Register

The register holds a device's identity: IMEI, ICCID and public key, the claim code derived from those three, and the tenant and contract it hangs on. A device registered without a tenant sits in the unassigned pool, its CRN naming no tenant yet. status is derived, not stored — registered, assigned, attached, active, suspended — and only an active device may connect.

Contracts, attachment and activation are billing; redeeming the claim code is device pairing. A device leaves the pool when it is claimed, assigned or attached to a contract — three different events, each carrying previousResourceIdentifier: whatever is keyed by the old CRN has to follow. Live values come from flake.

POST	Register a device/api/v1/register
GET	List registered devices/api/v1/register/devices
GET	Read one device/api/v1/register/devices/:deviceId
PATCH	Update a device's registration/api/v1/register/devices/:deviceId
DELETE	Delete a device/api/v1/register/devices/:deviceId

Register a device

Returns the device's claim code; roles in roleIds fall to whoever redeems it and require tenantId and share on each. A registered device still cannot connect — tenant, contract and activation have to follow.

POST/api/v1/register

Body

Name	Description
imeistring	The device's IMEI, the 15-digit identity of its modem. max length 16 Pattern: ^[0-9a-fA-F]+$
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it. max length 20 Pattern: ^[0-9a-fA-F]+$
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url. Pattern: ^[0-9a-fA-F]+$
tenantIdstringoptional	Tenant identifier
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.

Response

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.

Errors

Status	Description	Body
403	You do not have permission to perform this action
409	The claim code derived from IMEI, ICCID and public key already belongs to another device. Look that entry up by its IMEI and work on it instead.	code: DEVICE_ALREADY_EXISTS
400	The request did not match the schema for this endpoint. The details field carries the specific failures.	error: Validation Error
401	No valid access token was presented, or the DPoP proof accompanying it was missing, expired or bound to a different key.	error: string
500	The request failed for a reason that is not the caller's to fix. Safe to retry.	error: string, message: string, statusCode: 50

---

List registered devices

Devices the caller may read, each with its derived status. A tenant-scoped caller sees that tenant's devices; one without tenant scope sees the unassigned pool instead — with claim codes, capped at 1000 and unpaged.

GET/api/v1/register/devices

Response

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.
statusenum	Connectivity of the device: online, offline, or idle — idle means connected but quiet. Possible values: registered, assigned, attached, active, suspended
claimCodestringoptional	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.

Errors

Status	Description	Body
403	You do not have permission to perform this action
401	No valid access token was presented, or the DPoP proof accompanying it was missing, expired or bound to a different key.	error: string
500	The request failed for a reason that is not the caller's to fix. Safe to retry.	error: string, message: string, statusCode: 50

---

Read one device

One device's register entry with its derived status; {deviceId} accepts the device id or the IMEI printed on it. The claim code comes back only for a caller without tenant scope.

GET/api/v1/register/devices/Yk3pL7rWq2

Path Parameters

Name	Description
deviceId	The device id, or its IMEI.
Alternative 1string	Resource id: Base58 (9–10 characters) or a 16-character Crockford snowflake. Not an RFC 4122 UUID. Pattern: ^[0-9A-HJ-NP-Za-km-z]{9,16}$
Alternative 2string	The device id, or its IMEI. max length 16 Pattern: ^[0-9a-fA-F]+$

Response

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.
statusenum	Connectivity of the device: online, offline, or idle — idle means connected but quiet. Possible values: registered, assigned, attached, active, suspended
claimCodestringoptional	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.

Errors

Status	Description	Body
403	You do not have permission to perform this action
404	No device with this id or IMEI in the caller's scope. Another tenant's device reads as missing rather than forbidden, so check the tenant as well as the identifier.
400	The request did not match the schema for this endpoint. The details field carries the specific failures.	error: Validation Error
401	No valid access token was presented, or the DPoP proof accompanying it was missing, expired or bound to a different key.	error: string
500	The request failed for a reason that is not the caller's to fix. Safe to retry.	error: string, message: string, statusCode: 50

---

Update a device's registration

Correcting IMEI, ICCID or the public key re-derives the claim code, so the one printed on the device stops working. A tenant change re-keys the device's CRN and is refused while it sits on a contract.

