Every action in Hermetry is guarded by a permission. This page lists the permissions of the IoT modules and the platform permissions that IoT administrators meet most often, each with its minimum role and what it allows. How roles, groups and the Access Rights matrix combine is explained in Groups and permissions; access policies that narrow access further are in Access policies.
How to read the tables
| Column | Meaning |
|---|---|
| Permission | The id, as shown in Access Rights (search by id) and in API key Module permissions |
| What it allows | The permission’s name as the console shows it, slightly shortened |
| Minimum role | The lowest built-in role that can hold it. User means every member by default, Admin means admins and owners, Owner means owners only. |
Rules that apply to every row:
- A member has a permission when their role is at least the minimum role and the organisation’s matrix grants it to that role, or when one of their active groups grants it and the minimum role is User or Admin.
- A group can lift a member over an Admin minimum, never over an Owner minimum.
- A permission of a module your plan does not include does not exist for your organisation.
- An API key holds only the permissions you give it and never more than its holder has; owner-only permissions are never held by API keys.
- Some permissions belong to features that are in development; they are marked. Granting them has no effect until the feature is released. See In development.
IoT permissions
Devices
| Permission | What it allows | Minimum role |
|---|---|---|
iot_device.devices.read | View devices | User |
iot_device.devices.create | Create devices | Admin |
iot_device.devices.update | Edit and disable devices | Admin |
iot_device.devices.delete | Delete devices | Admin |
iot_device.credentials.manage | Manage device credentials | Admin |
iot_device.attributes.read | View device attributes | User |
iot_device.attributes.write | Write server and shared device attributes | Admin |
iot_device.bindings.read | View reading bindings | User |
iot_device.bindings.manage | Manage reading bindings (with the target record’s own manage permission) | Admin |
Device profiles
| Permission | What it allows | Minimum role |
|---|---|---|
iot_device_profile.profiles.read | View device profiles | User |
iot_device_profile.profiles.write | Create, edit and delete device profiles | Admin |
iot_device_profile.provisioning.manage | Manage provisioning settings and keys of device profiles | Admin |
iot_device_profile.templates.manage | Manage the platform’s profile templates. Platform operators only. | Admin |
Commands
| Permission | What it allows | Minimum role |
|---|---|---|
iot_rpc.read | View command history and command catalogs | User |
iot_rpc.send.basic | Send basic (read-only) commands to devices | User |
iot_rpc.send.privileged | Send configuration commands to devices | Admin |
iot_rpc.send.critical | Send high-impact commands to devices (reboot) | Admin |
iot_rpc.send.raw | Send raw commands (methods outside the catalog) | Owner |
iot_rpc.commands.manage | Manage the command catalogs of device profiles | Admin |
Alarms
| Permission | What it allows | Minimum role |
|---|---|---|
iot_alarm.read | View alarms and alarm rules | User |
iot_alarm.rules.manage | Edit the alarm rules of device profiles | Admin |
iot_alarm.mute | Mute the alarms of a device | Admin |
iot_alarm.acknowledge | Acknowledge alarms and add notes | User |
iot_alarm.resolve | Resolve (clear) alarms by hand | Admin |
Rules card
| Permission | What it allows | Minimum role |
|---|---|---|
iot_rules.read | View the rules of places and devices and their runs | User |
iot_rules.run | Run a rule now | User |
iot_rules.mode | Switch a place between Manual and Auto | User |
iot_rules.manage | Add, change, switch on or off and delete rules | Admin |
Sites and assets
| Permission | What it allows | Minimum role |
|---|---|---|
iot_asset.assets.read | View IoT sites and assets | User |
iot_asset.assets.manage | Create, edit, move and delete IoT sites and assets | Admin |
iot_asset.relations.manage | Manage relations and device placement | Admin |
Telemetry
| Permission | What it allows | Minimum role |
|---|---|---|
