Permission denied	Check token and device bind/share grants
`OP1013`	Total call limit exceeded	Reduce call rate
`OP1014`	Daily per-interface limit exceeded	See Interface call limits
`DV1007`	Device offline	Wait until the device is online

See Return codes · OP/SN/TK for the full catalog.

Sub-accounts (SUB)

Code	Meaning	Next step
`SUB1001`–`SUB1002`	Sub-account lacks API permission	Update policy via addPolicy
`SUB1005`	Sub-account token expired	Refresh subAccountToken
`SUB1006`	No device grant for sub-account	Check `Resource` and device serial
`SUB1008`	Sub-account not bound to app	Create and bind the sub-account first

See Return codes · SUB.

Device access and channels (DV10xx)

Code	Meaning	Next step
`DV1007`	Device offline or timeout	Wait for the device to come online
`DV1009`	Device busy	Retry later
`DV1012`	Insufficient share/grant permission	Check sub-account `Permission` / `Resource`
`DV1019`	Capability not supported	Confirm model and capability list
`DV1020`	Channel offline	Check channel status
`DV1026`	Function not supported	Use another API or upgrade firmware
`DV1028`	Not bound or channel missing	Verify `deviceId` / `channelId`

See Return codes · DV.

Device password (DV10xx)

Code	Meaning	Next step
`DV1016`	Device password error	Verify password
:---	:---	:---
`DV1020`	Password format invalid	Follow device password rules

See Return codes · catalog.