nexalwarenexalwaredocs
API ReferenceGrants

Grant an API key or team member access to a device

Dashboard-only

This mirrors what a human does from the Nexalware web app - it's not meant to be automated by a third-party integration, even though a session token from Log in can technically call it. If you're building an integration that controls devices, use an API key instead: have an Owner/Admin grant it access to a device (a DeviceGrant), and use the Device Control endpoints.
POST
/api/v1/devices/{deviceId}/grants

This is how an API key gets permission to call device commands it has none by default. Provide exactly one of apiKeyId or membershipId. Add subDeviceId to narrow the grant to one sub-device behind this device (an orchestrator "master") instead of the whole device - omit it to reach every sub-device behind the device, same as today. Requires an Owner or Admin session; API keys cannot create grants for themselves or anyone else.

Authorization

sessionAuth
AuthorizationBearer <token>

A session token for an existing account, obtained from POST /auth/login (see the Authentication endpoints) - not an API key. Endpoints marked with this scheme reject API key callers outright, regardless of what that key is granted. Outside the Authentication endpoints themselves, everything requiring this scheme manages dashboard resources (rules, grants, keys, device configuration, command catalogs) and mirrors what a human does in the Nexalware web app - it is not meant to be automated by a third-party integration the way the Device Control and Schedules endpoints are.

In: header

Path Parameters

deviceId*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/api/v1/devices/dev_a1b2c3/grants" \  -H "Content-Type: application/json" \  -d '{    "apiKeyId": "key_x1y2z3",    "commands": [      "ON",      "OFF"    ],    "scope": "WRITE"  }'
{  "grantId": "grt_x1y2z3"}

List recent events across your whole account GET

A paginated audit log across every device you own - device online/offline, commands sent, unauthorized attempts, schedule changes. Use `cursor` from a previous response to page further back.

List a device's access grants GET

Includes grants scoped directly to this device, grants scoped to its whole project, and grants scoped to one sub-device behind it - all three apply.