telemetry.read | Read telemetry readings (of the devices you may see) | User |
telemetry.admin.read | View the telemetry store’s settings (kinds, retention, keys) | Admin |
telemetry.admin.manage | Manage the telemetry store | Admin |
IoT telemetry settings
| Permission | What it allows | Minimum role |
|---|---|---|
iot_telemetry.settings.read | View IoT telemetry settings | Admin |
iot_telemetry.settings.update | Change IoT telemetry settings | Admin |
Firmware updates
| Permission | What it allows | Minimum role |
|---|---|---|
iot_ota.read | View firmware packages, assignments and device update states | User |
iot_ota.packages.manage | Upload, deprecate, revoke and delete firmware packages | Admin |
iot_ota.assign | Assign firmware, change OTA settings and retry updates | Admin |
iot_ota.keys.manage | Register and revoke firmware signing public keys | Owner |
Remote device settings
| Permission | What it allows | Minimum role |
|---|---|---|
iot_device_settings.manifests.read | View the device settings manifest catalog | Admin |
iot_device_settings.manifests.manage | Upload device settings manifests to the catalog | Admin |
iot_device_settings.read | View a device’s settings | Admin |
iot_device_settings.operate | Change a device’s operating settings (the lowest class; grant with read) | Admin |
iot_device_settings.write | Change a device’s configuration settings (network, Wi-Fi, firewall; covers operating settings; grant with operate) | Admin |
iot_device_settings.baselines.manage | Create, change and delete device settings baselines (named partial section values for many devices) | Admin |
iot_device_settings.jobs.manage | Start, pause, resume and cancel settings jobs that apply a baseline or one change to many devices in waves (what a job may change is what you may change) | Admin |
iot_device_settings.dangerous.write | Change a device’s dangerous settings (what can cut the device off; grant with write) | Owner |
Provisioning and claiming
| Permission | What it allows | Minimum role |
|---|---|---|
iot_provisioning.claim | Claim devices | Admin |
iot_provisioning.release | Release devices | Admin |
iot_provisioning.release.force | Force-release devices. Platform operators only. | Admin |
iot_provisioning.quarantine.activate | Activate quarantined devices | Admin |
iot_provisioning.pool.read | View the factory pool of licensed devices. Platform operators only. | Admin |
iot_provisioning.pool.manage | Manage the factory pool. Platform operators only. | Admin |
Device certificates
| Permission | What it allows | Minimum role |
|---|---|---|
iot_pki.certificates.read | View device certificates | Admin |
iot_pki.certificates.revoke | Revoke device certificates | Admin |
iot_pki.recovery.approve | Approve certificate recovery | Admin |
iot_pki.ca.manage | View and manage the platform’s certificate authorities. Platform operators only. | Admin |
iot_pki.settings.update | Change device certificate settings | Admin |
Protocol endpoints
| Permission | What it allows | Minimum role |
|---|---|---|
iot_gateway.endpoints.read | View protocol endpoints and the connection of polled devices | User |
iot_gateway.endpoints.manage | Create, edit, test and delete protocol endpoints; discover and connect polled devices | Admin |
Camera protocol actions
| Permission | What it allows | Minimum role |
|---|---|---|
iot_gateway_isapi.actions.manage | Change a supported camera’s key frame interval (Set to 2 seconds) and restore it | Admin |
Cameras
| Permission | What it allows | Minimum role |
|---|---|---|
iot_camera.cameras.read | View cameras, their streams and live view settings | User |
iot_camera.cameras.manage | Use a device as a camera, turn live view on and off, read its streams again, remove the camera | Admin |
iot_camera.view_live | Watch the live picture of a camera | User |
iot_camera.snapshots.read | View the snapshots of cameras and the camera storage figures (in development) | User |
iot_camera.snapshots.manage | Take a snapshot of a camera now and delete snapshots (in development) | Admin |
iot_camera.disk.read | See what a camera keeps on its own memory card (in development) | Admin |
iot_camera.disk.download | Download recordings and pictures from a camera’s own memory card (in development) | Admin |
