API docs by Redocly

VAULT API (3.0.0)

Download OpenAPI specification:

VAULT API Support: support@roamingiq.com License: Commercial License Terms of Service
Complete API Documentation & Integration Guide

VAULT WiFi Authentication & Management Platform API

VAULT is an enterprise WiFi authentication, subscriber management, and monetization platform that provides comprehensive APIs for network operators, venue administrators, and subscribers. The platform integrates with property management systems, payment processors, and network infrastructure to deliver seamless WiFi services.

Release Notes - v20260417

This update is rolling out to all VAULT production environments. Most operators have already received it, and the rollout is scheduled to complete on July 23, 2026. This is a large update — all operators are encouraged to read these notes in detail.

Unit-Level Keypools

VAULT now supports keypools assigned to individual units. Wi-Fi passwords/PSKs continue to maintain their roll-up hierarchy: a PSK assigned to a unit-level keypool rolls up to work with venue-level keypools and global keypools. See the Unit-Level Keypools and Keypool Hierarchy pages in our Knowledge Base for details.

Keypool Update Enhancements

When a new keypool is added to a venue or unit, existing PSKs now work against that new keypool, in accordance with keypool rules.

Subscription-Level Stripe Accounts

Stripe configuration has moved down from the subscriber level to the subscription level. This means an individual subscriber may now hold multiple subscriptions on different Stripe accounts. Subscribers moving from one venue to another will no longer see a Stripe processing error when the two venues have different Stripe accounts associated with them.

Wi-Fi-Only Plans

VAULT now supports a limited use case allowing a customer to sign up for Wi-Fi-only service, with wired access available as a paid upgrade. Please reach out to your VAULT Account Manager for more information if you wish to take advantage of this capability.

API Versioning

API updates have been applied and are available for review on our new API Documentation page in the Knowledge Base. This release introduces the api-version header. New integrations must send api-version: 20260417 to receive the current response format; existing integrations have until the 2026-11-17 sunset to adopt it, after which all responses use the current format regardless of whether the header is present. For our API-based customers, your VAULT Account Manager will reach out to discuss how this new versioning affects you and to agree on a timeline for moving to the latest API versions.

Email Address Editability

Email addresses are now editable by Network Admins only. Customer Support Agents and Subscribers remain restricted for security reasons. Expanded email editability — including standard new-address verification — is on our roadmap for a future update.

Subscriber Logs Contain Login Attempts

Subscriber logs now contain user login attempts. This helps support teams identify whether users are attempting to log in and, if so, whether they are entering the incorrect password.

Relaxed Suppression Logic

We have relaxed our suppression / DDoS-prevention logic for devices that repeatedly attempt to connect with the wrong password. This should reduce the number of false rejections for those devices. We continuously monitor this logic and will relax it further over time.

WPA3 Ruckus Fix

A fix has been applied to improve Ruckus WPA3 capabilities.

Bugs

Countless bugs have been squashed.

Backend Infrastructure

Dozens of infrastructure updates ship with this release, delivering multiple operational efficiencies. At the time of release, over 90% of VAULT authentications are processing in under 70 milliseconds.

API Changes

For integrators. Every row below was verified against the code at this release's HEAD.

Change Endpoint / Field Details
New endpoint listPushNotificationTemplates — GET + POST, under /equipment/…, /config/…, /networkoperatorconsole/equipment/… Admin-only (NetworkSoftwareProvider / NetworkOperator). Returns the operator's per-locale push templates (PushConfiguration, plus a DynamicVariables hint) and the push channel block Notifications.PushNotifications, which now contains only { PushApplicationID, Enable } — Vault no longer stores or returns FCM/APNS credentials or channel status. Sibling /config/listEmailTemplates + /config/listSMSTemplates aliases added.
New request field subscriber configure — Devices[] Declarative full push-device list {DeviceToken, ChannelType:'GCM'|'APNS', Platform?, DeviceName?}; each token ≤4096 chars + safe charset, deduped by token (first wins), capped at 20; a non-array value is ignored. A subscriber may set only its own list; operator / NSP / venue admins may set it on a subscriber's behalf.
New response field listSubscriptions, shoppingcart/listSubscriptions, listKeys / listSubscriberKeys RegisteredDevices (registered push devices) — distinct from AllDevices (connected Wi-Fi devices by MAC).
Changed config + read field operator/configure, listOperatorDetails — Notifications.PushNotifications Operator push is submitted and returned as { PushApplicationID, Enable }. The operator points Vault at a Pinpoint / AWS End User Messaging app they already own; the supplied PushApplicationID is validated (not auto-provisioned), and push is toggled by a separate Enable flag (stored as PushNotificationsEnabled). The two are independent — Enable is honored only when an app id is present. Vault stores only the app id + flag, no FCM/APNS credentials. PushApplicationID + Enable are returned under Notifications.PushNotifications on listOperatorDetails for admins/NSP; the per-locale templates surface only on the admin-only listPushNotificationTemplates.
Version-gated fields listSubscriptions With api-version ≥ 20260417: per-key StrictPSK, per-policy VenueUnitSSID (in NetworkData), and per-policy StripeCustomerID. The legacy top-level StripeCustomerID is returned only below the threshold. A localized deprecation hint names the header.
Version-gated fields listVenueUnits With api-version ≥ 20260417: per-unit VenueUnitSSID and StrictPSK (stripped below the threshold). This endpoint has no StripeCustomerID field. A localized deprecation hint names the header.
Threshold fix listSubscriptions, listVenueUnits The VenueUnitSSID / per-policy StripeCustomerID read gate was mistakenly checking 20260917 and is corrected to 20260417 — clients on api-version: 20260417 now actually receive the fields.
Preview auto-versioning listOperatorDetails, listVenueUnits, listSubscriptions When the request Origin contains -preview, the handler injects api-version = the running CODE_BRANCH, so preview UIs receive the newest gated shape with no header. (VAULT-109)
Write gate removed configure / add endpoints (object layer) The per-codebranch write block (401 "Write access not permitted on codebranch.") was removed from 26 object-layer files. Operators can write against any deployed API version. (A separate read-only-replica region gate is unchanged.)
Removed field listOperatorDetails — Notifications.Pinpoint / PinpointID No longer returned for api-version ≥ 20260417 (re-injected as empty below the threshold until the 2026-11-17 sunset). SMS now routes by SMSConsolePhoneNumber.E164 only.
Identifier change (from the 2026-11-17 sunset) networkoperatorconsole/subscribers/resetKey From the 2026-11-17 (20261117) sunset, admin Wi-Fi-password reset requires SubscriberToken + psk (the subscriber's current PSK); CurrentKeyID/pmk is no longer accepted. Before the sunset, CurrentKeyID stays a legacy alternative to psk. (resetKey sunset-gate update, in-range commit 097c348bd; no NETWORKOP ticket in the release range)
New endpoint listSuppressedDevices — POST (read-only), /operatorconsole/venues/listSuppressedDevices Requires AccessToken + VenueID; auth mirrors venue configuration (NetworkSoftwareProvider — needs OperatorID in body — / NetworkOperator / Venue Administrator). Lists a venue's three escalating per-MAC RADIUS suppression tiers, keyed by its NAS-Identifier: suppressed_mac (short, 60s / ≥10), suppressed_mac_repeat (4h / ≥100), suppressed_mac_longterm (12h / ≥1000) — each entry { mac, count, ttl }. Never deletes; discovery is region-local (run per region).
New request field configureVenue — clearSuppressedMacs (boolean) Ops action that does not modify the venue: when true, short-circuits the normal configure path and lists and deletes every per-MAC suppression counter (short / repeat / long-term) for the venue's NAS-Identifier, releasing devices stuck in the 12h long-term lockout (e.g. a subscription deleted then recreated, whose MAC is rejected pre-auth before its valid PSK is ever tried). The delete rides the cross-region cache fan-out (clears every region); discovery is region-local. Read-only sibling is listSuppressedDevices.
Changed route + request fields listLogs — moved /operatorconsole/config/listLogs → /operatorconsole/listLogs (old path deprecated in the spec) Full-text audit-log search over OpenSearch. New request fields: searchText (multi-field match), customQuery (raw OpenSearch Query DSL — supersedes the individual filter fields; only OperatorID + date range still applied; 400 on invalid DSL), exact-match filter fields, and searchBefore cursor pagination. Response adds searchBefore (next-page cursor) and allowedFilterFields. (logs → OpenSearch)
Removed endpoint networkoperatorconsole/scratchcards/{addScratchCards, extendScratchCardBatch, invalidateScratchCardBatch, viewScratchCardBatch} The scratch-card batch feature (bulk pre-generated one-time-PSK vouchers) was retired — all four routes dropped from the OpenAPI spec and their backing Lambdas deleted (ScratchCardGenerator + the four scratchcards/*). Clients calling these paths no longer have a route.
New API type device-authenticator (RADIUS/PSK) endpoints Migrated from API Gateway REST API → HTTP API (new invoke URL; WAFv2 WebACL association removed — HTTP API does not support it).

Platform Architecture

The VAULT API consists of three main console interfaces:

Subscriber Console

Self-service portal for WiFi subscribers and guests

Core Functions:

  • Authentication via email, phone, or token-based login
  • Device key management and WiFi credential provisioning
  • Subscription management and payment processing
  • Support ticket creation and account maintenance

Venue Management Console

Administrative interface for property and venue managers

Core Functions:

  • Venue configuration and building/unit management
  • Subscriber administration and billing oversight
  • Staff access control and permissions management
  • Usage analytics and support ticket management

Network Operator Console

Enterprise management for network service providers

Core Functions:

  • Multi-venue network operations and equipment management
  • Subscriber provisioning and service plan configuration
  • Administrative tools and system-wide monitoring

Technical Architecture

Backend Infrastructure: - AWS Lambda serverless functions for API endpoint handlers - AWS Cognito Identity Provider for authentication and user management - Distributed data storage for relationship and metadata management

Payment Processing: - Stripe integration for subscription billing and payment management - Automated billing cycles with failure handling and retry logic - Support for multiple currencies and regional payment methods

Network Integration: - ConnectWise API integration for network equipment management - PRTG monitoring system integration for real-time equipment status - RADIUS authentication support for WiFi infrastructure - Device bandwidth monitoring and usage analytics - Supported gateways: Nomadix, Mikrotik, Peplink, Altiplano, RiQ

Security & Compliance: - Multi-level access controls with role-based permissions - Input validation and sanitization on all endpoints - Audit logging for compliance and security monitoring - GDPR-compliant data handling and privacy protection

👨‍💼 Staff & Support Operations (/staff/, /support/):

  • 🔐 Granular staff access control with role-based permissions
  • 🎫 Integrated ticketing system for subscriber support and issue resolution
  • 🔍 Administrative oversight tools for venue operations and compliance

Endpoint Categories

Venue Management Console

Venue Operations: - Multi-building property discovery and configuration management - Real-time network equipment monitoring with ConnectWise integration - Usage analytics and bandwidth reporting with timezone support - RSSI signal strength monitoring and network optimization - Operational history and audit logging

Subscriber Management: - Complete subscriber lifecycle from onboarding to billing - Payment processing with Stripe integration and transaction history - Subscription modifications including plan changes and pricing adjustments - Communication tools and notification systems - Email validation and PII data management

Unit-Level Management: - Individual unit usage tracking and bandwidth monitoring - WiFi key pool management for secure device authentication - Unit-specific audit logs and activity tracking

Subscriber Console

Authentication & Profile Management: - Multi-modal login support (email, phone, subscriber tokens) - Terms & Conditions acceptance workflow and compliance tracking - Password reset and account recovery with secure validation - Personal information updates with privacy controls

Device & Access Management: - WiFi key generation and device registration - Real-time device session monitoring and connection history - Device naming and tagging for user organization - Key lifecycle management including rotation and security updates

Subscription & Billing: - Self-service subscription management and plan modifications - Payment method management with Stripe integration - Subscription cancellation with automated processing - Transaction history and billing statement access

Support & Communication: - Self-service ticketing system with automated routing - Venue communication and message acknowledgment - Account activity logging for transparency - Multi-language support (English, Spanish)

API Design Standards

Architecture: - OpenAPI 3.0.3 specification with comprehensive schema validation - RESTful design using POST methods with JSON payloads - Token-based authentication via AccessToken parameters - Standardized response format with consistent error handling

Security Framework: - TLS encryption with AWS Certificate Manager - AWS Cognito Identity Provider for authentication - Role-based access controls with venue-level isolation - Input validation and sanitization on all endpoints - Audit logging with immutable records and user attribution

Infrastructure Architecture infrastructure with distributed data storage

  • ⚡ High-Performance Caching: Intelligent caching layer for usage statistics and session management optimization
  • 🔌 External Integrations: ConnectWise for equipment management, PRTG for network monitoring
  • 💳 Payment Processing: Secure gateway integration with refund and chargeback handling
  • 🕸️ Relationship Database: Advanced relationship modeling for venue-subscriber hierarchies

📖 Implementation Guide

🔐 Authentication Flow

All API endpoints require authentication via AccessToken in the JSON request body:

Cloud Services: - AWS Lambda serverless functions for scalable API processing - AWS Cognito Identity Provider for secure user authentication - Distributed data storage for scalable relationship management

External Integrations: - Stripe payment processing for subscription billing and transactions - ConnectWise API for network equipment management and configuration - PRTG monitoring system for real-time infrastructure status - SMTP services for automated email communications - Supported network gateways: Nomadix, Mikrotik, Peplink, Altiplano, RiQ

Request/Response Format

Required header — api-version: New integrations must send api-version: 20260417 on every API call to receive the current response format; without the header, responses fall back to the legacy format. Existing integrations may keep calling without it until the 2026-11-17 sunset (and keep receiving the legacy format until then). From 2026-11-17 onward, every response uses the current format whether or not the header is present.

Standard Request Structure: json { "AccessToken": "authentication_token", "VenueID": "venue_identifier", "RequestParameters": "endpoint_specific_data" }

Standard Response Structure: json { "message": "Operation result description", "errorProcessing": false, "data": "endpoint_specific_results", "SupportedLocales": { "en-us": "English (US)", "es-xl": "Spanish (Latin America)" } }

Error Response Format: - HTTP Status Codes: 200 (Success), 401 (Unauthorized), 403 (Forbidden), 404 (Not Found), 500 (Server Error) - Localized error messages with troubleshooting guidance - Rate limiting with 429 responses and retry-after headers - Service maintenance notifications with 503 responses

Device Authentication

📡 Device Authentication - RADIUS / WPA3 PSK

Internal RADIUS authentication endpoints called by network access servers (NAS) and WiFi controllers to validate device credentials and retrieve per-device pre-shared keys.

Authentication Method

  • API Key (x-api-key header) — operator-scoped RADIUS key, not JWT

Endpoints

  • WPA3 RADIUS (/wpa3phase2) — per-device PSK lookup for WPA3 networks

These endpoints are not intended for direct web client consumption. They are called by network infrastructure (RADIUS servers, controllers) to make real-time access control decisions.

My Account

👤 My Account Self-Service Portal

Comprehensive self-service portal for subscribers to manage their account, services, billing, and preferences independently.

