Skip to content
Identity and Access Management

Devices

The term device identity is limited to identity and authentication workflows related to devices. There are two key terms under the umbrella of device identity:

  • Device authentication: the process of verifying that a device is what it says it is
  • Device identity: the ability to uniquely identify a device using a unique identifier.

More details can be found here.

Device Account Transfer Workflow

A device can be transferred between accounts through a structured process involving authorized subjects from both the source and target accounts.

Initiation

  • An authorized subject from the source account initiates a transfer request to move the device to a target account.

Approval/Rejection

  • An authorized subject from the target account reviews the transfer request and can either approve or reject it.
  • If approved, the device ownership is transferred to the target account
  • If rejected, the transfer does not occur, and the source account retains ownership.

Cancellation

  • The initiator of the transfer request can cancel it at any time before approval.

Note

  • A transfer request that is canceled or rejected can be re-initiated by the source account holder, allowing flexibility to attempt the transfer again if circumstances change or if the initial request was canceled or rejected by mistake

Implicit Transfer

Implicit transfers can be performed in two scenarios:

  1. Privileged Applications: A subject with authorization for both the source and target accounts can perform an implicit transfer. However, this capability is not applicable to all subjects. Typically, only the privileged application within IAM is permitted to execute such transfers. IAM decides whether to grant this privilege based on the business justification provided.

  2. Dealer-Customer Business Relationship: Dealers with an established doingBusinessWith relationship can implicitly transfer devices to/from their customers without requiring approval.

Even when a caller qualifies for an implicit transfer, they may opt into the approval workflow by setting the requireApproval query parameter on the transfer request so the target account must approve or reject. requireApproval cannot be combined with a Scheduled Transfer.

Both scenarios support immediate and scheduled transfers:

  • Immediate Transfer: The device is transferred to the target account immediately upon request.
  • Scheduled Transfer: The transfer can be scheduled for a specific date and time by providing a startDate in the request. This allows dealers to plan device deliveries in advance. Scheduled transfers have a status of SCHEDULED until the specified date/time is reached, at which point the transfer is automatically executed.

Transfer Request Actions

By source account holder

  • Initiate: Start the process by creating a transfer request (immediate or scheduled).
  • Cancel: Cancel the request if the transfer is no longer desired.
  • View: Monitor active transfers including pending and scheduled transfers.

By target account holder

  • View: Access and review the details of the transfer request, including scheduled transfers.
  • Approve: Agree to the transfer, resulting in a change of ownership.
  • Reject: Decline the transfer, maintaining current ownership.

Transfer Status

Device transfers can have the following statuses:

  • PENDING: Transfer request is awaiting approval from the target account.
  • SCHEDULED: Implicit transfer is scheduled for a future date and time.
  • APPROVED: Transfer has been approved and completed.
  • REJECTED: Transfer request was rejected by the target account.
  • CANCELED: Transfer request was canceled by the initiator.
  • FAILED: Scheduled transfer failed to execute at the specified time.
  • COMMITTED: Device transfer to target account is completed.
  • TRANSFERRED: Device has been transferred to another account.

Illustration of Device Account Association

Initial Ownership

  • A device’s lifecycle begins at manufacturing, where it is assigned to the account responsible for its production (e.g. Business Unit Accounts).

Implicit Transfer

  • Business Systems: A privileged application can transfer devices from the Business unit account to a dealer account without needing approval. These transfers can be immediate or scheduled for a future date and time.
  • Dealer-Customer: When a dealer has an established doingBusinessWith relationship with a customer, they can implicitly transfer devices between their accounts without approval. These transfers can also be immediate or scheduled.

Approval Workflow

This workflow applies when there is no doingBusinessWith relationship between accounts.

Dealer Actions

  • A dealer can start a transfer request to a customer’s account (without established business relationship), requiring the customer’s approval.
  • Can optionally schedule transfers when using implicit transfer with established business relationships.
  • Cancel the request at any time while the transfer request is pending.

Customer Actions

  • Access and review transfer requests made for their account.
  • Decide to approve or reject the transfer request. If approved, the customer acquires device ownership, but if rejected, the ownership stays the same.