iot_camera.recordings.read | See the recordings timeline, play recordings and list event clips (in development) | User |
iot_camera.recordings.manage | Turn recording on and off, change recording settings, save, delete and export clips (in development) | Admin |
LoRaWAN
| Permission | What it allows | Minimum role |
|---|---|---|
iot_lorawan.gateways.read | View LoRaWAN gateways | User |
iot_lorawan.gateways.manage | Add, edit, disable and delete LoRaWAN gateways and rotate their tokens | Admin |
iot_lorawan.devices.read | View LoRaWAN devices | User |
iot_lorawan.devices.manage | Add, edit and delete LoRaWAN devices and set their AppKey | Admin |
iot_lorawan.keys.read | Reveal the AppKey of a LoRaWAN device | Admin |
iot_lorawan.frames.read | View the live LoRaWAN frames | User |
LoRaWAN codecs
| Permission | What it allows | Minimum role |
|---|---|---|
iot_lorawan_codecs.read | View LoRaWAN codecs and run the codec test bench | User |
iot_lorawan_codecs.manage | Add, change and delete your own LoRaWAN codecs | Admin |
iot_lorawan_codecs.library.manage | Withdraw and restore codecs of the platform library | Admin |
Router panels (remote access)
| Permission | What it allows | Minimum role |
|---|---|---|
iot_remote_access.panel.open | Open, enter and close the web panel of a claimed router | Admin |
iot_remote_access.sessions.read | View the panel sessions of the organisation | Admin |
eSIM
| Permission | What it allows | Minimum role |
|---|---|---|
iot_esim.read | View a router’s eSIM chip, profiles and operations (in development) | Admin |
iot_esim.manage | Download, switch, turn off, rename and delete a router’s eSIM profiles (in development) | Owner |
Dashboards
| Permission | What it allows | Minimum role |
|---|---|---|
dashboard.home.view | Open the home page | User |
dashboard.boards.read | View dashboards | User |
dashboard.boards.write | Create and arrange your own dashboards | User |
dashboard.boards.manage | Manage shared dashboards | Admin |
dashboard.widgets.author_private | Create and edit your own private widgets | User |
dashboard.widgets.author | Create and edit widgets | Admin |
dashboard.widgets.publish | Publish widget versions | Admin |
dashboard.query.execute | Run widget data queries | User |
dashboard.commands.execute | Run widget commands | User |
dashboard.display.view | Open a dashboard through a display link | Anyone with a display link |
dashboard.settings.read | View dashboard settings | Admin |
dashboard.settings.update | Change dashboard settings | Admin |
Process drawings (SCADA)
| Permission | What it allows | Minimum role |
|---|---|---|
dashboard_scada.commands.author | Author commands on process diagram symbols | Admin |
dashboard_scada.diagrams.read | View process diagrams | User |
dashboard_scada.diagrams.write | Create, edit and delete process diagrams | Admin |
3D designs
| Permission | What it allows | Minimum role |
|---|---|---|
dashboard_viewer.designs.read | View 3D designs | User |
dashboard_viewer.designs.write | Create, edit and delete 3D designs | Admin |
Automation (flows)
| Permission | What it allows | Minimum role |
|---|---|---|
automation.read | View flows and the block catalog | Admin |
automation.manage | Create, edit and deploy flows | Admin |
automation.manage_privileged | Deploy flows with control-level blocks (commands, settings) | Admin |
automation.debug | Inject messages, see message contents and failed messages | Admin |
automation.hooks.call | Call webhooks of deployed flows from a signed-in session (dashboard widgets, app pages) | User |
Platform permissions often used with IoT
| Permission | What it allows | Minimum role |
|---|---|---|
members.view | View members | User |
members.invite, tenant_invitation.invitations.invite | Invite members, send invitations | Admin |
members.edit_role, members.suspend, members.remove | Change a member’s role or status, suspend, remove | Admin |
members.manage_owner | Modify or remove owners | Owner |
members.transfer_ownership | Transfer ownership | Owner |
api_key.keys.read, .create, .update, .delete | View, create, update and revoke API keys | Admin |
api_key.keys.rotate, api_key.keys.revoke_all | Rotate API keys, revoke all API keys | Owner |