Account Management

  • 📋 Profile Management: Personal information, contact details, and preferences
  • 💳 Billing & Payments: View invoices, make payments, manage payment methods
  • 📊 Service Overview: Current plan details, usage statistics, and service status
  • 📱 Communication Preferences: Notification settings, contact preferences, and alerts
  • 🔒 Security Settings: Password changes, MFA setup, and security preferences
  • 📈 Usage Analytics: Bandwidth consumption, session history, and activity reports

Self-Service Features

  • 🔄 Plan Changes: Upgrade, downgrade, or modify service plans
  • 💬 Support Access: Submit tickets, chat support, and help resources
  • 📋 Document Access: Contracts, invoices, and account documentation
  • 🏠 Unit Management: Move requests and unit change processing

/subscriberconsole/login

Signs a subscriber in and returns Cognito tokens. Unauthenticated — takes credentials, not an access token. The operator must have a fully configured Cognito pool (pool id, app client id AND secret) or every request is refused.

Two flows:

  • Credential login: Password plus one of EmailAddress (≥5 chars, lower-cased), PhoneNumber (matched exactly as stored, no normalization) or SubscriberToken (>4 chars, lower-cased). Refused if the account is SSO-managed and the operator has SAML configured.
  • SSO sign-in: send authorizationToken (an OAuth2 code from the operator's hosted sign-in page, NOT a bearer token) — takes precedence over Password. Exchanged for tokens at the operator's Cognito domain.

⚠ This "login" call writes: a new account is created if none exists; an existing account is marked SSO-managed on a successful SSO sign-in. Every attempt is logged, successful or not.

Sensitive fields (SubscriberToken, EmailAddress, PhoneNumber, name, status, key material) are always stripped from the response. Messages are localized (Spanish for Accept-Language starting 'es').

Authorizations:
None
Request Body schema: application/json
required
Password
string <password>

Subscriber password. Selects the credential flow. Must be sent with exactly one identifier. Sending an identifier WITHOUT a password is refused with the same message as a wrong password.

EmailAddress
string <email>

Subscriber email. Lower-cased before use. Consulted only when at least 5 characters long; a shorter value is silently skipped in favour of PhoneNumber.

PhoneNumber
string

Subscriber phone number, used for lookup exactly as supplied - no formatting or E.164 normalisation is applied. Reached only when EmailAddress is absent or shorter than 5 characters.

SubscriberToken
string

Subscriber token, lower-cased and used directly as the sign-in username. Reached only when neither EmailAddress (5+ characters) nor PhoneNumber was supplied, and honoured only when longer than 4 characters.

authorizationToken
string

OAuth2 authorization CODE issued by the operator's hosted sign-in page - not a JWT. Any non-empty value selects the SSO flow, which takes precedence over Password. The code is redeemed against the operator's Cognito domain using the request Origin as the redirect URI, so the Origin must match the one registered there.

Domain
string

Accepted but has no effect on this operation. In particular it does not change which user pool the sign-in is performed against.

property name*
additional property
any

Responses

Request samples

Content type
application/json
Example
{
  • "EmailAddress": "subscriber@example.com",
  • "Password": "<password>"
}

Response samples

Content type
application/json
{
  • "AuthenticationResult": {
    },
  • "message": "",
  • "errorProcessing": false
}

/subscriberconsole/acceptTandC

Complete a new subscriber's account activation: exchange the temporary password they were issued for a password of their own, recording their acceptance of the Terms and Conditions.

No login required — the caller is identified by the subscriber selector plus the temporary password only that subscriber received. One of SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber (undotted), tried in that order.

Deliberately uninformative on an unknown subscriber: 401 with an empty message, so the response can't be used to test whether an account exists.

Password rules: NewPassword must be 8-63 printable-ASCII characters. A missing/malformed value returns HTTP 200 with errorProcessing: true, not a 4xx.

On success: password is set, email marked verified, status becomes in-service, temporary password cleared, and a LoginPasswordCreated webhook fires if configured.

Already-activated accounts are refused (401, errorProcessing: false) but are still partially updated — the new password and in-service status are applied without verifying the temporary password.

An expired temporary password self-heals: a new one is generated and emailed, and the request is refused so the subscriber can retry.

Authorizations:
None
header Parameters
Accept-Language
string
Example: es-XL

A first tag beginning es returns the Spanish renderings of the messages; anything else, and the absence of the header, returns English.

Request Body schema: application/json
required
SubscriberToken
string

The subscriber's identifier. Highest precedence of the four selectors.

externalSubscriberID
string

The operator's own identifier for the subscriber. Used only when SubscriberToken is absent.

EmailAddress
string <email>

The subscriber's email address, matched case-insensitively. Used only when SubscriberToken and externalSubscriberID are absent.

PhoneNumber
string

The subscriber's phone number, matched exactly as sent against the stored value. Lowest precedence. The dotted PhoneNumber.E164 is NOT read on this operation.

TemporaryPassword
required
string

The temporary password issued to the subscriber. Trimmed before use; an empty or whitespace-only value is reported as missing.

NewPassword
required
string

The password the subscriber is choosing. Trimmed before use, then required to be 8 to 63 characters of printable ASCII (space through ~). The trimmed value is what is stored.

Responses

Request samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string",
  • "TemporaryPassword": "string",
  • "NewPassword": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": false
}

/subscriberconsole/initiateResetConsolePassword

Starts a subscriber console password reset: a one-time code is issued for the account and delivered to the subscriber by email or SMS. The code itself is never returned in the response - it goes only to the account's own contact details - and it is then presented to the confirm step to set the new password.

No access token is required. A caller with no token at all is classified as public and served. If a token IS supplied (in the body or as Authorization: Bearer <JWT>) and the operator has an identity pool, it is verified, so a malformed or expired token is refused 401 even though omitting it entirely would have been accepted. A verified token is classified as a Network Software Provider (which must also send OperatorID), a network-operator administrator listed for this operator under DomainAdministrator, AccountManager or CustomerSupport, venue staff (a VenueAdministrator or LeasingAgent whose token lists the VenueID sent in the body - so that classification only happens when you send VenueID), or the subscriber themselves.

Whose account. A subscriber caller always targets their own account and any identifier in the body is ignored. Every other caller names the account with SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber, resolved in that order of precedence; venue staff are additionally confined to subscribers who hold a subscription at one of their own venues.

A public caller's misses are answered like a success. For an unauthenticated caller, an unknown identifier, an account whose cached record cannot be loaded, and an account managed through an external identity provider ALL return the same 200 success body as a real send. The one account-dependent rejection a public caller can still see is the delivery-stage 401 'SMS is not configured for Operator', which arises only for an account that does exist; every other distinguishing rejection needs an authenticated caller.

What actually gets sent depends on the account's state. An account that already has an unused reset code has that SAME code re-sent - a fresh one is not issued. An account with no outstanding code gets a newly generated code of eight lower-case letters, stored against the account with the time it was issued. An account that has never completed its first sign-in is sent its welcome message with its existing temporary password instead of a reset code. An account in any other state answers success WITHOUT sending anything. All four cases return the same message, so the response does not tell you which happened.

Delivery channel. By default the message goes to the account's email address. Sending NotificationChannel set to exactly 'SMS' (upper-case; the comparison is exact) routes it to the account's phone number instead, and that request is honoured regardless of the operator's e-mail suppression settings - but if the operator has no SMS sending number configured the call is refused 401 with the English-only 'SMS is not configured for Operator'. Any OTHER delivery failure - including an account with no usable phone number - still answers 200 with the normal success message, so a 200 does not prove the message was delivered.

Authorizations:
CognitoAuth
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. It selects the operator whose subscribers can be addressed (a '-preview' infix is stripped first), supplies the identity pool used to verify a token if one was sent, and gates any source-IP allow-list. With no Origin/origin header at all the request is refused 401 'origin missing. '; an origin that resolves to no operator gives 401 'Operator not found. '.

Authorization
string

Optional Bearer <JWT>. When present, the second space-separated word is taken and OVERWRITES any AccessToken in the body. Supplying a token is optional here, but supplying a BAD one is worse than supplying none: it is verified and rejected 401.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. It localizes the success message, 'OperatorID Missing. ', 'Subscriber not found.' and the external-identity-provider rejection; the SMS-not-configured failure is hardcoded English.

Request Body schema: application/json
required
EmailAddress
string <email>

Names the account to reset. Lower-cased before lookup. Ignored when the caller's own token carries a subscriber identity, and outranked by SubscriberToken and externalSubscriberID when several are sent.

PhoneNumber
string

Names the account to reset, matched against the stored value exactly as sent. Lowest precedence of the four identifiers.

SubscriberToken
string

Names the account to reset; highest precedence of the four identifiers. IGNORED when the caller's own token carries a subscriber identity - their own account is used instead.

externalSubscriberID
string

Names the account to reset by the operator's own identifier for the subscriber. Second in precedence, after SubscriberToken.

AccessToken
string

Optional Cognito access-token JWT; may instead be supplied as Authorization: Bearer <JWT>, which overwrites this property. Omitting it entirely is fine and yields a public caller; supplying an invalid or expired one is refused 401.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider, in which case its absence gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and removed from the body.

VenueID
string

Only meaningful for venue staff: the caller is classified as venue staff solely when their token lists this VenueID as a VenueAdministrator or LeasingAgent venue, and the target subscriber must then hold a subscription at one of the caller's venues. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

NotificationChannel
string

Set to exactly 'SMS' to have the code sent to the account's phone number instead of its email address; the comparison is case-sensitive, so 'sms' does not select SMS. Any other value, or omitting it, leaves delivery to the account's email address. An SMS request is honoured even where the operator suppresses subscriber e-mail.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "NotificationChannel": "SMS"
}

Response samples

Content type
application/json
{
  • "message": "Code to reset password sent to account. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/subscriberconsole/confirmResetConsolePassword

Completes a subscriber console password reset: present the one-time code plus a new password.

Unauthenticated — any access token supplied is ignored; authorization rests entirely on possession of a valid code for the named account.

Identify the account with exactly one of EmailAddress, PhoneNumber or SubscriberToken.

⚠ The not-found rejection carries no text — an unresolvable identifier gets 401 with an EMPTY message, deliberately, so a public caller can't probe for accounts.

OTP is the 8-letter reset code most recently issued; it has no time limit of its own and stays valid until used or replaced (the message says 'expired' but really means 'didn't match').

New password: 8-63 printable-ASCII characters. Length/charset failures return HTTP 200 with errorProcessing: true, not 4xx. The identity pool's own password policy can still reject an otherwise-valid password (401 'Something went wrong!. ').

Authorizations:
None
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. It selects the operator whose subscribers can be addressed and whose identity pool the password is written to (a '-preview' infix is stripped first), and it gates any source-IP allow-list. With no Origin/origin header at all the request is refused 401 'origin missing. '; an origin that resolves to no operator gives 401 'Operator not found. '. An account belonging to a different operator behaves exactly like a non-existent one.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. Here it localizes the field-validation messages, 'OTP expired. ', 'Password changed. ', 'Error updating password. ' and 'Something went wrong!. '.

Authorization
string

Accepted but inert: when present the second space-separated word is copied onto the request's AccessToken property, which this operation never verifies and never uses to authorise anything.

Request Body schema: application/json
required
EmailAddress
string <email>

One of the three ways to name the account. Lower-cased before lookup. Used only when SubscriberToken is absent.

PhoneNumber
string

One of the three ways to name the account, matched against the stored value exactly as sent, so it must be in the same form the account holds. Used only when SubscriberToken and EmailAddress are both absent. Must be a JSON string; a numeric value abandons the request, which then answers HTTP 200 with an empty message and errorProcessing false, having changed nothing.

SubscriberToken
string

One of the three ways to name the account, and the one that wins when several are sent.

OTP
required
string

The one-time reset code issued for this account - eight lower-case letters when generated by the reset-initiation step. Must be a non-empty string after trimming, else the request fails with HTTP 200 and 'OTP missing from request. '. A non-matching code gives 401 'OTP expired. '.

NewPassword
required
string <password> [ 8 .. 63 ] characters

The new console password. Trimmed before validation, then required to be 8-63 characters of printable US-ASCII (space through ~). Missing, too short, too long or out-of-range characters each fail with HTTP 200 and errorProcessing true. It is set as a PERMANENT password in the operator's identity pool and also recorded on the subscriber's account record.

AccessToken
string

Accepted but inert - this operation never verifies it and it confers no authority.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string",
  • "SubscriberToken": "string",
  • "OTP": "string",
  • "NewPassword": "pa$$word",
  • "AccessToken": "string"
}

Response samples

Content type
application/json
{
  • "message": "Password changed. ",
  • "errorProcessing": false
}

/subscriberconsole/updatePII

Updates the calling subscriber's own account. Whose record is changed depends on the caller's role, not the request body — a caller with no operator/venue role is always confined to their own account, regardless of what SubscriberToken/EmailAddress/etc. is sent; an operator/venue-role caller may target another account via those fields (this handler also serves the staff consoles).

Field permissions (subscriber caller): may set GivenName, FamilyName, PhoneNumber, contactpref_sms, locale, Status, registered devices. May NOT set EmailAddress (needs a DomainAdministrator/NSP), externalSubscriberID, any AdministrativeAccess role, or account-removal switches — a disallowed field is silently dropped, not rejected, EXCEPT AdministrativeAccess, whose mere presence can trigger a 409 regardless of role.

Names are sanitized (not rejected) unless the cleanup would remove disallowed characters, in which case the request is refused. Only changed fields are written; the account is locked during the update — a concurrent update returns 200 having changed nothing.

Authorizations:
None
Request Body schema: application/json
required
AccessToken
string

Cognito access token of the calling subscriber. May instead be supplied as 'Authorization: Bearer ', which takes precedence over the body value. Missing in both places is refused with 401.

GivenName
string

Given name. Only applied when non-empty. Markup and entities are stripped, the value is trimmed and truncated to 64 characters, and letters, digits, dot, underscore, hyphen, ampersand, space, parentheses, comma, question mark, asterisk and apostrophe are kept; if anything else was present the request is refused with 'Invalid characters in GivenName.'

FamilyName
string

Family name. Same sanitising and same refusal, with 'Invalid characters in FamilyName.'

PhoneNumber
string

Phone number. Normalised to E.164 before storing; an unusable value is refused with the literal doubled, as 'Invalid PhoneNumber. Invalid PhoneNumber. '. If the normalised number already belongs to another account of this operator the request is refused with 'PhoneNumber is associated with another account.'

PhoneNumber.E164
string

Alias for PhoneNumber - when present it is copied onto PhoneNumber before the update runs. For a subscriber caller it does NOT select another account.

contactpref_sms
boolean

SMS contact preference. Applied only when the value is exactly the boolean true or false; a string such as "true" is ignored.

phone_number_verified
boolean

Marks the phone number as verified. Applied only for an exact boolean true or false.

locale
string
Enum: "en-us" "es-xl"

Preferred language. Any other value is ignored, not rejected.

Status
string

Account status. Only 'AUP not accepted' and 'In Service' are accepted (compared case-insensitively after trimming); any other value is ignored.

Array of objects

Declarative replacement of the account's registered push-notification devices. Applied only when the value is an array. Devices present in the list are registered or refreshed and devices missing from it are removed.

forgetSubscriberDevices
boolean

When exactly true, forgets the subscriber's connected network devices. Optionally scoped to a single device by also sending Calling-Station-Id; a supplied but unusable Calling-Station-Id is refused with 'Invalid Calling-Station-Id. ' rather than falling through to forgetting them all, and one that matches nothing is refused with 'Device not found. '.

Calling-Station-Id
string

Device MAC address, used only alongside forgetSubscriberDevices to limit the operation to that one device.

EmailAddress
string <email>

Accepted only from a domain administrator of the operator or a provider-level caller. Sent by a subscriber it is ignored - the account's email cannot be changed through this operation by its owner. When it is applied and the address already belongs to another account of the operator the request is refused with 'Email Address is associated with another account.'