PATCH/api/v1/register/devices/Yk3pL7rWq2

Path Parameters

Name	Description
deviceId	The device id, or its IMEI.
Alternative 1string	Resource id: Base58 (9–10 characters) or a 16-character Crockford snowflake. Not an RFC 4122 UUID. Pattern: ^[0-9A-HJ-NP-Za-km-z]{9,16}$
Alternative 2string	The device id, or its IMEI. max length 16 Pattern: ^[0-9a-fA-F]+$

Body

Name	Description
tenantIdstringoptional	Tenant identifier
imeistringoptional	The device's IMEI, the 15-digit identity of its modem. max length 16 Pattern: ^[0-9a-fA-F]+$
iccidstringoptional	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it. max length 20 Pattern: ^[0-9a-fA-F]+$
publicKeystringoptional	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url. Pattern: ^[0-9a-fA-F]+$
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.

Response

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource

Errors

Status	Description	Body
403	You do not have permission to perform this action
404	No device with this id or IMEI in the caller's scope. Another tenant's device reads as missing rather than forbidden, so check the tenant as well as the identifier.
409	The claim code derived from IMEI, ICCID and public key already belongs to another device. Look that entry up by its IMEI and work on it instead.	code: DEVICE_ALREADY_EXISTS
409	The device sits on a contract and can be neither deleted nor moved to another tenant. Detach it in billing first, so its billing interval is closed properly.	code: DEVICE_ATTACHED
400	The request did not match the schema for this endpoint. The details field carries the specific failures.	error: Validation Error
401	No valid access token was presented, or the DPoP proof accompanying it was missing, expired or bound to a different key.	error: string
500	The request failed for a reason that is not the caller's to fix. Safe to retry.	error: string, message: string, statusCode: 50

---

Delete a device

Removes the device and most of what hangs off its CRN: cached service state, metadata, geolocation and pairings. Stored history stays, and a function instance bound directly to the device is switched off rather than removed.

DELETE/api/v1/register/devices/Yk3pL7rWq2

Path Parameters

Name	Description
deviceId	The device id, or its IMEI.
Alternative 1string	Resource id: Base58 (9–10 characters) or a 16-character Crockford snowflake. Not an RFC 4122 UUID. Pattern: ^[0-9A-HJ-NP-Za-km-z]{9,16}$
Alternative 2string	The device id, or its IMEI. max length 16 Pattern: ^[0-9a-fA-F]+$

Errors

Status	Description	Body
403	You do not have permission to perform this action
404	No device with this id or IMEI in the caller's scope. Another tenant's device reads as missing rather than forbidden, so check the tenant as well as the identifier.
409	The device sits on a contract and can be neither deleted nor moved to another tenant. Detach it in billing first, so its billing interval is closed properly.	code: DEVICE_ATTACHED
400	The request did not match the schema for this endpoint. The details field carries the specific failures.	error: Validation Error
401	No valid access token was presented, or the DPoP proof accompanying it was missing, expired or bound to a different key.	error: string
500	The request failed for a reason that is not the caller's to fix. Safe to retry.	error: string, message: string, statusCode: 50

---

Events

Published on the tenant's event stream and delivered over the websocket to every subscriber holding read on the resource the message names. resourceIdentifier is the resource the action changed; the payload is the shape below.

Event	Description
REGISTER_DEVICE_ACTIVATE	The customer activated a device on its contract; only activatedAt is new, and it is the last gate before the device may connect.
REGISTER_DEVICE_CONNECT_FLAGS	The connect path wrote signCorrect or supportsFlakeAuth after one of them changed. The event is internal and never published — no websocket delivers it.
REGISTER_DEVICE_CREATE	A device was added to the register, together with the claim-code, IMEI and ICCID lookups that resolve to its CRN.
REGISTER_DEVICE_DELETE	A device was deleted; the payload is its complete entry, the last chance for anything keyed by its CRN to clean up.
REGISTER_DEVICE_REKEY	An unassigned device was claimed and moved to a tenant-scoped CRN; previousResourceIdentifier is the CRN it left, so anything keyed by that one has to follow.
REGISTER_DEVICE_SET_CONTRACT	A device was attached to a contract, swapped onto another, or detached from one; an unassigned device inherits the contract's tenant here and comes back under a new CRN.
REGISTER_DEVICE_UPDATE	A device's register data was corrected, or it was assigned to a tenant; previous* names only the identifiers that changed, and their old lookups are dropped with it.

