Litmus Edge Manager 3.0.x - Edge Lifecycle: OAuth Clients

List Device OAuth Clients

GET {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients

New in 3.0.

List Device OAuth Clients

Lists the OAuth clients defined on an edge device. Secrets are never returned.

Endpoint

GET {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Response

200 OK. An array of clients: clientId, clientName, the granted device groups, tokenTtlMinutes and expiryTime (epoch ms, absent when the client never expires). A device with no clients answers [].

[]

These are OAuth clients on the edge device (LitmusEdge), managed through LEM: LEM relays each call to the device, so the device must be online and run a LitmusEdge version that supports OAuth client management. A client gets an access token from the device's own token endpoint with the client-credentials grant and uses it against that device's APIs.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

[]

Create Device OAuth Client

POST {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients

New in 3.0.

Create Device OAuth Client

Creates an OAuth client on an edge device. The client secret is returned once, in this response only; store it immediately. Use Regenerate Device OAuth Client Secret if it is lost.

Endpoint

POST {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Request body

{
  "clientName": "historian-reader",
  "groupIds": ["<device group id>"],
  "tokenTtlMinutes": 5,
  "expiryDate": null
}

Response

200 OK. The new client with clientId, clientSecret and the device's tokenEndpoint (where the client requests tokens). These are OAuth clients on the edge device (LitmusEdge), managed through LEM: LEM relays each call to the device, so the device must be online and run a LitmusEdge version that supports OAuth client management. A client gets an access token from the device's own token endpoint with the client-credentials grant and uses it against that device's APIs.

Not exercised against a live device by these docs yet; the body and response fields come from the 3.0 API specification and the LEM web UI.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
  "clientName": "string",
  "groupIds": [
    "string"
  ],
  "expiryDate": 0,
  "tokenTtlMinutes": 0
}

Rename Device OAuth Client

PUT {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients/{{oauth_client_id}}

New in 3.0.

Rename Device OAuth Client

Renames an OAuth client. clientName is the only field that can change; groups, token lifetime and expiry are fixed at creation.

Endpoint

PUT {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients/{{oauth_client_id}}

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Request body

{
  "clientName": "historian-reader-2"
}

Response

200 OK. These are OAuth clients on the edge device (LitmusEdge), managed through LEM: LEM relays each call to the device, so the device must be online and run a LitmusEdge version that supports OAuth client management. A client gets an access token from the device's own token endpoint with the client-credentials grant and uses it against that device's APIs.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
  "clientName": "string"
}

Regenerate Device OAuth Client Secret

POST {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients/{{oauth_client_id}}/secret

New in 3.0.

Regenerate Device OAuth Client Secret

Issues a new secret for an OAuth client and invalidates the old one. The new secret is returned once, in this response only. An access token the client already holds keeps working until it expires (at most the client's tokenTtlMinutes), so a consumer still using the old secret may only fail on its next token request.

Endpoint

POST {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients/{{oauth_client_id}}/secret

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Response

200 OK. clientId, the new clientSecret and tokenEndpoint. These are OAuth clients on the edge device (LitmusEdge), managed through LEM: LEM relays each call to the device, so the device must be online and run a LitmusEdge version that supports OAuth client management. A client gets an access token from the device's own token endpoint with the client-credentials grant and uses it against that device's APIs.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Delete Device OAuth Client

DELETE {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients/{{oauth_client_id}}

New in 3.0.

Delete Device OAuth Client

Deletes an OAuth client, so it can no longer obtain tokens. Tokens it already holds keep working until their TTL runs out (at most the client's tokenTtlMinutes).

Endpoint

DELETE {{LEM_URL}}/api/v1/device/{{deviceID}}/oauth-clients/{{oauth_client_id}}

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Response

200 OK. These are OAuth clients on the edge device (LitmusEdge), managed through LEM: LEM relays each call to the device, so the device must be online and run a LitmusEdge version that supports OAuth client management. A client gets an access token from the device's own token endpoint with the client-credentials grant and uses it against that device's APIs.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.