SubscriberToken
string

Ignored for a subscriber caller: the target is forced to the token's own account. Staff callers use it to select the account to change.

externalSubscriberID
string

Accepted only from an operator-level or provider-level caller; ignored when a subscriber sends it.

SubscriberManagedviaSSO
boolean

Marks the account as managed through an external identity provider. Unlike every other field here it has no role restriction - any caller can set it on the account the request resolved to - and it is applied on ANY truthy value, so the string "false" sets it too. It also REPLACES the rest of the request: when it is truthy every other field sent alongside it is discarded and only this flag is written. The change is reported in message as the literal 'Updated SubscriberManagedviaSSO to true. '. Once set, the account can no longer sign in with a password at an operator configured with a SAML identity provider.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<cognito access token>",
  • "GivenName": "<given name>",
  • "FamilyName": "<family name>",
  • "locale": "en-us",
  • "contactpref_sms": true
}

Response samples

Content type
application/json
{
  • "errorProcessing": false,
  • "statusCode": 200,
  • "message": "Updated locale = en-us. Updated contactpref_sms = true. "
}

/subscriberconsole/viewTandC

Returns the operator's Terms and Conditions text for a locale. No login required — the caller is authorized purely by the request Origin resolving to a known operator; any token/subscriber fields sent are ignored, and the same request returns the same text for anyone on that operator's domain.

Locale: derived from Accept-Language by default (es-xl if it starts with es, else en-us); sending locale overrides it and is echoed back as ProfileLocale.

⚠ An unusable locale (case-insensitively neither en-us nor es-xl) does NOT fail the request — it returns 200 with only message/errorProcessing: false and no TandC. Check for the ABSENCE of TandC, not errorProcessing, to detect this. Send locale in lower case — a value that differs only in case passes validation but then matches no stored text.

TandC is likewise absent (not empty) when the operator has published no text for the resolved locale. Read-only.

Authorizations:
CognitoAuth
header Parameters
Accept-Language
string
Example: es-XL

Determines DeviceLocale, and the text returned when no locale is sent. A first tag beginning es selects es-xl; anything else, and the absence of the header, selects en-us.

Request Body schema: application/json
optional
locale
string

Which localised text to return. Must be en-us or es-xl, and must be sent in lower case to find anything. Omit it to get the text for the locale derived from Accept-Language.

Responses

Request samples

Content type
application/json
{
  • "locale": "es-xl"
}

Response samples

Content type
application/json
{
  • "DeviceLocale": "en-us",
  • "ProfileLocale": "es-xl",
  • "TandC": "string",
  • "message": "string",
  • "errorProcessing": false
}

/subscriberconsole/viewTandC (GET)

Returns the operator's Terms and Conditions text for a locale. No login required — the caller is authorized purely by the request Origin resolving to a known operator; any token/subscriber fields sent are ignored, and the same request returns the same text for anyone on that operator's domain.

Locale: derived from Accept-Language by default (es-xl if it starts with es, else en-us); sending locale overrides it and is echoed back as ProfileLocale.

⚠ An unusable locale (case-insensitively neither en-us nor es-xl) does NOT fail the request — it returns 200 with only message/errorProcessing: false and no TandC. Check for the ABSENCE of TandC, not errorProcessing, to detect this. Send locale in lower case — a value that differs only in case passes validation but then matches no stored text.

TandC is likewise absent (not empty) when the operator has published no text for the resolved locale. Read-only.

Authorizations:
CognitoUserPool
query Parameters
locale
string
Example: locale=es-xl

Which localised text to return. Must be en-us or es-xl, and must be sent in lower case to find anything. Omit it to get the text for the locale derived from Accept-Language.

header Parameters
Accept-Language
string
Example: es-XL

Determines DeviceLocale, and the text returned when no locale is sent. A first tag beginning es selects es-xl; anything else, and the absence of the header, selects en-us.

Responses

Response samples

Content type
application/json
{
  • "DeviceLocale": "en-us",
  • "ProfileLocale": "es-xl",
  • "TandC": "string",
  • "message": "string",
  • "errorProcessing": false
}

/subscriberconsole/listKeys

Return the calling subscriber's own Wi-Fi keys, grouped by keypool, with connected devices, registered devices, and venue messages.

Reports only on the caller — every request field except the access token is discarded; there's no subscriber/venue/unit selector. An operator-admin token that happens to resolve to a subscriber gets THEIR OWN keys back; a NetworkSoftwareProvider staff token can never use this operation (always 'OperatorID Missing. ').

The body IS the subscriber's record — no envelope, no success flag; use errorProcessing.

Ended subscriptions are dropped; the remainder are folded into KeysInKeyPools. A subscriber with no surviving subscription gets only their record plus device counts.

Read-only.

api-version gate: api-version: 20260417 or higher adds editable/StrictPSK/VenueUnitSSID/per-policy StripeCustomerID; below that, a version-upgrade notice is appended to message on every response.

Authorizations:
CognitoAuth
header Parameters
Authorization
string

Bearer <JWT>. Takes precedence over the body's AccessToken.

api-version
string
Example: 20260417

Send 20260417 or higher to receive the newer field shape. Below that, a migration notice is appended to message on every response.

Request Body schema: application/json
optional
AccessToken
string

Cognito access token. Required unless supplied as an Authorization: Bearer header, which overrides this value. Missing entirely is a 401.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string"
}

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "EmailAddress": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "en-us",
  • "PhoneNumber.E164": "string",
  • "OperatorID": "string",
  • "SubscriberManagedviaSSO": true,
  • "Devices": [
    ],
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "AdministrativeAccess": { },
  • "DeviceCountOnline": 0,
  • "DeviceCountOffline": 0,
  • "KeyCount": 1,
  • "KeyCountActive": 1,
  • "KeysInKeyPools": {
    },
  • "AllDevices": {
    },
  • "RegisteredDevices": [
    ],
  • "messages_from_venues": {
    },
  • "StripeCustomerID": "string",
  • "message": "string",
  • "errorProcessing": true
}

/subscriberconsole/listKeys (GET)

Return the calling subscriber's own Wi-Fi keys, grouped by keypool, with connected devices, registered devices, and venue messages.

Reports only on the caller — every request field except the access token is discarded; there's no subscriber/venue/unit selector. An operator-admin token that happens to resolve to a subscriber gets THEIR OWN keys back; a NetworkSoftwareProvider staff token can never use this operation (always 'OperatorID Missing. ').

The body IS the subscriber's record — no envelope, no success flag; use errorProcessing.

Ended subscriptions are dropped; the remainder are folded into KeysInKeyPools. A subscriber with no surviving subscription gets only their record plus device counts.

Read-only.

api-version gate: api-version: 20260417 or higher adds editable/StrictPSK/VenueUnitSSID/per-policy StripeCustomerID; below that, a version-upgrade notice is appended to message on every response.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token. Required unless supplied as an Authorization: Bearer header, which overrides it. Every other query parameter is discarded.

header Parameters
Authorization
string

Bearer <JWT>. Takes precedence over the AccessToken query parameter.

api-version
string
Example: 20260417

Send 20260417 or higher to receive the newer field shape. Below that, a migration notice is appended to message on every response.

Responses

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "EmailAddress": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "en-us",
  • "PhoneNumber.E164": "string",
  • "OperatorID": "string",
  • "SubscriberManagedviaSSO": true,
  • "Devices": [
    ],
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "AdministrativeAccess": { },
  • "DeviceCountOnline": 0,
  • "DeviceCountOffline": 0,
  • "KeyCount": 1,
  • "KeyCountActive": 1,
  • "KeysInKeyPools": {
    },
  • "AllDevices": {
    },
  • "RegisteredDevices": [
    ],
  • "messages_from_venues": {
    },
  • "StripeCustomerID": "string",
  • "message": "string",
  • "errorProcessing": true
}

/subscriberconsole/refreshAccessToken

Exchanges a refresh token for a fresh token set via the identity provider — no password re-entry.

What actually authorizes this: the refresh token, verified by the identity provider. The access token sent alongside it is NOT verified here (no signature/expiry/sign-out check) — it's decoded only to read the user name needed to address the refresh, and is expected to be expired in normal use.

A provider refusal is not an error status — the response is 200 with an empty message and no AuthenticationResult. Clients MUST treat the absence of AuthenticationResult, not the HTTP status, as failure. The same empty 200 covers an operator with no identity-provider configured and an unexpected internal failure.

On success, the new tokens are nested one level deeper than the property name suggests: AuthenticationResult.AuthenticationResult.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
RefreshToken
required
string

The refresh token to exchange. This is the credential for the operation. An absent or empty value is rejected 401 RefreshToken missing. . Its validity is judged by the identity provider, not here, so a revoked or expired one produces a 200 with no result rather than a 401.

AccessToken
string

The account's access token, supplied here or as an Authorization: Bearer header (which overrides this field when present). It MAY be expired - it is never verified, only decoded to read the user name that the refresh is addressed to. Absent or empty is rejected 401 AccessToken Missing. ; present but undecodable, or carrying no user-name claim, is rejected with the SAME message.

Responses

Request samples

Content type
application/json
{
  • "RefreshToken": "string",
  • "AccessToken": "string"
}

Response samples

Content type
application/json
{
  • "AuthenticationResult": {
    },
  • "message": "",
  • "errorProcessing": false
}

/subscriberconsole/logout

Signs the calling subscriber out everywhere — evicts the presented token and every other cached token for the account, sets a global sign-out marker (tokens issued BEFORE this instant are refused elsewhere in the API until they expire), and asks the identity provider to revoke refresh tokens on every device. A fresh login moments later is unaffected.

Authorization: the token must resolve to a subscriber identity — the only role test on this operation, with no anonymous path. The account signed out is always the token's own account; no request field can name a different one.

Idempotent and always reports success: signing out an already-signed-out account succeeds again, and the identity-provider result isn't inspected — even if refresh-token revocation fails there, this still returns 200.

Messages localize to Spanish for Accept-Language: es*.

Authorizations:
CognitoUserPool
Request Body schema: application/json
optional
AccessToken
string

The access token to sign out. Required unless it is supplied as an Authorization: Bearer header, which overrides this field when present. An empty string counts as absent and is rejected 401. This token also names the account: nothing else in the request selects a user.

IdToken
string

Optional companion identity token. When present it, rather than the access token, is verified against the operator's identity pool to establish who the caller is; the account to sign out is still taken from the access token's own user-name claim, so a request whose identity token verifies but whose access token carries no user name is rejected.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": false
}

/subscriberconsole/updateKeyTag

Give one of your Wi-Fi keys a name of your own.

Only the key's own subscriber can rename it — any other authenticated caller's request is accepted, returns 200, and changes nothing (indistinguishable from a no-op except by the empty message).

Send psk (the key's own PSK) to target the key; without it, a subscriber with more than one active subscription gets a silent no-op.

The name is validated, not cleaned up — HTML/whitespace/length are checked, and any correction needed triggers a rejection (Invalid characters in UserFriendlySubscriptionID.) rather than silently truncating.

Renaming to the current name is a no-op. This is one entry point onto the shared subscription-configuration operation — other subscription fields sent in the same body are applied too, where the caller is permitted.

A missing or non-JSON body fails with 502, not a normal 4xx refusal — always send a JSON object.

Authorizations:
CognitoUserPool
header Parameters
Authorization
string

Bearer <JWT>. Takes precedence over the body's AccessToken.

Accept-Language
string
Example: es-XL

A first tag beginning es returns the Spanish renderings of the localised messages; anything else returns English. The messages raised by the rename itself are hardcoded English either way.

Request Body schema: application/json
required
AccessToken
string

Cognito access token. Required unless supplied as an Authorization: Bearer header, which overrides this value.

KeyTag
string <= 40 characters

The name to give the key. 1 to 40 characters; it must contain no HTML markup or entities and no leading or trailing whitespace, because the value is rejected rather than cleaned. Omitting it means no rename is attempted.

psk
string

The pre-shared key of the subscription to rename, exactly as it appears in the key listing. Strongly recommended: without it the rename is applied only when the caller holds exactly one active subscription.

OperatorID
string

Required only for a network-software-provider caller; omitting it is a 401 for that caller and it is ignored for everyone else. Note that such a caller cannot perform a rename regardless.

VenueID
string

Read only to decide whether the caller holds a venue role over that venue. It does not select the subscription, and a venue caller cannot rename a key either. Format {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Names the target subscriber for an operator or venue caller. A subscriber caller does not need it: any target selector a subscriber sends is ignored and replaced with their own identity, so a subscriber can only ever address their own keys.

externalSubscriberID
string

Alternative target-subscriber selector for an operator or venue caller, used when SubscriberToken is absent.

EmailAddress
string <email>

Alternative target-subscriber selector for an operator or venue caller, matched case-insensitively.

PhoneNumber.E164
string

Alternative target-subscriber selector for an operator or venue caller. Only the dotted form is recognised as a selector here.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "KeyTag": "Study",
  • "psk": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": false
}

/subscriberconsole/updateDeviceName

Sets the friendly label on one of the calling subscriber's registered devices, identified by its MAC. Stored in the device cache, not on the subscription record.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a network-operator admin, or (for any token carrying a subscriber identity) the subscriber themself. No venue-scoped branch — venue staff can only act as their own subscriber identity, if they have one.

The MAC is normalized (lower-cased, separators stripped) before matching — a MAC not among the caller's registered devices is refused 'Device not found. '.

The label is HTML-escaped, trimmed and truncated to 40 characters AFTER escaping — a label containing anything that looks like an HTML tag/entity is rejected outright rather than cleaned up. Must also be unique across the caller's own devices, INCLUDING the device's own current label — re-sending the existing label is a rejection, not a no-op.

Success returns an empty message — the presence of Calling-Station-Id/UserDefinedHostName in the body, not the message text, is what confirms the rename.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator is resolved from it (a '-preview' infix is stripped first) and supplies the Cognito pool used to verify the token plus any source-IP allow-list. With no Origin/origin header at all the request is refused 401 'origin missing. '; an origin that resolves to no operator gives 401 'Operator not found. '.

Authorization
string

Optional Bearer <JWT> alternative to the body's AccessToken. When present, the second space-separated word is taken and OVERWRITES whatever AccessToken the body carried.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. On this operation it affects only 'AccessToken Missing. ', 'OperatorID Missing. ', 'Access Denied. ' and 'Subscriber not found.'; every device and label message is a hardcoded English literal that never localizes.

Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. May instead be supplied as Authorization: Bearer <JWT>, which overwrites this property. Absent from both gives 401 'AccessToken Missing. '. It is verified only when the resolved operator has a Cognito pool configured.

Calling-Station-Id
required
string

MAC address of the device to rename, with or without ':' or '-' separators and in any case; it is normalised to lower-case with separators removed before lookup and storage. Any falsy value (absent, empty string, 0) gives 401 'Calling-Station-Id not found. '. A MAC that is not one of the caller's registered devices gives 401 'Device not found. '.

UserDefinedHostName
required
string <= 40 characters

The new label. Absent or empty gives 401 'UserDefinedHostName not found. '. A value containing an HTML tag or an HTML entity is rejected 401 'Invalid characters in UserDefinedHostName.' rather than sanitised. Otherwise it is HTML-escaped, trimmed and cut to 40 characters - if that leaves nothing, 401 'UserDefinedHostName not found. '. It must not equal a label already carried by any of the caller's devices, including the device being renamed - re-sending that device's current label gives 401 'Duplicate UserDefinedHostName. ' and writes nothing.

SubscriberToken
string

IGNORED when the caller's own token carries a subscriber identity - it is overwritten with the caller's own. It identifies the target device owner only for operator and provider callers.