Device activated

The customer activated a device on its contract; only activatedAt is new, and it is the last gate before the device may connect.

EVENTREGISTER_DEVICE_ACTIVATE

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.

Connect flags recorded

The connect path wrote signCorrect or supportsFlakeAuth after one of them changed. The event is internal and never published — no websocket delivers it.

EVENTREGISTER_DEVICE_CONNECT_FLAGS

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.

Device registered

A device was added to the register, together with the claim-code, IMEI and ICCID lookups that resolve to its CRN.

EVENTREGISTER_DEVICE_CREATE

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.

Device removed from the register

A device was deleted; the payload is its complete entry, the last chance for anything keyed by its CRN to clean up.

EVENTREGISTER_DEVICE_DELETE

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.

Device re-keyed to a tenant

An unassigned device was claimed and moved to a tenant-scoped CRN; previousResourceIdentifier is the CRN it left, so anything keyed by that one has to follow.

EVENTREGISTER_DEVICE_REKEY

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.
previousResourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource

Device contract link changed

A device was attached to a contract, swapped onto another, or detached from one; an unassigned device inherits the contract's tenant here and comes back under a new CRN.

EVENTREGISTER_DEVICE_SET_CONTRACT

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.
previousResourceIdentifierstringoptional	The device's CRN before this change, so the same action that writes the new lookup keys can drop the stale ones. Present only when the CRN actually moved.
previousContractIdstringoptional	The contract the device was on before this change; present when it was moved to another one or detached.

Device registration updated

A device's register data was corrected, or it was assigned to a tenant; previous* names only the identifiers that changed, and their old lookups are dropped with it.

EVENTREGISTER_DEVICE_UPDATE

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
imeistring	The device's IMEI, the 15-digit identity of its modem.
iccidstring	ICCID of the device's SIM, hexadecimal, at most 20 characters. It is printed on the SIM and therefore public: it names a device but proves nothing about it.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
tenantIdstringoptional	Tenant identifier
contractIdstringoptional	CRN of the contract the device is attached to. Being on a contract is not the same as being live — activation is the customer's own, later step, recorded in activatedAt.
attachedAtintegeroptional	When the device was attached to contractId, UTC epoch milliseconds; absent while it is on no contract.
activatedAtintegeroptional	When the customer activated the device, UTC epoch milliseconds. Absent means it was never activated and does not count as live.
signCorrectbooleanoptional	Whether the device answered the connect challenge with a signature that verifies against its publicKey. Written at connect rather than at registration, so it is absent until the device has connected once.
supportsFlakeAuthbooleanoptional	Whether the device's connect message carried the flake-auth property. Written at connect, so it is absent until the device has connected once — together with signCorrect it is what says which devices run firmware new enough to be upgraded.
claimCodestring	The claim code printed on the device, base58 and case-sensitive; the dashes of the printed XXXX-XXXX-XXX grouping are dropped before it is compared. Pairing takes it as the proof of physical possession, and a device listing carries it only for a reader outside any tenant.
roleIdsarraystringoptional	Ids of the roles an account joins when it signs up with this device's claim code. Each one takes share on that role, and a code carrying none produces an account with no access of its own.
createdBystring
createdAtinteger	Unix timestamp in milliseconds when this resource was created.
previousResourceIdentifierstringoptional	The device's CRN before this change, so the same action that writes the new lookup keys can drop the stale ones. Present only when the CRN actually moved.
previousImeistringoptional	The IMEI before this update, present only when it changed, so the IMEI lookup can drop the old key.
previousIccidstringoptional	The ICCID before this update, present only when it changed.
previousClaimCodestringoptional	The claim code before this update. The code is derived from IMEI, ICCID and public key, so correcting any of those three re-derives it and the printed code stops working.