# LitmusEdge Manager (LEM) - Product Router

> You are at https://api.litmus.io/lem/agents.md.
> Parent: https://api.litmus.io/agents.md
> Pick the component matching your task and fetch only that file.

---

## What LEM is

Fleet management plane for multiple LitmusEdge instances. Manages companies, sites, projects, deploys apps and backups across fleets, centralizes Digital Twin asset models.

- Three distinct URL prefixes - identify which one a category uses before constructing any URL:

| Prefix | Used by | Auth header |
|---|---|---|
| `{{LEM_URL}}/api/v1/...` | Main fleet API (~158 endpoints) | `X-AuthToken: {{LEM_AdminApiToken}}` |
| `{{LEM_URL}}/mpcs/...` | Marketplace catalog management (16 endpoints) | `Authorization: {{LEM_AdminApiToken}}` (NOT X-AuthToken) |
| `{{LEM_adminURL}}/admin/v1/...` | Admin console on port 8446 (~144 endpoints) | `X-AuthToken: {{LEM_AdminApiToken}}` |

- Version: this tree documents LEM 2.31.x.

---

## Authentication

LEM uses an admin API token, not OAuth2. Get one from Admin Console -> Settings -> Tokens. Set as `X-AuthToken` header (or `Authorization` for the `/mpcs/` paths only).

```
X-AuthToken: <admin-token>
```

The token does not expire automatically; revoke from Admin Console.

---

## Top-level sections

| Section | What it covers | Fetch |
|---|---|---|
| Companies | Top-level company / project listing | /lem/companies.md |
| Edge Lifecycle Management | Per-edge operations: devices, deploys, backups, alerts, RBAC, licenses | /lem/edge-lifecycle/agents.md |
| Digital Twins / Asset Management | DT2 asset models (fleet-wide) | /lem/digital-twins.md |
| Admin Console | LEM-instance admin: settings, integrations, license server, instance alerts, logs | /lem/admin-console/agents.md |

---

## Quick path - LEM-specific keywords

| Keywords | Fetch |
|---|---|
| "edge device", "fleet", "list edges" | /lem/edge-lifecycle/edge-devices.md |
| "site", "company", "project" | /lem/companies.md, /lem/edge-lifecycle/sites.md |
| "deploy app to edge", "launch app on edge" | /lem/edge-lifecycle/applications.md (or /workflows/deploy-app-lem.md) |
| "backup edge", "restore edge" | /workflows/backup-restore-edge.md |
| "zero touch", "activation request" | /lem/edge-lifecycle/activation.md (or /workflows/provision-zero-touch.md) |
| "project alert", "trigger", "notification" | /lem/edge-lifecycle/alerts.md (or /workflows/create-project-alert.md) |
| "license", "feature flag", "license pool" | /lem/edge-lifecycle/licenses.md OR /lem/admin-console/license-server-mgmt.md |
| "asset model", "DT2", "asset hierarchy" | /lem/digital-twins.md |
| "instance alert", "edge events registry", "webhook" | /lem/admin-console/instance-alerts.md |
| "marketplace catalog", "feature mgmt" | /lem/edge-lifecycle/features.md |
| "edge device template" | /lem/admin-console/edge-devices.md |
| "AI/ML model upload to LEM" | /lem/edge-lifecycle/ai-ml-models.md (or /workflows/upload-ml-model-lem.md) |
| "RBAC on the edge itself" | /lem/edge-lifecycle/rbac.md |
| "LEM admin users / teams / tokens" | /lem/admin-console/admin-console-settings.md |
| "system logs" | /lem/admin-console/logs.md |
| "Kafka / Clickhouse / Syslog integration on LEM" | /lem/admin-console/integration.md |
| "Docker registry on LEM" | /lem/admin-console/docker-registry.md |
| "data lifecycle, partitions, archive, purge" | /lem/admin-console/data-lifecycle.md |
| "WireGuard, remote access" | /lem/edge-lifecycle/remote-access.md |
| "device certificate" | /lem/edge-lifecycle/certificates.md |
| "software update" | /lem/edge-lifecycle/software-update.md |
| "events forwarding, event registry" | /lem/edge-lifecycle/events.md |

---

## RBAC ambiguity - read this carefully

There are TWO different RBAC scopes in LEM:

- **Per-edge RBAC** (`/api/v1/loopedge-user/...`) - manages users on the LE itself, NOT LEM admin users. -> /lem/edge-lifecycle/rbac.md
- **LEM admin RBAC** (`/admin/v1/...` users/teams/tokens) - manages who can log into LEM itself. -> /lem/admin-console/admin-console-settings.md

Confusing the two will give you the wrong endpoints. Disambiguate before routing.

---

## When to back out

If your task is actually about:

- A single edge in isolation (not via LEM) -> /le/agents.md
- MQTT / UNS / namespace -> /luns/agents.md
- Cross-product or unsure -> /agents.md