EmailAddress
string <email>

IGNORED for a subscriber caller; identifies the target subscriber only for operator and provider callers. Lower-cased by the shared request sanitiser before lookup.

PhoneNumber.E164
string

IGNORED for a subscriber caller; identifies the target subscriber only for operator and provider callers, in which case it is also copied onto a PhoneNumber property before lookup.

externalSubscriberID
string

IGNORED for a subscriber caller; identifies the target subscriber only for operator and provider callers, by the operator's own identifier for them.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider, in which case its absence gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and removed from the body before the rename runs.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "Calling-Station-Id": "02:00:00:00:00:01",
  • "UserDefinedHostName": "Study Laptop",
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "Calling-Station-Id": "020000000001",
  • "UserDefinedHostName": "Study Laptop",
  • "errorProcessing": false
}

/subscriberconsole/cancelSubscription

Sets, changes or removes the end date of one of the signed-in subscriber's own subscriptions. Not limited to cancelling — sending an empty NewEndDateTimeUTC.ISO8601 removes a future end date, un-cancelling a pending cancellation.

Always scoped to the caller's own subscription — any SubscriberToken in the body is overridden by the authenticated identity (the one exception: a supplied externalSubscriberID that resolves to exactly one subscriber of this operator replaces the caller for the request — send it only for your own account).

Selecting the subscription: exactly one non-ended subscription must match; narrow with VenueID, UnitID_internal, etc. if the subscriber holds more than one.

End date: endImmediately (loosely compared) ends the subscription now and overrides NewEndDateTimeUTC.ISO8601; otherwise the date is required (or send it empty to remove an existing future end date). For a wired unit, a non-immediate end is pushed to end-of-day in the venue's local time zone unless doNotResetDatetoMidnight is exactly true.

Refunds: if permitted and the current billing cycle hasn't ended, remaining whole hours are refunded (capped by what's refundable on the last invoice); requestedRefundAmount overrides the pro-rated figure. A refund Stripe rejects does NOT fail the call — 200 with an error message instead. During a zero-priced trial, the end date moves to the trial's end instead of refunding.

A subscriber managed through external SSO cannot use this operation.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Must be the console origin of the operator the subscriber belongs to. Absent, or not resolvable to exactly one known operator domain, is refused with 401 'Forbidden. '.

Partner-Integration-Channel
string

Marks the call as machine-to-machine API access, which skips the external-SSO refusal. It changes no other check.

Request Body schema: application/json
required
AccessToken
required
string

Cognito access token for the signed-in subscriber. Required; the request is refused without it whenever the operator has console sign-on configured.

NewEndDateTimeUTC.ISO8601
string

The new end instant, as an ISO-8601 string. Required unless endImmediately is set. Send it EMPTY to remove an existing future end date instead of setting one. Cannot carry format date-time because the empty string is a meaningful value.

boolean or string or integer

Ends the subscription at the moment of the request and overrides NewEndDateTimeUTC.ISO8601. Compared loosely: true, 'true' and 1 all trigger it; anything else leaves it off.

doNotResetDatetoMidnight
boolean

Only meaningful for a wired unit with a non-immediate end date. Exactly the boolean true keeps the end instant as supplied; any other value lets it be moved to end of day in the venue's local time zone.

VenueID
string

Narrows the search to one venue when the subscriber holds several subscriptions. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UnitID_internal
string

Narrows the search to one unit. Highest-selectivity narrowing field after SetupIntentId.

UnitID
string

Narrows the search by the unit number/name as recorded on the subscription.

UnitBuilding
string

Narrows the search by building.

UnitFloor
string

Narrows the search by floor.

externalVenueID
string

Narrows the search by the operator's own venue identifier.

externalVenueUnitID
string

Narrows the search by the operator's own unit identifier.

SetupIntentId
string

Selects the subscription directly by its subscription identifier. Ignored when StripeClientSecret is supplied.

StripeClientSecret
string

Selects the subscription by the client secret recorded on it. Takes precedence over SetupIntentId. The literal string 'undefined' is ignored.

externalSubscriberID
string

CAUTION: this field selects WHICH SUBSCRIBER the request acts on. Trimmed to 64 characters and resolved against this operator's subscribers; a single match replaces the caller's own identity for the rest of the request, and a value matching more than one subscriber is refused. Omit it unless it is your own.

integer or string

Requested refund in the smallest currency unit. Honoured when it parses to a positive integer, and still capped at the amount that remains refundable on the last invoice. Absent means the refund is pro-rated from the hours remaining in the billing cycle.

CancellationReasons
Array of strings

Free-text reasons recorded on the subscription and forwarded on the webhook event. Anything that is not a non-empty array is stored as an empty list.

SubscriberToken
string

Ignored. It is overwritten with the signed-in subscriber's own identity before the subscription is looked up.

EmailAddress
string <email>

Not used to select the subscription while the signed-in identity is available.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito access token>",
  • "VenueID": "<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "NewEndDateTimeUTC.ISO8601": "2026-12-31T23:59:59.999Z",
  • "CancellationReasons": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "Subscription end date updated to 2026-12-31T23:59:59.999Z",
  • "EndDateTimeUTC.ISO8601": "2026-12-31T23:59:59.999Z",
  • "errorProcessing": false
}

/subscriberconsole/listPayments

Returns invoice/payment history as a Payments array plus record counts and per-currency totals. Read-only, apart from a best-effort receipt-URL lookup for rows missing one.

Who may call it: an access token is mandatory (no anonymous access). Classified in order: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), or Subscriber — whichever the token matches first.

Scope: a Subscriber caller (including a staff token that doesn't match its intended role) always sees only their own history; other identifiers in the request can only narrow it further, never widen it. Operator/venue callers may target a subscriber via externalSubscriberID, EmailAddress or PhoneNumber.E164.

Date window: defaults to the last 2 years when no lower bound is sent — this does NOT return full history by default. An unparseable bound is silently ignored. Rows with no invoice date are always included.

Size guard: if more than 2000 records match, Payments is emptied and message explains why; PaymentCount becomes 0 but NonZeroPaymentCount still reflects the real (pre-emptying) tally.

Authorizations:
CognitoUserPool
Request Body schema: application/json
optional
AccessToken
string

Access token identifying the caller. Required unless it is supplied as an Authorization: Bearer header, which overrides this field when present. An empty string counts as absent and is rejected 401.

IdToken
string

Optional companion identity token. When present it, rather than the access token, is verified against the operator's identity pool to establish who the caller is.

OperatorID
string

Required ONLY for a network-software-provider caller, for whom it selects the operator whose invoices are read; it is consumed as the operator context and never used as a row filter. Ignored for every other caller.

SubscriberToken
string

Restrict to one subscriber. Sent by a subscriber caller it is overwritten with the caller's own identity, so it can neither broaden nor redirect the query.

externalSubscriberID
string

Operator's own subscriber identifier. Used to resolve a subscriber when no SubscriberToken is supplied, and as an exact-match filter on the returned rows.

EmailAddress
string <email>

Subscriber e-mail. Lower-cased before use. Resolves a subscriber when no SubscriberToken is supplied, and is otherwise an exact-match filter on the row's stored e-mail.

PhoneNumber.E164
string

Subscriber phone in E.164 form. For operator- and venue-level callers it is also promoted to the subscriber-resolution input; for a subscriber caller it acts only as an exact-match filter on the row's stored phone.

StripeCustomerID
string

Payment-provider customer identifier. Selects the read when no subscriber identity is in play, and is an exact-match filter in all cases.

externalSubscriptionID
string

Exact-match filter on the row's external subscription identifier.

VenueID
string

Venue identifier. For a venue-level caller this is the value that must be covered by the token's venue role, and it is also applied as an exact-match filter, which is what confines such a caller to its own venue. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

Exact-match filter on the row's external venue identifier.

UnitID_internal
string

Exact-match filter on the row's unit identifier.

externalVenueUnitID
string

Exact-match filter on the row's external unit identifier.

ServicePlanID
string

Exact-match filter on the row's service plan.

externalServicePlanID
string

Exact-match filter on the row's external service-plan identifier.

MinInvoiceDateTimeUTC.ISO8601
string

Inclusive lower bound on the invoice date. Overrides MinStartDateTimeUTC.ISO8601. Defaults to two years before the request when neither is sent. An unparseable value disables the bound.

MaxInvoiceDateTimeUTC.ISO8601
string

Inclusive upper bound on the invoice date. Overrides MaxStartDateTimeUTC.ISO8601. An unparseable value disables the bound.

MinStartDateTimeUTC.ISO8601
string

Lower bound, used only when MinInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is compared against the invoice date.

MaxStartDateTimeUTC.ISO8601
string

Upper bound, used only when MaxInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is compared against the invoice date.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "StripeCustomerID": "string",
  • "externalSubscriptionID": "string",
  • "VenueID": "PMGID._V3VENUE_.USA.STATE.POSTALCODEID.VENUENAMEID.CITYID",
  • "externalVenueID": "string",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string",
  • "ServicePlanID": "string",
  • "externalServicePlanID": "string",
  • "MinInvoiceDateTimeUTC.ISO8601": "string",
  • "MaxInvoiceDateTimeUTC.ISO8601": "string",
  • "MinStartDateTimeUTC.ISO8601": "string",
  • "MaxStartDateTimeUTC.ISO8601": "string"
}

Response samples

Content type
application/json
{
  • "PaymentCount": 0,
  • "NonZeroPaymentCount": 0,
  • "Payments": [
    ],
  • "BillingCycleHours": 0,
  • "DownloadKbps": 0,
  • "UploadKbps": 0,
  • "PricePerDownloadGbps.USD": 0,
  • "VenuePriceAdjustment": 0,
  • "VenueUnitPriceAdjustment": 0,
  • "MinInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "message": "string",
  • "errorProcessing": false,
  • "property1": 0,
  • "property2": 0
}

/subscriberconsole/addTicket

Raises a support ticket on the ConnectWise PSA instance configured for the caller's venue, and attaches the issue text as a note.

Always scoped to the caller's own subscription — matched by the authenticated account's email against active, set-up, non-ended subscriptions at the given VenueID. contactEmailAddress/EmailAddress only set the ticket's contact info, never used to find the subscription. Exactly one matching subscription must exist.

VenueID is required — VAULTID is accepted as an alias but only VenueID is actually used for the lookup, so sending VAULTID alone will not find a subscription.

Silent no-op: if the venue lacks a complete ConnectWise configuration, or any ConnectWise call fails, no ticket is created and the call still succeeds with an empty result.

⚠ This operation returns a JSON ARRAY, not an object. On success: index 0 is an internal object not part of the contract, index 1 is the created ticket (or {} if none was created). A validation rejection returns a ONE-element array with no message/errorProcessing at all — branch on the HTTP status code, not the body, for those. Earlier rejections (bad token, malformed body) return a normal object instead.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Must be the console origin of the operator the subscriber belongs to. Absent, or not resolvable to exactly one known operator domain, is refused with 401 'Forbidden. '.

Partner-Integration-Channel
string

Marks the call as machine-to-machine API access. It does not change any check this operation performs.

Request Body schema: application/json
required
AccessToken
required
string

Cognito access token for the signed-in subscriber. Required; the request is refused without it whenever the operator has console sign-on configured.

contactName
required
string

Required. Recorded as the ticket contact and as the author of the note. Refused if absent or empty, and refused if it contains anything that looks like an HTML tag or an HTML entity. Otherwise trimmed and truncated to 40 characters.

contactEmailAddress
string <email>

Contact e-mail recorded on the ticket. Either this or EmailAddress must be present; when both are, this one wins and replaces EmailAddress. Must be a valid e-mail address. Not used to select the subscription.

EmailAddress
string <email>

Alternative to contactEmailAddress, used only when that field is absent. Must be a valid e-mail address. Lower-cased before use. Not used to select the subscription - the subscription is always found through the authenticated account.

summary
required
string

Required. One-line ticket subject. HTML-escaped, then trimmed and truncated to 100 characters. Also used as the note text when Description is absent.

VenueID
string

The venue the subscription is. Required in practice: it is the only field the subscription lookup reads. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

VAULTID
string

The venue key used to read the venue's ConnectWise configuration and to select its VAULT-UI company configurations. Defaults to VenueID when omitted. Supplying VAULTID without VenueID satisfies the presence check but leaves the subscription lookup with nothing to query, so the request is then always refused.

unitID
string

Optional. When present the subscription must be the one for exactly this unit, and the same value is used as the ConnectWise UNIT configuration id whose name is recorded on the ticket. When absent, the subscriber must have exactly one qualifying unit at the venue.

VAULTUnitID
string

Optional, used only when unitID is absent. Matched case-insensitively against the answers of the ConnectWise UNIT configurations' questions whose text contains 'VAULT'; a match records that configuration's name and site on the ticket. No effect on which subscription is selected.

CustomUnit
string

Optional free-text unit label. Used only on the unitID branch, and only when ConnectWise returns no UNIT configuration for that id.

Description
string

Optional. The body of the note attached to the ticket. Falls back to summary when absent. Not escaped or truncated.

PrefContactMethod
string

Optional. When present it is placed on its own line above the note text.

TicketType
string

Optional ConnectWise ticket type name.

TicketSubType
string

Optional ConnectWise ticket sub-type name. Only applied when TicketType is also supplied.

contactPhoneNumber
string

Optional. Recorded on the ticket as the contact phone number, verbatim.

serviceboardid
string

Optional ConnectWise service board id. Consulted only when the venue's own configured board id is present but is not a positive number. The string 'undefined' is ignored.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito access token>",
  • "contactName": "<contact name>",
  • "contactEmailAddress": "subscriber@example.com",
  • "summary": "<short description of the issue>",
  • "VenueID": "<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "Description": "<full description of the issue>"
}

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

/subscriberconsole/listKeySessions

Returns one subscriber's Wi-Fi data usage for the trailing 7 days as a fixed hourly series (~168 entries, oldest first, zero-filled for idle hours). Each entry's timestamp marks the END of the hour it covers, so the final entry is stamped up to an hour ahead of the request. Read-only.

Whose usage: a token with no operator/venue role but a subscriber identity always reads its OWN usage (request identifiers are ignored). A NetworkOperator caller may name a subscriber via SubscriberToken/externalSubscriberID/EmailAddress/PhoneNumber.E164. A Venue-role caller must send a VenueID it holds, and is confined to subscribers with a subscription at one of its venues. If no identifier is sent, the caller's own usage is returned regardless of role.

Two fields that don't filter: VenueID never narrows the totals; Calling-Station-Id only replaces the reported device list per hour, not the byte totals.

GET and POST are served by the same implementation and return identical output for the same subscriber; GET reads parameters from the query string and its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Must be the console origin of the operator the request belongs to; an absent or unrecognised Origin is refused with 401.

Authorization
string

Bearer . When present it replaces the AccessToken field.

Accept-Language
string

A value beginning with 'es' returns the localisable rejection messages in Spanish; anything else returns them in English.

Request Body schema: application/json
required
AccessToken
string

Cognito access token for the caller. Required unless the same token is sent as an Authorization: Bearer header, which takes precedence over this field. Missing from both is refused.

