LitmusEdgeManager 2.31.x API Documentation/Edge Lifecycle Management/RBAC - LE, LEM, LUNS API Docs

List Device Users

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users

List Device Users

Returns the users defined on the target LE device. LEM proxies the call -- the users live in the device's own auth system, not in LEM.

Endpoint

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

[
    {
        "userId": "0cd0732e-c1cd-401d-9a30-46f67ceea633",
        "username": "admin",
        "firstName": "System",
        "lastName": "Administrator",
        "mustChangePassword": false,
        "mfaEnabled": false,
        "disabled": false,
        "isAdmin": true,
        "eulaAcceptedTs": "2025-11-14T18:22:02Z"
    }
]

Create Device User

POST {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}

Create Device User

Creates a new user on the target LE device. Use Set Device User Groups to assign group membership after creation. The user is prompted to accept the EULA on first login.

Endpoint

POST {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

{
  "username": "User",
  "firstName": "First",
  "lastName": "Last",
  "email": "email@litmus.io",
  "admin": false,
  "mustChangePassword": true,
  "password": "Litmus@1",
  "disabled": true,
  "locked": true,
  "lockReason": "string"
}

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "username": "User",
    "firstName": "First",
    "lastName": "Last",
    "email": "email@litmus.io",
    "locked": true,
    "lockReason": "string",
    "admin": false,
    "mustChangePassword": true,
    "password": "Litmus@1",
    "disabled": true
}

Response

Status: 200 OK

{
    "userId": "345aac2a-b5bb-4e74-9552-59132626fab0"
}

Update Device User

PUT {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}

Update Device User

Updates an existing user on the device. Pass the full record.

Endpoint

PUT {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

Same shape as Create Device User.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "username": "User",
    "firstName": "First",
    "lastName": "Last",
    "email": "email@litmus.io",
    "locked": false,
    "lockReason": "string",
    "admin": false,
    "mustChangePassword": false,
    "password": "Litmus@1",
    "disabled": false
}

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Delete Device User

DELETE {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}

Delete Device User

Removes a user from the target LE device.

Endpoint

DELETE {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Get Device User Groups

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}/groups

Get Device User Groups

Returns the groups one user is currently a member of on the target device.

Endpoint

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}/groups

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 0 

[
    {
        "groupId": "default_admins_group",
        "groupName": "Administrators"
    },
    {
        "groupId": "default_viewers_group",
        "groupName": "Viewers"
    }
]

Set Device User Groups

PUT {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}/groups

Set Device User Groups

Replaces the user's group memberships with the supplied list. This is not additive -- omitted groups are removed.

Endpoint

PUT {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/users/{{user_id}}/groups

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

[ "group1", "group2", "group3" ]

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

[
    "group1",
    "group2",
    "group3"
]

Response

Status: 200 OK

{
    "code": "S",
    "message": null,
    "messageDetails": null
}

Validate Password

POST {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/password

Validate Password

Validates a candidate password against the device's password policy. Returns isSufficient plus a per-requirement breakdown.

Endpoint

POST {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/password

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

{ "password": "password" }

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "password": "password"
}

Response

Status: 200 OK

{
    "isSufficient": true,
    "requirements": {},
    "score": 1
}

Get Device Roles

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/permissions

Get Device Roles

Returns the roles available on the target device, with each role's per-component permissions.

Endpoint

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/permissions

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

[
    {
        "component": {
            "id": "dl",
            "label": "Downloads",
            "desc": "Downloads."
        },
        "permissions": [
            "View"
        ]
    },
    {
        "component": {
            "id": "lic",
            "label": "Licensing",
            "desc": "Licensing component provides license management functionality."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "mp",
            "label": "Marketplace",
            "desc": "Marketplace component manages execution environment for marketplace application."
        },
        "permissions": [
            "Create",
            "Delete",
            "Modify",
            "Update",
            "View"
        ]
    },
    {
        "component": {
            "id": "sysinfo",
            "label": "System Info",
            "desc": "System Info component reports system information and performance."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "cc",
            "label": "Integrations",
            "desc": "Integrations."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "dt",
            "label": "Digital Twin",
            "desc": "Digital Twin is a service for managing virtual models designed to accurately reflect physical objects."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "flows",
            "label": "Flows Manager",
            "desc": "Flows Manager."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "stats",
            "label": "DataHub",
            "desc": "Stats component manages historic data."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "support",
            "label": "Support Bundle",
            "desc": "Support Bundle."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "access",
            "label": "Access",
            "desc": "Access provides access to data from external systems."
        },
        "permissions": [
            "View",
            "Modify"
        ]
    },
    {
        "component": {
            "id": "auth",
            "label": "Auth",
            "desc": "Authentication and Authorization component."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "css",
            "label": "Cloud Storage Sync",
            "desc": "Cloud Storage Sync sync data between local mounted directories and different cloud storage providers."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "events",
            "label": "Events",
            "desc": "Events allows viewing of system events."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "ftp",
            "label": "FTP Server",
            "desc": "Internal FTP server."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "opcua",
            "label": "OPCUA Server",
            "desc": "OPCUA server."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "analytics",
            "label": "Analytics",
            "desc": "Analytics."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "dh",
            "label": "DeviceHub",
            "desc": "Device Hub is responsible for data acquisition from equipment."
        },
        "permissions": [
            "ViewDevices",
            "ViewDrivers",
            "ViewTags",
            "Modify",
            "ModifyDevices",
            "ModifyTags",
            "View"
        ]
    },
    {
        "component": {
            "id": "dm",
            "label": "Device Management",
            "desc": "Device Management."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "nd",
            "label": "Network Discovery",
            "desc": "Network Discovery allows scanning local networks for connected devices."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "nwutil",
            "label": "Network Util",
            "desc": "Network tools."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    }
]

