Kuray Karaaslan
@kuray-karaaslan · Joined August 2026
- Topics
- 11
- Replies
- 28
- Points
- 0
Forum Replies Created
In the Permissions reference: every IoT permission with its minimum role and what it allows, plus the platform ones IoT admins meet most. The ids there are the keys you see in the matrix, so you can paste one into the filter.
A group works. dashboard_viewer.designs.write has Admin as its minimum role, and a group can lift a member over an Admin minimum. Only Owner minimums are out of reach for groups.
No need. A template group is an ordinary group once it’s added. If you want to compare, add the template and look at both columns side by side in Access Rights, then delete whichever you don’t keep. Deleting a group removes it from every member, so move people first.
Expected, and thanks for testing before the auditor did. Groups only add permissions on top of the role. The group itself grants nothing that writes, but the User role holds some rights that act, by default. The ones you ran into: acknowledging alarms, running rules and switching their mode, and sending basic (read-only) commands.
Two ways to close it:
- If no User in your organisation should do those things, untick
iot_alarm.acknowledge,iot_rules.run,iot_rules.modeandiot_rpc.send.basicfor User in Access Rights. - If it’s only the viewers, write a Deny access policy with those actions and the condition
subject.roles containsthe viewer group’s key. Deny always wins. Run it in shadow mode first and check it in the access tester with an owner’s role so you don’t lock yourself out.
Yes. Watching live and viewing cameras are User permissions already, and the template includes cameras, live view, snapshots and recordings. Templates only offer permissions of modules your organisation has, so with cameras on you’ll see them in the group.
No, it refuses every certificate until its revocation set is loaded. There’s no password fallback either: a presented certificate always decides.
Every firewall action starts in Observe unless you choose otherwise, and actions on devices start in Suggest, so a proposal waits for an administrator. Revoking a device’s credential, ending its connection and revoking its certificate are Suggest-only: a person approves every run. Disabling a device runs on its own only if you set that action to Auto yourself.
By themselves, at the latest 30 days before expiry. You can also ask one to renew early with Renew certificate (the cert.renew command); it keeps the current certificate until the new one is in use. Devices that were asked to renew and didn’t are reported to administrators along with the expiring ones.
It’s disconnected at once. Revoke certificate asks for a reason (Key compromise, Superseded, Device retired or Unspecified) and for the device serial as confirmation. The fingerprint goes into the revocation set of every gateway node, the live connection is dropped, and the next login attempt gets CONNACK 5. It’s also listed in the next CRL; each issuing CA’s list is valid for 7 days.
It can’t be undone. The device needs a new certificate before it connects again.
No. Uploading your own CA for third-party X.509 devices isn’t available; third-party devices use access tokens or MQTT basic. The certificate path is for licensed devices, whose certificates come from Hermetry’s CA at provisioning.
No. One domain is marked Primary. E-mail and notification links use the primary domain while it serves, and the free address otherwise.
Yes. An administrator can switch new domains to a CNAME challenge in the domain settings (Preferred DNS Challenge: TXT record or CNAME record). That setting exists for exactly this kind of DNS service.
That also matters because a pending challenge is valid for 24 hours. After that you verify again and get a new one, so a TXT record that takes days to go in would always arrive too late.
Not only. The Log tab shows the device’s audited changes, each by a person or by the system, together with its connection history (connects, disconnects, refused logins) in one timeline; Show switches between All, Connections and Changes. For a single device it’s quicker than the API call. I wrote the post two days before it shipped.
Yes, high and critical rows fire the audit.high_risk webhook, so you can forward them as they happen. For bulk pulls the export endpoint does CSV or NDJSON and can be limited to one actor:
GET /tenant/{tenantId}/api/audit-logs/export?format=ndjson&fromDate=2026-10-01&toDate=2026-10-21Search for the action you’re after instead of scrolling, or filter by severity: the ones in the shot are all Low, so a High or Critical filter leaves them out.