OperatorID
string

Required only when the caller is a network-software-provider console user (a token with no subscriber identity, on an origin that belongs to a software provider); omitting it is then refused. Every other caller has the operator derived from the Origin header and this field is ignored. Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

SubscriberToken
string

Identifies the subscriber to report on. Highest precedence of the four identifying fields, and used exactly as supplied. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

externalSubscriberID
string

The operator's own identifier for the subscriber. Used when SubscriberToken is absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

EmailAddress
string <email>

Subscriber e-mail; matched case-insensitively. Used when SubscriberToken and externalSubscriberID are absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

PhoneNumber.E164
string

Subscriber phone number in E.164. Lowest precedence, and honoured only for network-software-provider, network-operator and venue callers. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

VenueID
string

Grants access to a venue administrator or leasing agent whose role list contains this venue, and confines that caller to subscribers of its own venues. It does NOT filter the usage figures. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Calling-Station-Id
string

A device MAC address. Separators ':' and '-' are stripped and the value is lower-cased. It does NOT filter the byte totals: its only effect is that each hour's Calling-Station-Id array reports this one value instead of the devices actually seen.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito access token>"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "UsageData": [
    ],
  • "errorProcessing": false
}

/subscriberconsole/listKeySessions (GET)

Returns one subscriber's Wi-Fi data usage for the trailing 7 days as a fixed hourly series (~168 entries, oldest first, zero-filled for idle hours). Each entry's timestamp marks the END of the hour it covers, so the final entry is stamped up to an hour ahead of the request. Read-only.

Whose usage: a token with no operator/venue role but a subscriber identity always reads its OWN usage (request identifiers are ignored). A NetworkOperator caller may name a subscriber via SubscriberToken/externalSubscriberID/EmailAddress/PhoneNumber.E164. A Venue-role caller must send a VenueID it holds, and is confined to subscribers with a subscription at one of its venues. If no identifier is sent, the caller's own usage is returned regardless of role.

Two fields that don't filter: VenueID never narrows the totals; Calling-Station-Id only replaces the reported device list per hour, not the byte totals.

GET and POST are served by the same implementation and return identical output for the same subscriber; GET reads parameters from the query string and its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string
Example: AccessToken=<Cognito access token>

Cognito access token for the caller. Required unless the same token is sent as an Authorization: Bearer header, which takes precedence over this field. Missing from both is refused.

OperatorID
string
Example: OperatorID=<Country>.<State>.<PostalCode_ID>.<OperatorName_ID>.<City_ID>

Required only when the caller is a network-software-provider console user (a token with no subscriber identity, on an origin that belongs to a software provider); omitting it is then refused. Every other caller has the operator derived from the Origin header and this field is ignored. Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

SubscriberToken
string
Example: SubscriberToken=<SubscriberToken>

Identifies the subscriber to report on. Highest precedence of the four identifying fields, and used exactly as supplied. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

externalSubscriberID
string
Example: externalSubscriberID=<operator's own subscriber id>

The operator's own identifier for the subscriber. Used when SubscriberToken is absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

Subscriber e-mail; matched case-insensitively. Used when SubscriberToken and externalSubscriberID are absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

PhoneNumber.E164
string
Example: PhoneNumber.E164=+15555550100

Subscriber phone number in E.164. Lowest precedence, and honoured only for network-software-provider, network-operator and venue callers. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

VenueID
string
Example: VenueID=<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>

Grants access to a venue administrator or leasing agent whose role list contains this venue, and confines that caller to subscribers of its own venues. It does NOT filter the usage figures. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Calling-Station-Id
string
Example: Calling-Station-Id=AA:BB:CC:DD:EE:FF

A device MAC address. Separators ':' and '-' are stripped and the value is lower-cased. It does NOT filter the byte totals: its only effect is that each hour's Calling-Station-Id array reports this one value instead of the devices actually seen.

header Parameters
Origin
required
string

Must be the console origin of the operator the request belongs to; an absent or unrecognised Origin is refused with 401.

Authorization
string

Bearer . When present it replaces the AccessToken field.

Accept-Language
string

A value beginning with 'es' returns the localisable rejection messages in Spanish; anything else returns them in English.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "UsageData": [
    ],
  • "errorProcessing": false
}

/subscriberconsole/listPaymentMethod

Returns a summary of the card/wallet saved against ONE of the calling subscriber's subscriptions — funding type, brand, expiry, last four digits. No full card number or provider identifier is returned; nothing is written.

Who may call it: only the subscriber themself — the lookup is forced to the token's identity, so a SubscriberToken in the body can't be used to read someone else's card.

Choosing the subscription: StripeClientSecret must match exactly one non-ended subscription of the caller. Zero or multiple matches both return 200 with an essentially empty body — check for the presence of card, not the status.

No card on file (or no usable payment-provider credentials) also returns 200 with card present but empty.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator is resolved from it (a '-preview' infix is stripped first) and supplies the Cognito pool used to verify the token, the operator whose subscriptions are searched, and any source-IP allow-list. With no Origin/origin header at all the request is refused 401 'origin missing. '; an origin that resolves to no operator gives 401 'Operator not found. '.

Authorization
string

Optional Bearer <JWT> alternative to the body's AccessToken. When present, the second space-separated word is taken and OVERWRITES whatever AccessToken the body carried.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. On this operation it affects only 'AccessToken Missing. ' and 'Access Denied. '; 'StripeClientSecret missing from request. ' is a hardcoded English literal.

Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT of the subscriber. May instead be supplied as Authorization: Bearer <JWT>, which overwrites this property. Absent from both gives 401 'AccessToken Missing. '. It is verified only when the resolved operator has a Cognito pool configured, and it must carry a subscriber identity or the call is refused 401 'Access Denied. '.

StripeClientSecret
required
string

The payment client secret stored on the subscription whose saved card you want, compared for exact equality against the caller's own non-ended subscriptions. Absent or empty gives 401 'StripeClientSecret missing from request. '. A value matching none - or more than one - of them returns 200 with an empty body rather than an error.

SubscriberToken
string

IGNORED. It is overwritten with the subscriber identity carried by the access token before the lookup, so it cannot reach another subscriber's payment method.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "StripeClientSecret": "string",
  • "SubscriberToken": "string"
}

Response samples

Content type
application/json
{
  • "SetupSuccessDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "card": {
    },
  • "wallet": {
    },
  • "errorProcessing": false,
  • "message": ""
}

/subscriberconsole/listDeviceSessions

Returns one subscriber's Wi-Fi data usage for the trailing 7 days as a fixed hourly series (~168 entries, oldest first, zero-filled for idle hours). Each entry's timestamp marks the END of the hour it covers, so the final entry is stamped up to an hour ahead of the request. Read-only.

Whose usage: a token with no operator/venue role but a subscriber identity always reads its OWN usage (request identifiers are ignored). A NetworkOperator caller may name a subscriber via SubscriberToken/externalSubscriberID/EmailAddress/PhoneNumber.E164. A Venue-role caller must send a VenueID it holds, and is confined to subscribers with a subscription at one of its venues. If no identifier is sent, the caller's own usage is returned regardless of role.

Two fields that don't filter: VenueID never narrows the totals; Calling-Station-Id only replaces the reported device list per hour, not the byte totals.

GET and POST are served by the same implementation and return identical output for the same subscriber; GET reads parameters from the query string and its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Must be the console origin of the operator the request belongs to; an absent or unrecognised Origin is refused with 401.

Authorization
string

Bearer . When present it replaces the AccessToken field.

Accept-Language
string

A value beginning with 'es' returns the localisable rejection messages in Spanish; anything else returns them in English.

Request Body schema: application/json
required
AccessToken
string

Cognito access token for the caller. Required unless the same token is sent as an Authorization: Bearer header, which takes precedence over this field. Missing from both is refused.

OperatorID
string

Required only when the caller is a network-software-provider console user (a token with no subscriber identity, on an origin that belongs to a software provider); omitting it is then refused. Every other caller has the operator derived from the Origin header and this field is ignored. Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

SubscriberToken
string

Identifies the subscriber to report on. Highest precedence of the four identifying fields, and used exactly as supplied. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

externalSubscriberID
string

The operator's own identifier for the subscriber. Used when SubscriberToken is absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

EmailAddress
string <email>

Subscriber e-mail; matched case-insensitively. Used when SubscriberToken and externalSubscriberID are absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

PhoneNumber.E164
string

Subscriber phone number in E.164. Lowest precedence, and honoured only for network-software-provider, network-operator and venue callers. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it but no qualifying operator or venue role (see the description).

VenueID
string

Grants access to a venue administrator or leasing agent whose role list contains this venue, and confines that caller to subscribers of its own venues. It does NOT filter the usage figures. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Calling-Station-Id
string

A device MAC address. Separators ':' and '-' are stripped and the value is lower-cased. It does NOT filter the byte totals: its only effect is that each hour's Calling-Station-Id array reports this one value instead of the devices actually seen.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito access token>"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "UsageData": [
    ],
  • "errorProcessing": false
}

/subscriberconsole/listDeviceSessions (GET)

Returns one subscriber's Wi-Fi data usage for the trailing 7 days as a fixed hourly series (~168 entries, oldest first, zero-filled for idle hours). Each entry's timestamp marks the END of the hour it covers, so the final entry is stamped up to an hour ahead of the request. Read-only.

Whose usage: a token with no operator/venue role but a subscriber identity always reads its OWN usage (request identifiers are ignored). A NetworkOperator caller may name a subscriber via SubscriberToken/externalSubscriberID/EmailAddress/PhoneNumber.E164. A Venue-role caller must send a VenueID it holds, and is confined to subscribers with a subscription at one of its venues. If no identifier is sent, the caller's own usage is returned regardless of role.

Two fields that don't filter: VenueID never narrows the totals; Calling-Station-Id only replaces the reported device list per hour, not the byte totals.

GET and POST are served by the same implementation and return identical output for the same subscriber; GET reads parameters from the query string and its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string
Example: AccessToken=<Cognito access token>

Cognito access token for the caller. Required unless the same token is sent as an Authorization: Bearer header, which takes precedence over this field. Missing from both is refused.

OperatorID
string
Example: OperatorID=<Country>.<State>.<PostalCode_ID>.<OperatorName_ID>.<City_ID>

Required only when the caller is a network-software-provider console user (a token with no subscriber identity, on an origin that belongs to a software provider); omitting it is then refused. Every other caller has the operator derived from the Origin header and this field is ignored. Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

SubscriberToken
string
Example: SubscriberToken=<SubscriberToken>

Identifies the subscriber to report on. Highest precedence of the four identifying fields. Ignored only for a caller classified as a subscriber - that is, one whose token matches no network-operator role for the operator resolved from the Origin and no venue role for the supplied VenueID. A staff token carries a subscriber identity too, but is classified by its role first, so these fields ARE honoured for it.

externalSubscriberID
string
Example: externalSubscriberID=<operator's own subscriber id>

The operator's own identifier for the subscriber. Used when SubscriberToken is absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it.

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

Subscriber e-mail; matched case-insensitively. Used when SubscriberToken and externalSubscriberID are absent. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it.

PhoneNumber.E164
string
Example: PhoneNumber.E164=+15555550100

Subscriber phone number in E.164. Lowest precedence, and honoured only for network-software-provider, network-operator and venue callers. Ignored only for a caller classified as a subscriber (no matching network-operator role and no matching venue role); a staff token also carries a subscriber identity but is classified by its role first, so this field IS honoured for it.

VenueID
string
Example: VenueID=<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>

Grants access to a venue administrator or leasing agent whose role list contains this venue, and confines that caller to subscribers of its own venues. It does NOT filter the usage figures. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Calling-Station-Id
string
Example: Calling-Station-Id=AA:BB:CC:DD:EE:FF

A device MAC address. Separators ':' and '-' are stripped and the value is lower-cased. It does NOT filter the byte totals: its only effect is that each hour's Calling-Station-Id array reports this one value instead of the devices actually seen.

header Parameters
Origin
required
string

Must be the console origin of the operator the request belongs to; an absent or unrecognised Origin is refused with 401.

Authorization
string

Bearer . When present it replaces the AccessToken field.

Accept-Language
string

A value beginning with 'es' returns the localisable rejection messages in Spanish; anything else returns them in English.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "UsageData": [
    ],
  • "errorProcessing": false
}

/subscriberconsole/resetKey

Rotates a subscriber's Wi-Fi pre-shared key (PSK). You identify the CURRENT key, supply the NEW one, and the change is written across every one of that subscriber's set-up, non-ended subscriptions that carries the current key; the key-pool caches are then rebuilt so the new key starts authenticating and the old one stops. The new key is NOT echoed back - the response carries only a status message.

Who may call it. An access token is mandatory: it is read from Authorization: Bearer <JWT> (which overwrites any AccessToken in the body) or from the body, and if neither is present the call is refused 401 with 'AccessToken Missing. ' - there is no anonymous fallthrough on this operation. The token is then classified, in this order: a Network Software Provider (the operator resolved from the request Origin carries a provider id, and the token carries a username but no subscriber identity - such a caller MUST send OperatorID, else 401 'OperatorID Missing. '); a network-operator administrator whose token lists this operator under DomainAdministrator, AccountManager or CustomerSupport; or any token carrying a subscriber identity, which is treated as the subscriber acting on their own key. There is NO venue-scoped branch on this operation - a venue administrator or leasing agent is admitted only if their own token also carries a subscriber identity, and then only as that subscriber. Anything else is refused 401 'Access Denied. '.

Whose key is rotated. For a subscriber caller SubscriberToken, EmailAddress, PhoneNumber.E164 and externalSubscriberID in the body are ignored and the subscriber identity carried by the token is used instead, so the account cannot be selected by naming one. The account whose key is actually rotated is then derived from the current key you supply: with psk alone the match is narrowed to that subscriber's own subscriptions, but when CurrentKeyID is sent as well the narrowing is skipped and the target becomes whichever subscriber of this operator holds the supplied key. Those four fields are read only for operator and provider callers, and if such a caller sends none of them they too are reclassified as a subscriber and the call targets their own token (a provider token carries no subscriber identity at all, so that combination ends in 401 'Subscriber not found.').

Identifying the current key. Send psk - the current pre-shared key itself. CurrentKeyID, the WPA2 pairwise master key derived from it, remains accepted as a legacy alternative until 17 November 2026, after which only psk satisfies the check; it is resolved back to the PSK through a reverse-lookup cache and, failing that, by recomputing the key derivation over the subscriber's active keys across the SSIDs they are served on. A current key that does not resolve to exactly one subscription holder of this operator gives 401 'Current key not found.'.

Supplying the new key. Send either NewKey (the complete key) or UserPartForNewKey, from which the stored key is assembled as that value, a dot, and the subscriber's own token. Send exactly one of the two. As of 2026-08-24 an empty or null NewKey is no longer rejected as invalid characters - the charset check is skipped when the field is empty - so a UserPartForNewKey request succeeds whether NewKey is omitted, empty or null. Where the resolved StrictPSK is true for the target subscription (escalate-only: operator OR venue OR unit), a full NewKey is MANDATORY - UserPartForNewKey is refused there, because the assembled value contains a '.' and can never be StrictPSK-compliant. A missing NewKey in that case returns 401 'This subscription requires NewKey. UserPartForNewKey is not accepted where StrictPSK applies.'; a supplied NewKey failing the strict contract (8-63 characters, an uppercase, a lowercase, a digit and one special from !#+,-/:=@_ with no other non-alphanumeric, no '.', not starting with a special, no run of 8 identical characters) returns 401 'New key does not meet the StrictPSK requirement for this venue unit. ...'; and if that policy cannot be resolved the reset is refused 401 'Unable to verify the password policy for this subscription. Try again.' rather than proceeding.

dryRun runs every validation - length, character set, assembled format and uniqueness across the operator - and answers 200 'Strong Wi-Fi password. ' WITHOUT writing anything or rotating any key.