Get Device Permissions

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/permissions

Get Device Permissions

Returns the per-component permission catalog of the target device. Same URL as Get Device Roles; the difference is in intent: this is used to render the permission picker in role-editor UIs.

Endpoint

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/permissions

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 0 

[
    {
        "component": {
            "id": "cc",
            "label": "Integrations",
            "desc": "Integrations."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "analytics",
            "label": "Analytics",
            "desc": "Analytics."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "dh",
            "label": "DeviceHub",
            "desc": "Device Hub is responsible for data acquisition from equipment."
        },
        "permissions": [
            "ModifyTags",
            "View",
            "ViewDevices",
            "ViewDrivers",
            "ViewTags",
            "Modify",
            "ModifyDevices"
        ]
    },
    {
        "component": {
            "id": "dl",
            "label": "Downloads",
            "desc": "Downloads."
        },
        "permissions": [
            "View"
        ]
    },
    {
        "component": {
            "id": "nwutil",
            "label": "Network Util",
            "desc": "Network tools."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "lic",
            "label": "Licensing",
            "desc": "Licensing component provides license management functionality."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "access",
            "label": "Access",
            "desc": "Access provides access to data from external systems."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "auth",
            "label": "Auth",
            "desc": "Authentication and Authorization component."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "css",
            "label": "Cloud Storage Sync",
            "desc": "Cloud Storage Sync sync data between local mounted directories and different cloud storage providers."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "dm",
            "label": "Device Management",
            "desc": "Device Management."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "dt",
            "label": "Digital Twin",
            "desc": "Digital Twin is a service for managing virtual models designed to accurately reflect physical objects."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "flows",
            "label": "Flows Manager",
            "desc": "Flows Manager."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "ftp",
            "label": "FTP Server",
            "desc": "Internal FTP server."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "mp",
            "label": "Marketplace",
            "desc": "Marketplace component manages execution environment for marketplace application."
        },
        "permissions": [
            "View",
            "Create",
            "Delete",
            "Modify",
            "Update"
        ]
    },
    {
        "component": {
            "id": "nd",
            "label": "Network Discovery",
            "desc": "Network Discovery allows scanning local networks for connected devices."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "opcua",
            "label": "OPCUA Server",
            "desc": "OPCUA server."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "stats",
            "label": "DataHub",
            "desc": "Stats component manages historic data."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "sysinfo",
            "label": "System Info",
            "desc": "System Info component reports system information and performance."
        },
        "permissions": [
            "Modify"
        ]
    },
    {
        "component": {
            "id": "events",
            "label": "Events",
            "desc": "Events allows viewing of system events."
        },
        "permissions": [
            "Modify",
            "View"
        ]
    },
    {
        "component": {
            "id": "support",
            "label": "Support Bundle",
            "desc": "Support Bundle."
        },
        "permissions": [
            "Modify"
        ]
    }
]

Get Device Groups

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/groups

Get Device Groups

Returns the groups defined on the target device. Built-in groups (Administrators, Viewers) are flagged isSystem: true.

Endpoint

GET {{LEM_URL}}/api/v1/loopedge-user/{{edge_device_id}}/groups

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Errors

HTTP status When it happens
400 Bad Request Missing or malformed query/body parameter.
401 Unauthorized Missing or invalid credentials.
403 Forbidden Token lacks permission for this operation.
404 Not Found Target entity does not exist.
5xx Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support.

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 0 

[
    {
        "groupId": "default_admins_group",
        "groupName": "Administrators",
        "isSystem": true
    },
    {
        "groupId": "default_viewers_group",
        "groupName": "Viewers",
        "isSystem": true
    }
]

View this page as Markdown