webhook.endpoints.read, .create, .update, .delete, .test, .trigger | Manage webhook endpoints, send test and manual events | Admin |
webhook.endpoints.rotate_secret | Rotate a webhook signing secret | Owner |
webhook.deliveries.read, .redeliver, .replay | See deliveries, redeliver, replay failed ones | Admin |
audit_log.logs.read, .export, .verify | View, export and verify the audit log | Admin |
audit_log.logs.anonymize, audit_log.logs.purge | Anonymise an actor (erasure), purge expired rows | Owner |
tenant_usage.metrics.read | Read usage metrics and quotas | Admin |
tenant_usage.settings.update | Change usage alert settings | Admin |
tenant_setting.config.read, .update | View and change organisation settings | Admin |
tenant_session.settings.read, .update | View and change the sign-in policy | Admin |
auth_abac.policies.read, .write, auth_abac.simulate, auth_abac.decisions.read | Access policies, the simulator and the decision log | Owner |
auth_saml.config.read, .update, .delete | Configure SAML single sign-on | Owner |
auth_sso.settings.read, .update | View and change single sign-on settings | Admin |
tenant_domain.domains.create, tenant_domain.domains.delete | Add and remove custom domains | Owner |
tenant_domain.domains.read, .verify | View domains, verify ownership | Admin |
tenant_export.data.export | Export all of the organisation’s data | Owner |
tenant_branding.branding.update | Change branding | Admin |
notification_mail.settings.update, notification_sms.settings.update, notification_push.settings.update, notification_inapp.settings.update | Change e-mail, SMS, push and in-app notification settings | Admin |
notification_external.link.manage | Link or unlink your own chat accounts | User |
notification_external.provider.manage | Connect or disconnect the organisation’s chat platforms | Admin |
ai_firewall.incidents.read, .manage, ai_firewall.settings.manage | Read and manage AI firewall incidents and settings | Admin |
mcp_server.connect | Connect AI assistants (MCP clients) | User |
mcp_server.settings.manage | Manage MCP settings | Admin |
Owner-only actions
These stay with owners whatever groups say:
| Action | Permission |
|---|---|
| Transfer ownership; change or remove owners | members.transfer_ownership, members.manage_owner |
| Configure SAML single sign-on | auth_saml.config.* |
| Access policies | auth_abac.* |
| Add and remove custom domains | tenant_domain.domains.create, tenant_domain.domains.delete |
| Export all data | tenant_export.data.export |
| Rotate and revoke all API keys | api_key.keys.rotate, api_key.keys.revoke_all |
| Rotate a webhook signing secret | webhook.endpoints.rotate_secret |
| Send raw commands | iot_rpc.send.raw |
| Register and revoke firmware signing keys | iot_ota.keys.manage |
| Change a device’s dangerous settings | iot_device_settings.dangerous.write |
The IoT group templates
Settings > Access Control > Groups > From template… adds these groups. Each lists only the permissions of modules your organisation has.
| Template | Permissions |
|---|---|
| IoT operator | iot_device.devices.read, iot_device.devices.update, iot_device.attributes.write |
| IoT viewer | iot_device.devices.read, iot_device.attributes.read, iot_device.bindings.read, iot_device_profile.profiles.read, iot_alarm.read, iot_asset.assets.read, iot_rules.read, iot_rpc.read, iot_ota.read, iot_pki.certificates.read, iot_device_settings.read, iot_gateway.endpoints.read, iot_lorawan.gateways.read, iot_lorawan.devices.read, iot_lorawan.frames.read, iot_lorawan_codecs.read, iot_camera.cameras.read, iot_camera.view_live, iot_camera.snapshots.read, iot_camera.recordings.read |
Members are User by default, so an IoT viewer group mainly adds the read permissions whose minimum role is Admin (device settings, certificates). An IoT operator can edit devices and write their attributes but cannot manage credentials or create and delete devices.
Neither template lets a member send commands beyond what their role allows: Basic commands need iot_rpc.send.basic, which every User has by default. To stop viewers from pressing board controls, remove that permission from the User role in Access Rights, or give viewers a role and groups without it.