Two request-shape failures answer HTTP 200, not 4xx. Omitting the current-key identifier and omitting the new key are both reported as HTTP 200 with errorProcessing true and an explanatory message. Treat errorProcessing, not the HTTP status, as the outcome flag on this operation.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator is resolved from it (a '-preview' infix is stripped first) and supplies the Cognito pool used to verify the token plus any source-IP allow-list. Absent (and with no Origin/origin header at all) the request is refused 401 'origin missing. '; an origin that resolves to no operator gives 401 'Operator not found. '.

Authorization
string

Optional Bearer <JWT> alternative to the body's AccessToken. When present, the second space-separated word is taken and OVERWRITES whatever AccessToken the body carried.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. It affects only the four translated rejections on this operation ('AccessToken Missing. ', 'OperatorID Missing. ', 'Access Denied. ', 'Subscriber not found.'); every key-validation and key-rotation message is a hardcoded English literal that does not localize.

Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. May instead be supplied as Authorization: Bearer <JWT>, which overwrites this property. Absent from both gives 401 'AccessToken Missing. '. It is verified only when the resolved operator has a Cognito pool configured.

psk
string

The CURRENT pre-shared key, and the supported way to identify the key being rotated. When it is sent without CurrentKeyID the match is narrowed to the subscriber the request resolved to; when CurrentKeyID is sent as well that narrowing is skipped and the key's own holder becomes the target. If it matches no single holder of this operator the call fails 401 'Current key not found.'. Required from 17 November 2026 onward.

CurrentKeyID
string

LEGACY alternative to psk until 17 November 2026: the WPA2 pairwise master key for the current PSK, as a hex string. It is resolved back to the PSK through a reverse-lookup cache and, failing that, by recomputing the key derivation over the subscriber's active keys across the SSIDs they are served on. From that date it no longer satisfies the current-key requirement.

NewKey
string [ 8 .. 63 ] characters

The complete new pre-shared key. Send this OR UserPartForNewKey. Longer than 63 characters gives 401 'NewKey cannot be more than 63 characters.'. Any value outside the WPA-permitted printable range - INCLUDING an empty string, a null, or any value shorter than 8 characters - gives 401 'NewKey has invalid characters.', so omit the property entirely when you are using UserPartForNewKey. After assembly the key must differ from the current key, and when it contains a dot whose final segment is longer than 5 characters that segment must be the target's own subscriber token, otherwise 401 'New key in incompatible format.'.

UserPartForNewKey
string <= 40 characters

Alternative to NewKey: the stored key becomes this value, a dot, and the target subscriber's own token. Longer than 40 characters gives 401 'UserPartForNewKey cannot be more than 40 characters.'; characters outside the permitted printable range give 401 'UserPartForNewKey has invalid characters. It cannot contain a period.'. The assembled key must still be at least 8 and at most 63 characters.

dryRun
boolean

Truthy runs every validation, including the operator-wide uniqueness check, and returns 200 'Strong Wi-Fi password. ' WITHOUT writing anything. This is a plain truthiness test, so the string '0' counts as true while the number 0 does not. It also suppresses the duplicate-key metric.

SubscriberToken
string

IGNORED when the caller's own token carries a subscriber identity - the caller's own token is used instead and this value is overwritten. It identifies the target only for operator and provider callers.

EmailAddress
string <email>

IGNORED for a subscriber caller; identifies the target subscriber only for operator and provider callers. Lower-cased by the shared request sanitiser before lookup.

PhoneNumber.E164
string

IGNORED for a subscriber caller; identifies the target subscriber only for operator and provider callers, in which case it is also copied onto a PhoneNumber property before lookup.

externalSubscriberID
string

IGNORED for a subscriber caller; identifies the target subscriber only for operator and provider callers, by the operator's own identifier for them.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider, in which case its absence gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and removed from the body before the key logic runs.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "psk": "string",
  • "CurrentKeyID": "string",
  • "NewKey": "stringst",
  • "UserPartForNewKey": "string",
  • "dryRun": true,
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Password reset successful.",
  • "errorProcessing": false,
  • "statusCode": 200
}

/subscriberconsole/acknowledgeMessageFromVenue

Marks one message a venue sent to the calling subscriber as acknowledged.

Who may call it: only the subscriber the message belongs to — the target subscriber comes from the token and overwrites any identifier sent in the body, so this can only ever acknowledge the caller's own message.

MessageID is the key under which the message appears in messages_from_venues (from listKeys) — must be sent as a non-empty string.

Idempotent: re-acknowledging an already-acknowledged message returns the same success, unchanged.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator is resolved from it (a '-preview' infix is stripped first) and supplies the Cognito pool used to verify the token plus any source-IP allow-list. With no Origin/origin header at all the request is refused 401 'origin missing. '; an origin that resolves to no operator gives 401 'Operator not found. '.

Authorization
string

Optional Bearer <JWT> alternative to the body's AccessToken. When present, the second space-separated word is taken and OVERWRITES whatever AccessToken the body carried.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. On this operation it affects only 'AccessToken Missing. ' and 'Access Denied. '; the success message, 'MessageID missing from request. ' and 'Message not found. ' are hardcoded English literals that never localize.

Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT of the subscriber. May instead be supplied as Authorization: Bearer <JWT>, which overwrites this property. Absent from both gives 401 'AccessToken Missing. '. It is verified only when the resolved operator has a Cognito pool configured, and it must carry a subscriber identity or the call is refused 401 'Access Denied. '.

MessageID
required
string

Identifier of the message to acknowledge, as returned in the subscriber's message list. Must be a non-empty string; absent, empty or non-string gives 401 'MessageID missing from request. '. A value that is not one of the caller's own messages gives 404 'Message not found. '.

SubscriberToken
string

IGNORED. Whatever is sent here is overwritten with the subscriber identity carried by the access token before the message is looked up, so it cannot be used to reach another subscriber's message.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "MessageID": "string",
  • "SubscriberToken": "string"
}

Response samples

Content type
application/json
{
  • "message": "Message acknowledged by subscriber. ",
  • "errorProcessing": false
}

/subscriberconsole/modifyServicePlan

Changes the service plan on one of the caller's own subscriptions and returns the resulting billing adjustment. Requires only a valid token — no role/admin access needed.

Selecting the subscription: filtered to the caller's own active subscriptions using unit/venue/external-id/Stripe identifiers; exactly one match is required (with no filters, the call only succeeds if the operator has exactly one active subscription for this caller).

The new plan must be offered at the subscription's venue and belong to the same operator; a differing billing cycle is adopted and the cadence re-anchored. Requesting the current plan is refused.

On success: the subscription is repriced (unused hours of the old cycle credited back, new hours valued at the new rate, net carried to the next invoice — capped so the next invoice never goes negative), bandwidth/device limits are rewritten, and the subscriber is notified. If the new plan costs money and there's no usable payment method, the subscription is flagged payment-failed.

⚠ Real billing consequences, not idempotent.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token of the calling subscriber, in the request BODY (this operation does not read an Authorization header). The user pool is resolved from the request Origin. A missing token is refused with 401 whenever the operator has a Cognito pool configured.

NewServicePlanID
string

Identifier of the plan to move to. One of NewServicePlanID or NewExternalServicePlanID must be a non-empty string, otherwise the call is refused with 401. The plan must be offered at the matched subscription's venue and belong to the same operator. Its billing-cycle length need NOT match the current subscription's.

NewExternalServicePlanID
string

Alternative to NewServicePlanID: the operator's own external identifier for the plan. Used only when NewServicePlanID is absent or empty.

UnitID_internal
string

Selects the subscription by internal unit id. This is the most selective filter and is applied first when present.

UnitID
string

Selects the subscription by the unit's display id.

UnitBuilding
string

Narrows selection by building.

UnitFloor
string

Narrows selection by floor.

externalVenueUnitID
string

Narrows selection by the operator's external unit identifier.

VenueID
string

Narrows selection to one venue. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

Narrows selection by the operator's external venue identifier.

externalSubscriberID
string

Narrows selection by the operator's external subscriber identifier.

externalSubscriptionID
string

Narrows selection by the operator's external subscription identifier.

StripeClientSecret
string

Narrows selection by the subscription's stored Stripe client secret.

SetupIntentId
string

Selects the subscription by its Stripe setup-intent / subscription id. Applied before every other filter when present.

Reason
string

Optional free text recorded on the subscription's event history alongside the plan change. Not validated.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<cognito access token>",
  • "NewServicePlanID": "<service plan id>",
  • "UnitID_internal": "<internal unit id>"
}

Response samples

Content type
application/json
{
  • "message": "Service plan updated. ",
  • "BillingCyclePriceAdjustment": -450,
  • "NextInvoiceAdjustedAmount.USD": 2550,
  • "NextInvoiceDateTimeUTC.ISO8601": "2026-09-15T00:00:00.000Z",
  • "errorProcessing": false
}

/subscriberconsole/listSubscriberLog

Returns activity-log entries for the CALLING subscriber's account only — a SubscriberToken naming someone else silently yields an empty result, never another subscriber's log.

Results are scoped to the caller's operator and a time window (newest first; no lower bound by default, upper bound defaults to just after 'now'); the window actually used is echoed back. Narrow further with the listed filters, a fuzzy free-text search, or (POST only) a raw search expression that replaces the individual filters. Each entry's Administrator field is expanded to Given Family (email) where recognizable.

The event field is always an object — structured entries as stored, plain-text entries wrapped as { message: <text> }. Read-only.

GET form: query parameters mirror the POST body, with two exceptions — customQuery can't be sent as a query string (silently ignored, but it still suppresses every other filter when present), and paging beyond the first page requires the POST form. Responses may be cached briefly by the client.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
AccessToken
string

Cognito access token of the calling subscriber. May instead be supplied as 'Authorization: Bearer ', which takes precedence over the body value. Missing in both places is refused with 401.

MinViewWindowDateUTC.ISO8601
string <date-time>

Start of the window. Omitted means no lower bound at all - and in that case the total count stops being exact past 10000. An unparseable value is refused with 400.

MaxViewWindowDateUTC.ISO8601
string <date-time>

End of the window. Defaults to about a minute after 'now'. An unparseable value is refused with 400.

pageSize
integer <= 500
Default: 250

Entries per page. Defaults to 250 and is capped at 500.

searchBefore
Array of any

Cursor from a previous response's searchBefore, to fetch the next page.

searchText
string

Fuzzy full-text search across the entry text, operation name, administrator, source address, account token and log type. All supplied terms must match.

object

Raw search expression, applied instead of the individual filter fields below. It must be an object containing at least one of bool, match, term, terms, range, wildcard, regexp, exists or multi_match; an object carrying none of them is refused with 400. The operator scope and the date window are still applied on top of it. It does not lift the account scoping. A value that is NOT an object is neither applied nor refused: it is ignored as a search expression, but it still suppresses every individual filter field below, so the request returns 200 with those filters silently dropped.

string or Array of strings

Exact-match filter on the operation that produced the entry. A single value or an array of values.

string or Array of strings

Exact-match filter on the entry type. A single value or an array of values.

string or Array of strings

Exact-match filter on the stored administrator value (matched before it is expanded for display). A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

string or Array of strings

Exact-match filter. For a subscriber caller the account is forced to their own regardless, so a value other than their own token simply produces an empty result.

string or Array of strings

Exact-match filter on the venue. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. A single value or an array.

string or Array of strings

Exact-match filter on the internal unit id. A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

string or Array of strings

Exact-match filter. A single value or an array.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<cognito access token>",
  • "pageSize": 50,
  • "MinViewWindowDateUTC.ISO8601": "2026-07-01T00:00:00Z"
}

Response samples

Content type
application/json
{
  • "log": [
    ],
  • "currentCount": 1,
  • "totalCount": 1,
  • "pageSize": 250,
  • "hasMore": false,
  • "MinViewWindowDateUTC.ISO8601": null,
  • "MaxViewWindowDateUTC.ISO8601": "2026-08-19T09:00:00.000Z",
  • "allowedFilterFields": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/subscriberconsole/listSubscriberLog (GET)

Returns activity-log entries for the CALLING subscriber's account only — a SubscriberToken naming someone else silently yields an empty result, never another subscriber's log.

Results are scoped to the caller's operator and a time window (newest first; no lower bound by default, upper bound defaults to just after 'now'); the window actually used is echoed back. Narrow further with the listed filters, a fuzzy free-text search, or (POST only) a raw search expression that replaces the individual filters. Each entry's Administrator field is expanded to Given Family (email) where recognizable.

The event field is always an object — structured entries as stored, plain-text entries wrapped as { message: <text> }. Read-only.

GET form: query parameters mirror the POST body, with two exceptions — customQuery can't be sent as a query string (silently ignored, but it still suppresses every other filter when present), and paging beyond the first page requires the POST form. Responses may be cached briefly by the client.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token of the calling subscriber, as an alternative to the Authorization header. Missing in both places is refused with 401.

MinViewWindowDateUTC.ISO8601
string <date-time>

Start of the window. Omitted means no lower bound at all - and in that case the total count stops being exact past 10000. An unparseable value is refused with 400.

MaxViewWindowDateUTC.ISO8601
string <date-time>

End of the window. Defaults to about a minute after 'now'. An unparseable value is refused with 400.

pageSize
integer <= 500
Default: 250

Entries per page. Defaults to 250 and is capped at 500.

searchText
string

Fuzzy full-text search across the entry text, operation name, administrator, source address, account token and log type. All supplied terms must match.

function_name
string

Exact-match filter on the operation that produced the entry.

LogType
string

Exact-match filter on the entry type.

Administrator
string

Exact-match filter on the stored administrator value, matched before it is expanded for display.

AdministratorOS
string

Exact-match filter.

AdministratorBrowser
string

Exact-match filter.

SourceIP
string

Exact-match filter.

SourceLocale
string

Exact-match filter.

SubscriberToken
string

Exact-match filter. For a subscriber caller the account is forced to their own regardless, so a value other than their own token simply produces an empty result.

VenueID
string
Example: VenueID=PMG000._V3VENUE_.USA.ST.00000.VENUENAME.CITY

Exact-match filter on the venue. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UnitID_internal
string

Exact-match filter on the internal unit id.

EquipmentID
string

Exact-match filter.

KeyPoolID
string

Exact-match filter.

ServicePlanID
string

Exact-match filter.

header Parameters
Authorization
string

'Bearer '. Takes precedence over an AccessToken query parameter. One of the two must be present.

Responses

Response samples

Content type
application/json
{
  • "log": [
    ],
  • "currentCount": 1,
  • "totalCount": 1,
  • "pageSize": 250,
  • "hasMore": false,
  • "MinViewWindowDateUTC.ISO8601": null,
  • "MaxViewWindowDateUTC.ISO8601": "2026-08-19T09:00:00.000Z",
  • "allowedFilterFields": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/venuemgmtconsole/subscribers/resendCodeforTandC

Sends the subscriber-console password-reset code — or, for an account that has never accepted the Terms and Conditions, the welcome message with its temporary password. Despite the name, this is the general subscriber password-reset module.

No authentication is required — an unauthenticated request is accepted and classified Public.

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), Subscriber (always their own account only), or Public.

Delivery: NotificationChannel: "SMS" forces SMS to the subscriber's stored phone number (bypassing suppression) when one exists; otherwise email is sent. An EmailAddress/PhoneNumber in the request is only used to look the subscriber up, never as a destination.

Privacy for unauthenticated callers: a Public caller always gets the same 200 success body, whether or not the subscriber exists or is reachable — this prevents account enumeration. Authenticated callers get the real rejection instead.

