List devices
A dashboard session sees every device on the account. An API key only sees devices its own DeviceGrants actually cover (a direct device grant, or a project-level grant covering everything in that project) - the same scoping every command call is checked against, applied here too so a key never enumerates devices it has no access to. This is the right first call for an agent (SDK or the MCP server's list_devices tool) to make: discover which devices this key can act on before calling anything else.
A session token for an existing account, obtained from POST /auth/login (see the Authentication endpoints) - not an API key. Endpoints marked with this scheme reject API key callers outright, regardless of what that key is granted. Outside the Authentication endpoints themselves, everything requiring this scheme manages dashboard resources (rules, grants, keys, device configuration, command catalogs) and mirrors what a human does in the Nexalware web app - it is not meant to be automated by a third-party integration the way the Device Control and Schedules endpoints are.
In: header
Query Parameters
Response Body
application/json
application/json
curl -X GET "https://example.com/api/v1/devices"[ { "deviceId": "string", "name": "string", "boardType": "string", "appType": "string", "deviceStatus": "PENDING", "enabled": true, "deviceTypeId": "string", "relayState": true, "isOnline": true, "lastSeen": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z" }]