Device MQTT topic access¶
This page is the device-facing topic-access contract: which MQTT topics a registered device may publish and subscribe to once it is connected over mTLS. It is the rule your firmware can rely on — the platform enforces it on every publish and subscribe.
The model is small and default-deny: a device may only touch the two topic spaces below, and everything else is refused.
Your own device subtree¶
A device may publish and subscribe on its own device/{thing_id}/* subtree,
where {thing_id} is your device’s registered identity. This is the subtree the
device uses for its own traffic — telemetry it sends up, and commands or state it
receives back.
Example topic |
Direction |
|---|---|
|
device publishes (up) |
|
device publishes (up) |
|
device subscribes (down) |
|
device subscribes (down) |
|
device publishes |
Any action — publish or subscribe — is permitted anywhere under your own
device/{thing_id}/ subtree.
Scope topics (subscribe-only)¶
A device may subscribe to scope/{sid}/* topics for the scopes it currently
belongs to, where {sid} is a scope identifier. Scope topics carry
broadcasts, over-the-air update signals, and fleet commands sent to a group of
devices at once.
Scope topics are receive-only for a device: it may subscribe to a
scope/{sid}/* topic it belongs to, but it may not publish to one. Attempting
to publish to a scope topic is denied.
Per-device isolation¶
A device has no access to another device’s device/{other}/* topics. A device
cannot read another device’s traffic or publish into another device’s subtree. An
attempt to do so is denied and disconnects the offending client.
Access follows your scope membership¶
Which scope/{sid}/* topics a device can receive follows the device’s scope
membership. When a device is moved between scopes, its topic access changes to
match its new membership automatically — there is no per-device configuration
to edit and no firmware change required. The device does not need to be
reprovisioned; the new access takes effect on its next connection.
Default-deny¶
Access is default-deny. Anything not explicitly listed above — a topic outside
your own device/{thing_id}/* subtree, a publish to a scope topic, or a topic
belonging to another device — is refused. Design your firmware to use only its own
device subtree and the scope topics for the scopes it belongs to.