Authorizations:
CognitoAuth
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first), and that record supplies the OperatorID, the Cognito pool used to verify the token and any source-IP whitelist. A request with neither 'origin' nor 'Origin' is rejected 401 'origin missing. '; an origin that resolves to no operator is rejected 401 'Operator not found. '.

Authorization
string

Optional on this route. When non-empty the value is split on a space and element [1] is taken as the AccessToken, OVERWRITING any AccessToken in the request body. A value with no space yields undefined, which is then treated as no token at all - the request is processed as an anonymous Public call rather than rejected.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) message catalogue, anything else US English. This affects the response 'message' text only.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT access token. Optional. Overwritten by the Authorization header when that header is present. Verified only when the operator record carries a Cognito pool; a token that fails verification is rejected 401.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token and its preferred_username (or, failing that, its email resolved through the operator's email cache) identifies the caller.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller, which is rejected 401 'OperatorID Missing. ' without it. It then replaces the operator context and is removed from the request before the identifier lookups run. Ignored for every other caller.

VenueID
string

Read only by the role check: a caller whose venue-level role list contains this exact VenueID is classified 'Venue'. It does NOT scope the reset and it is not required for operator-level callers - but a venue staff member who omits it is classified 'Subscriber' and resets their own password instead of the target's. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Identifies the target subscriber directly. Highest precedence of the four identifiers. Ignored for a caller classified 'Subscriber', whose own token always wins.

externalSubscriberID
string

The operator's own subscriber identifier; resolved to a SubscriberToken. Used only when SubscriberToken is absent.

EmailAddress
string

Subscriber email address; lower-cased and resolved to a SubscriberToken. Used only when SubscriberToken and externalSubscriberID are absent. Look-up only - the reset is delivered to the address stored on the subscriber record.

PhoneNumber
string

Lowest precedence of the four identifiers. Note the un-dotted name: a 'PhoneNumber.E164' property is not read by this route.

NotificationChannel
string

Passed straight through to the notification engine. The only value with an effect is the exact string 'SMS', which sends the code by SMS to the subscriber's stored phone number and bypasses every suppression flag - but only when the subscriber record has a phone number; without one the request falls back to email. Any other value, or none, sends email when the subscriber record has an email address.

Domain
string

Read only when the resolved operator is the NetworkSoftwareProvider itself: it stages a second operator record for admin use. It does not select the operator whose subscriber is reset - use OperatorID for that.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string",
  • "NotificationChannel": "string",
  • "Domain": "string"
}

Response samples

Content type
application/json
{
  • "message": "Code to reset password sent to account. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

Shopping Cart

🛒 Shopping Cart & E-commerce

Complete e-commerce functionality for venue browsing, service selection, and checkout processes for prospective subscribers.

Shopping Experience

  • 🏢 Venue Discovery: Browse available venues with service offerings
  • 📋 Service Selection: Choose service plans, add-ons, and customization options
  • 🛒 Cart Management: Add, remove, modify items and calculate pricing
  • 💳 Checkout Process: Secure payment processing and account creation
  • 📊 Pricing Engine: Dynamic pricing, promotions, and discount calculations
  • 🎯 Recommendations: Intelligent service suggestions and upselling

E-commerce Features

  • 💰 Multiple Payment Methods: Credit cards, ACH, and alternative payment options
  • 🎫 Promotional Codes: Discount codes, special offers, and campaign tracking
  • 📱 Multi-Platform: Web, mobile, and API-driven shopping experiences
  • 📊 Analytics: Conversion tracking, abandoned cart recovery, sales metrics

/networkoperatorconsole/shoppingcart/listServicePlans

Lists service plans for the operator resolved from the request's origin header. Returns one of three shapes, selected by UnitID_internal first, then caller role:

  1. UnitID_internal supplied (any caller, including unauthenticated): { "AvailableServicePlans": [...] }, narrowed by the unit's venue, active subscriptions and (for public/cart callers) self-signup rules.
  2. No UnitID_internal, caller is operator staff: a bare JSON array of the operator's plans.
  3. No UnitID_internal, any other caller: {} with errorProcessing: false — a 200, not a rejection.

Authentication is optional; there's no role-based rejection for the public path — only a NetworkSoftwareProvider can be rejected on role grounds (missing/unresolvable OperatorID).

Filtering on shape 1: narrowed by the unit's existing subscription (wired units only), then the venue's configured plan list (globally-available plans always included; a venue with no configured list, or an unresolvable venue, shrinks to ONLY globally-available plans), then (public/cart callers only) self-signup, deprecated, low-bandwidth and name/description keyword filters.

Read-only. This path is an alias — served by the identical implementation as the other two listServicePlans routes.

Authorizations:
CognitoAuth
header Parameters
origin
required
string

Selects the operator whose configuration is read: the value, with a leading https:// and any -preview suffix removed, is looked up as an operator domain. Absent, the request is rejected with origin missing. . An origin that resolves to no operator is NOT rejected here - it yields a record with no identity, which downgrades the caller to the public role.

Authorization
string

Bearer <Cognito access token>. The bearer value replaces any AccessToken sent in the body, so the header wins. Omitting it is legitimate on the service-plan endpoints - the caller is then treated as public - but on the template endpoint an unauthenticated caller is rejected.

api-version
string

Integer api-version selector. It does not change which plans are returned. Sending a value below 20260417 (before the 2026-11-17 sunset) appends an advisory sentence about NetworkConfiguration.StrictPSK to the response's message; on the administrator bare-array shape that property cannot survive serialisation and is silently lost. Send 20260417 or higher.

Accept-Language
string

Only the first tag is inspected and only its first two characters: a value beginning es selects Spanish, anything else selects English. This affects the two localized messages only (OperatorID Missing. and the api-version advisory); every other message is an English literal regardless.

Request Body schema: application/json
optional

Optional. A body is parsed only when it is sent as a JSON string; anything else is treated as an empty object. A present-but-unparseable body is a 401, not a 400.

AccessToken
string

Cognito access token. OPTIONAL - without it the caller is public, which is the supported shopping-cart path when UnitID_internal is supplied. Overridden by an Authorization: Bearer header.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller - it names the target operator whose plans are listed, and omitting it is a 401. Ignored for every other caller.

UnitID_internal
string

A non-empty value selects response shape 1 for ANY caller. It is looked up as the operator's unit record; a value that finds no unit does not error - the filters are simply skipped, and the operator's whole plan catalogue is returned unfiltered.

VenueID
string

Read ONLY on the administrator bare-array shape - it is ignored when UnitID_internal is supplied, because that shape derives the venue from the unit. Narrows the array to the plans listed in that venue's configured service-plan list; globally-available plans are NOT exempted here. Format is the venue identifier form {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalServicePlanID
string

Read ONLY on the administrator bare-array shape. Compared with loose equality against each plan's externalServicePlanID, so a numeric string matches a stored number.

ShoppingCartEnabled
boolean

Read only on shape 1, and only when it is exactly the JSON boolean true. Setting it applies to an authenticated caller the same unit and self-signup filters a public caller gets. Any other value, including the string "true", leaves those filters off.

IdToken
string

Cognito id token. It is consulted ONLY when an AccessToken is also supplied and that access token is not already cached; in that case the caller's identity is taken from the id token's preferred_username, or resolved from its email claim, and the access token itself is not separately verified. An id token alone authenticates nothing. A presented id token is also checked against global sign-out.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "UnitID_internal": "string",
  • "VenueID": "string",
  • "externalServicePlanID": "string",
  • "ShoppingCartEnabled": true,
  • "IdToken": "string"
}

Response samples

Content type
application/json
[ ]

/networkoperatorconsole/shoppingcart/listServicePlans (GET)

Lists service plans for the operator resolved from the request's origin header. Returns one of three shapes, selected by UnitID_internal first, then caller role:

  1. UnitID_internal supplied (any caller, including unauthenticated): { "AvailableServicePlans": [...] }, narrowed by the unit's venue, active subscriptions and (for public/cart callers) self-signup rules.
  2. No UnitID_internal, caller is operator staff: a bare JSON array of the operator's plans.
  3. No UnitID_internal, any other caller: {} with errorProcessing: false — a 200, not a rejection.

Authentication is optional; there's no role-based rejection for the public path — only a NetworkSoftwareProvider can be rejected on role grounds (missing/unresolvable OperatorID).

Filtering on shape 1: narrowed by the unit's existing subscription (wired units only), then the venue's configured plan list (globally-available plans always included; a venue with no configured list, or an unresolvable venue, shrinks to ONLY globally-available plans), then (public/cart callers only) self-signup, deprecated, low-bandwidth and name/description keyword filters.

Read-only. This path is an alias — served by the identical implementation as the other two listServicePlans routes.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token. OPTIONAL - without it the caller is public, which is the supported shopping-cart path when UnitID_internal is supplied. Overridden by an Authorization: Bearer header.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller - it names the target operator whose plans are listed, and omitting it is a 401. Ignored for every other caller.

UnitID_internal
string

A non-empty value selects response shape 1 for ANY caller. It is looked up as the operator's unit record; a value that finds no unit does not error - the filters are simply skipped, and the operator's whole plan catalogue is returned unfiltered.

VenueID
string

Read ONLY on the administrator bare-array shape - it is ignored when UnitID_internal is supplied, because that shape derives the venue from the unit. Narrows the array to the plans listed in that venue's configured service-plan list; globally-available plans are NOT exempted here. Format is the venue identifier form {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalServicePlanID
string

Read ONLY on the administrator bare-array shape. Compared with loose equality against each plan's externalServicePlanID, so a numeric string matches a stored number.

ShoppingCartEnabled
string

Accepted but INERT on the GET form. It is honoured only when it is exactly the JSON boolean true, and a query parameter always arrives as a string - so ?ShoppingCartEnabled=true has no effect. Use the POST form with a real JSON boolean.

header Parameters
origin
required
string

Selects the operator whose configuration is read: the value, with a leading https:// and any -preview suffix removed, is looked up as an operator domain. Absent, the request is rejected with origin missing. . An origin that resolves to no operator is NOT rejected here - it yields a record with no identity, which downgrades the caller to the public role.

Authorization
string

Bearer <Cognito access token>. Query parameters are merged into the request first and the bearer value is applied afterwards, so this header wins over an AccessToken query parameter.

api-version
string

Integer api-version selector. It does not change which plans are returned. Sending a value below 20260417 (before the 2026-11-17 sunset) appends an advisory sentence about NetworkConfiguration.StrictPSK to the response's message; on the administrator bare-array shape that property cannot survive serialisation and is silently lost. Send 20260417 or higher.

Accept-Language
string

Only the first tag is inspected and only its first two characters: a value beginning es selects Spanish, anything else selects English. This affects the two localized messages only (OperatorID Missing. and the api-version advisory); every other message is an English literal regardless.

Responses

Response samples

Content type
application/json
[ ]

/networkoperatorconsole/shoppingcart/requestSubscription

Public (unauthenticated) shopping-cart entry point for starting or resuming a subscription setup — the operator is resolved from Origin, not a token.

Two shapes: with StripeClientSecret, re-opens an existing setup (returns the pending Stripe setup-intent, starts a payment-method update, or — if setup already completed — reports the completed state with no Stripe secret to open). Without it, delegates to the standard subscription-creation flow: finds/creates the subscriber, resolves the venue unit, validates the service plan, and either returns a pre-existing subscription or creates a new one with a Stripe setup intent.

Cart-safe response: this route never returns psk, SubscriberToken, unit or service-plan details, or other subscriber PII — those fields are stripped before the response is sent, win or lose.

⚠ Creating a new subscriber without GivenName AND without a caller-supplied externalSubscriberID is rejected. contactpref_sms IS persisted for a new subscriber.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
StripeClientSecret
string

Shape (1). When present (length > 0) the subscription is looked up on the OperatorID-StripeClientSecret index and no new subscription is created. Exactly one match is required, otherwise 401 'Invalid subscription. '. This is a Stripe value - the client_secret of the Stripe SetupIntent, stored and expected to start with 'seti_'.

updatePaymentMethod
boolean

Shape (1) only. Strictly true starts a new Stripe setup intent for a payment-method update.

EmailAddress
string <email>

Shape (2) subscriber identifier. One of EmailAddress / PhoneNumber.E164 / SubscriberToken / externalSubscriberID is required, else 401 'EmailAddress, PhoneNumber.E164, SubscriberToken or externalSubscriberID missing from request. ' (401). Sanitized by request validation, which lowercases, strips characters outside [a-z0-9._%+-@] and then runs an email address; a null result returns 401 'Email Address validation failed' - note the space in 'Email Address'.

PhoneNumber.E164
string

Shape (2) subscriber identifier / SMS OTP destination. Compared against the number already on the account to compute phoneNumberDifferent. The value 'null' anywhere in the string causes the field to be dropped.

PhoneNumber
string

Alternate spelling the cart posts; used only for the phoneNumberDifferent comparison.

SubscriberToken
string

Shape (2) subscriber identifier.

Format: an 8-character token generated by the platform.

NOTE: on this unauthenticated route a supplied SubscriberToken can never update the subscriber - caller_may_update_subscriber is false for function_name 'vault_shoppingcart'. A SubscriberToken that does not resolve to a subscriber of this operator also blocks new-subscriber creation: the token is simply deleted and no account is opened.

externalSubscriberID
string

Shape (2) subscriber identifier. On the new-subscriber path it is trimmed to 40 characters, NOT 64. It is NOT sanitized anywhere before that point on this route, so a value containing an HTML tag or entity is rejected with 401 'Invalid characters in externalSubscriberID.' (401). When present it also satisfies the GivenName requirement: copies it into GivenName.

GivenName
string

CONDITIONALLY REQUIRED. When the call creates a new subscriber and neither GivenName nor a caller-supplied externalSubscriberID is present, the request is rejected with 401 'GivenName missing from request' (401 - no trailing space and no full stop). The crypto.randomUUID assigned at does NOT satisfy the fallback: it lands on Subscriber.externalSubscriberID, while tests the request's externalSubscriberID. Sanitized with request validation; when sanitization empties the value the call returns 401 'GivenName validation failed'.

FamilyName
string

Family name for a newly created subscriber. Sanitized with request validation; when sanitization empties the value the call returns 401 'FamilyName validation failed'. When absent it defaults to GivenName.

UnitID_internal
string

Shape (2). Primary way to identify the venue unit; resolved directly and checked against the operator's venues. Not found returns 401 'ERROR: UnitID_internal not found. '. Format: {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor}, each of the last three uppercased and stripped of characters outside [A-Za-z0-9_-].

externalVenueUnitID
string

Shape (2) alternative unit identifier.

VenueID
string

Shape (2). Narrows the unit search to one venue; when omitted every venue of the operator is searched. Format: {pmgID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode}.{VenueName}.{City} (example).

externalVenueID
string

Shape (2) alternative venue identifier.

UnitID
string

Shape (2) unit lookup field (trimmed to 40 characters).

UnitBuilding
string

Shape (2) unit lookup field (trimmed to 40 characters).

UnitFloor
string

Shape (2) unit lookup field (trimmed to 40 characters).

AddressLine1
string

Shape (2) unit lookup field (trimmed to 40 characters).

AddressLine2
string

Shape (2) unit lookup field (trimmed to 40 characters).

City
string

Shape (2) unit lookup field (trimmed to 40 characters).

State
string

Shape (2) unit lookup field (trimmed to 40 characters).

Country.ISO3166A3
string

Shape (2) unit lookup field (trimmed to 40 characters).

PostalCode
string

Shape (2) unit lookup field (trimmed to 40 characters).

ServicePlanID
string

Shape (2). Validated against the venue unit; when omitted the unit's DefaultServicePlanID is used. An unavailable plan returns 401 with the composed message 'ERROR: Service plan ' + the submitted ServicePlanID + ' is not available for this subscription.'. A value ending in '.V3SERVICEPLAN.EMERGENCYSERVICE' is replaced by the existing subscription's plan in shape (1).

FORMAT: {OperatorID}.V3SERVICEPLAN.{plan name, sanitized, first 20 characters, spaces removed, UPPERCASED} - the prefix is the OPERATOR id, which is itself {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}. It is never a VenueID.

externalServicePlanID
string

Shape (2) alternative service-plan identifier.

externalSubscriptionID
string

Shape (2). Accepted, but never written on this route (the caller_may_update_subscriber gate at is false for 'vault_shoppingcart') and stripped from the response and from the response's Subscription.

NewKey
string

A complete Wi-Fi password, used INSTEAD of UserPartForNewKey. It is copied onto the internal LegacyPSK field on arrival and stored as-is, so the SubscriberToken is NOT appended. REQUIRED where the resolved StrictPSK is true for the target venue unit, because the composed UserPartForNewKey value contains a '.' and can never be StrictPSK-compliant; supply a value satisfying 8-63 characters, an uppercase, a lowercase, a digit and one special from !#+,-/:=@_ with no other non-alphanumeric, no '.', not starting with a special and no run of 8 identical characters. Omitting both key fields is also valid - a compliant key is then generated.

UserPartForNewKey
string

Shape (2). The user part of the PSK. 1-40 characters: over 40 returns 401 'Wi-Fi password cannot be more than 40 characters.', under 1 returns 401 'Wi-Fi password cannot be less than 1 character.', and a value that is not WPA-legal or that contains a '.' returns 401 'Wi-Fi password has invalid characters.'. Where the resolved StrictPSK is true for the unit this field is REFUSED with 401 (the composed value contains a '.' and can never be StrictPSK-compliant): omit it to have a compliant key generated, or supply a compliant full key instead. When a pre-existing setup-intent subscription is found at the unit it replaces the user part of that subscription's PSK.

contactpref_sms
boolean

HONOURED on the new-subscriber path, contrary to what the name of the caller_may_update_subscriber gate suggests. That gate only blocks the UPDATE path (for a request that names an existing SubscriberToken). When a NEW subscriber is created, copies the value onto Subscriber.contactpref_sms and writes it onto the created subscription row, so posting it to this unauthenticated endpoint DOES change persisted state. The test is LOOSE (== true), so 1 and '1' also enable it and the raw submitted value is what gets stored; anything else stores false. The value is deleted from the response by the cart filter.

Responses

Request samples

Content type
application/json
Example
{
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "+15555550100",
  • "GivenName": "Alex",
  • "FamilyName": "Rivera",
  • "VenueID": "pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO",
  • "UnitID_internal": "pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO.101.A.1"
}

Response samples

Content type
application/json
Example
{
  • "StripeCustomerID": "cus_XXXXXXXXXXXX",
  • "StripeSetupIntentId": "seti_XXXXXXXXXXXX",
  • "StripeClientSecret": "seti_XXXXXXXXXXXX_secret_XXXXXXXXXXXX",
  • "StripePublishableKey": "pk_XXXXXXXXXXXX",
  • "dateAddedUTC.ISO8601": "2026-08-19T14:03:22.117Z",
  • "phoneNumberDifferent": false,
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/listVenues

List the operator's venues, filtered by the caller's role. The operator is resolved from Origin.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue) or NetworkOperator (sees every venue) get the full list; a Venue admin/leasing agent sees only their own venues; Public (including unauthenticated) sees venues only when the operator's shopping cart is enabled, filtered to cart-eligible venues.

Trimmed per venue: internal config sections, Stripe credentials and dateAddedUTC are always removed. A caller whose token carries no SubscriberToken (NSP, or Public with no subscriber record) additionally loses externalVenueID, ShoppingCart and DailyReport on cart-enabled venues.

Read-only, from cache — a venue changed moments ago may not be reflected yet.

This path is an exact alias of /networkoperatorconsole/venues/listVenues — same implementation, same filtering by token, not by path.

Authorizations:
CognitoAuthNone
Request Body schema: application/json
optional

JSON object. A body is not required: with no access token the caller is simply treated as Public. If a body IS sent it must be valid JSON - a non-empty non-JSON body is rejected with 401 'Malformed JSON in input. '.

AccessToken
string

Cognito access-token JWT. Optional - absent means Public. May instead be supplied as an Authorization: Bearer <JWT> header, which overrides this property.

IdToken
string

Cognito id token. Only consulted during token verification, which runs only when an AccessToken is also present.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider; ignored otherwise.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

/networkoperatorconsole/shoppingcart/listVenues (GET)

List the operator's venues, filtered by the caller's role. The operator is resolved from Origin.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue) or NetworkOperator (sees every venue) get the full list; a Venue admin/leasing agent sees only their own venues; Public (including unauthenticated) sees venues only when the operator's shopping cart is enabled, filtered to cart-eligible venues.

Trimmed per venue: internal config sections, Stripe credentials and dateAddedUTC are always removed. A caller whose token carries no SubscriberToken (NSP, or Public with no subscriber record) additionally loses externalVenueID, ShoppingCart and DailyReport on cart-enabled venues.

Read-only, from cache — a venue changed moments ago may not be reflected yet.

This path is an exact alias of /networkoperatorconsole/venues/listVenues — same implementation, same filtering by token, not by path.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT. Optional - with no token the caller is treated as Public. May instead be supplied as an Authorization: Bearer <JWT> header, which overrides this parameter.

IdToken
string

Cognito id token. Only consulted during token verification, which itself only runs when an AccessToken is also supplied. When an IdToken is present it becomes the verified credential: the id token is the one whose signature is checked, and the access token is NOT verified on that path.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider - omitting it then is a 401. Ignored for every other caller.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

/networkoperatorconsole/shoppingcart/listVenueUnits

List a venue's units for self-service shopping cart sign-up — identity, address, PSK policy and SMS code only. Read-only. No token required (anonymous sign-up is supported).

Always returns the cut-down cart projection, for every caller — unlike the sibling /venues/listVenueUnits, an admin token does not get the richer projection here.

Filtering by role: Public and Subscriber callers have cart-disabled and occupied units filtered out (a Subscriber's own units are always kept); NetworkSoftwareProvider (must send OperatorID), NetworkOperator and Venue callers see everything unfiltered. globalroaming and secondary units are always excluded.

Resolving the venue: VenueID directly, or derived from externalVenueID (not for Public) or UnitID_internal (narrows to one unit). No resolvable venue is a 400.

An unowned or cart-disabled venue is not an error — 200 with no VenueUnits key.

api-version gate: StrictPSK requires api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

Authorizations:
CognitoAuthorizer
header Parameters
Authorization
string

Bearer <JWT> Cognito access token. When present the endpoint splits on the space and uses the second segment, overwriting any AccessToken supplied elsewhere in the request.

api-version
string
Example: 20260417

Feature gate. Send 20260417 or higher to receive StrictPSK on each unit. Parsed with parseInt and compared numerically, so a non-numeric value is treated as 0. Below the threshold the endpoint also appends an advisory sentence to message. After 2026-11-17 the gated field is returned unconditionally.

Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT, as an alternative to the Authorization header. Optional: with no token at all the caller resolves to the Public role rather than being rejected.

IdToken
string

Cognito id token. Read only by the shared token validator, which runs only when an access token is also supplied; when present the id token is verified instead of the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
string

The venue whose units are listed. Required unless externalVenueID or UnitID_internal resolves it; if neither does, the request is rejected with 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

The operator's own venue identifier, used to resolve VenueID when it is not supplied directly. Ignored for a Public caller. A lookup that finds no match is not an error - it simply leaves VenueID unresolved, which then produces the 400.

UnitID_internal
string

Narrows the result to this one unit, and resolves VenueID when it was not supplied. If the lookup returns a row set that does not narrow to exactly one unit, the request is rejected with 400. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor}, with each of the last three trimmed to 20 characters, reduced to [A-Za-z0-9_-] and upper-cased.

externalVenueUnitID
string

Accepted and IGNORED on this resource: the external-unit resolver that reads it runs only on /venues/listVenueUnits and /venues/listVenueUnitDetails. Sending it has no effect on the venue resolved or the units returned. Use UnitID_internal to narrow the result here.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "externalVenueID": "string",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string"
}

Response samples

Content type
application/json
{
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 0,
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/listVenueUnits (GET)

List a venue's units for self-service shopping cart sign-up — identity, address, PSK policy and SMS code only. Read-only. No token required (anonymous sign-up is supported).

Always returns the cut-down cart projection, for every caller — unlike the sibling /venues/listVenueUnits, an admin token does not get the richer projection here.

Filtering by role: Public and Subscriber callers have cart-disabled and occupied units filtered out (a Subscriber's own units are always kept); NetworkSoftwareProvider (must send OperatorID), NetworkOperator and Venue callers see everything unfiltered. globalroaming and secondary units are always excluded.

Resolving the venue: VenueID directly, or derived from externalVenueID (not for Public) or UnitID_internal (narrows to one unit). No resolvable venue is a 400.

An unowned or cart-disabled venue is not an error — 200 with no VenueUnits key.

api-version gate: StrictPSK requires api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT, as an alternative to the Authorization header. Optional: with no token at all the caller resolves to the Public role rather than being rejected.

IdToken
string

Cognito id token. Read only by the shared token validator, which runs only when an access token is also supplied; when present the id token is verified instead of the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
string

The venue whose units are listed. Required unless externalVenueID or UnitID_internal resolves it; if neither does, the request is rejected with 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

The operator's own venue identifier, used to resolve VenueID when it is not supplied directly. Ignored for a Public caller. A lookup that finds no match is not an error - it simply leaves VenueID unresolved, which then produces the 400.

UnitID_internal
string

Narrows the result to this one unit, and resolves VenueID when it was not supplied. If the lookup returns a row set that does not narrow to exactly one unit, the request is rejected with 400. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor}, with each of the last three trimmed to 20 characters, reduced to [A-Za-z0-9_-] and upper-cased.

externalVenueUnitID
string

Accepted and IGNORED on this resource: the external-unit resolver that reads it runs only on /venues/listVenueUnits and /venues/listVenueUnitDetails. Sending it has no effect on the venue resolved or the units returned. Use UnitID_internal to narrow the result here.

header Parameters
Authorization
string

Bearer <JWT> Cognito access token. When present the endpoint splits on the space and uses the second segment, overwriting any AccessToken supplied elsewhere in the request.

api-version
string
Example: 20260417

Feature gate. Send 20260417 or higher to receive StrictPSK on each unit. Parsed with parseInt and compared numerically, so a non-numeric value is treated as 0. Below the threshold the endpoint also appends an advisory sentence to message. After 2026-11-17 the gated field is returned unconditionally.

Responses

Response samples

Content type
application/json
{
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 0,
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/addSubscriptionPayment Deprecated

Not implemented — do not use. The route is live and fully authenticated, but the operation behind it is an empty stub: it reads nothing from the request, writes nothing, and returns HTTP 200 with a body of exactly {"errorProcessing": false}. Because the status is 200, the failure is silent.

To take payment for a subscription, use the Stripe SetupIntent flow: call /networkoperatorconsole/shoppingcart/requestSubscription to create the subscription and obtain the SetupIntent, then /networkoperatorconsole/shoppingcart/approveSubscriptionSetup to confirm it. Capture itself is driven by Stripe's webhook, not by an operator-console call.

To refund, use /networkoperatorconsole/subscribers/refundPayment.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token. Absent rejects with HTTP 401 and message 'AccessToken missing from request'. The operator scope (OperatorID) is NOT taken from the token: it is resolved from the request Origin header, which request validation.validateUIDomain records and getCognitoData maps to the operator record. The token supplies only the AdministrativeAccess arrays, which are checked against that OperatorID.

Format: a Cognito JWT access token string. The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the resolved OperatorID, otherwise HTTP 401 'Administrative Access denied (2). ' (message, statusCode). AccessToken is the ONLY field with any effect: never dereferences its event parameter, so no other property of the body is read anywhere on this path.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<cognito-access-token>"
}

Response samples

Content type
application/json
{
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/listSubscriptions

List the calling operator's subscriptions, with filters and optional pagination.

Requires one of NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the resolved operator.

Two response modes: by default, the full filtered list is returned (up to 2000 rows — beyond that, Subscriptions is emptied and a message explains the cap, with Subscriptions_csv holding the CSV instead). Sending Limit or nextToken switches to pagination: SubscriptionCount becomes the page size, TotalCount the full total, page size defaults to 250 and is clamped to 1000.

Filters: EmailAddress/PhoneNumber.E164/externalSubscriberID are resolved to a SubscriberToken first (no GSI on these fields) — an identifier that resolves to nothing yields an empty result set rather than an error.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT for an operator staff member. Presence checked; verified at token validation.

SubscriberToken
string

Filter by subscriber. Takes precedence over EmailAddress/PhoneNumber.E164/externalSubscriberID, which are otherwise resolved to a token.

EmailAddress
string

Filter by subscriber email; lower-cased before use. Resolved to a SubscriberToken via the Cognito-backed resolver.

PhoneNumber.E164
string

Filter by subscriber phone; resolved to a SubscriberToken. Copied onto the request's PhoneNumber for the resolver when that field is absent.

externalSubscriberID
string

Filter by the operator's own subscriber id; resolved to a SubscriberToken.

externalSubscriptionID
string

Filter by external subscription id.

StripeCustomerID
string

Filter by Stripe customer id.

UnitID_internal
string

Filter by venue unit; drives an indexed query.

externalVenueUnitID
string

Filter by external venue-unit id.

VenueID
string

Filter by venue. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (documented; a worked value appears).

externalVenueID
string

Filter by external venue id.

ServicePlanID
string

Filter by service plan.

externalServicePlanID
string

Filter by external service plan id.

AccountStatusAtCreation
string

Filter by the account status recorded when the subscription was created.

boolean or string

Filter on the payment-failed flag. Matched with strict === against both the boolean and the string form, i.e. true/"true" and false/"false"; any other value selects neither filter.

boolean or string

Restrict to pending subscriptions. Enabled only when the value is truthy AND strictly equals true or the string "true".

MaxViewWindowDateUTC.ISO8601
string

Upper bound of the view window; passed to new Date(...) and only applied when it parses to a valid date.

MinViewWindowDateUTC.ISO8601
string

Lower bound of the view window.

integer or string

Page size. Supplying it (any value that is not undefined/null/'') switches the response into paginated mode. Validated as an integer and clamped to 1000; default page size is 250.

nextToken
string

Opaque cursor from a previous page - base64url of {v:1, o:}. Supplying it also switches on paginated mode.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "string",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "externalSubscriptionID": "string",
  • "StripeCustomerID": "string",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string",
  • "VenueID": "string",
  • "externalVenueID": "string",
  • "ServicePlanID": "string",
  • "externalServicePlanID": "string",
  • "AccountStatusAtCreation": "string",
  • "paymentFailed": true,
  • "onlyDisplayPendingSubscriptions": true,
  • "MaxViewWindowDateUTC.ISO8601": "string",
  • "MinViewWindowDateUTC.ISO8601": "string",
  • "Limit": 1,
  • "nextToken": "string"
}

Response samples

Content type
application/json
{
  • "SubscriptionCount": 0,
  • "Subscriptions": [
    ],
  • "Subscriptions_csv": [
    ],
  • "TotalCount": 0,
  • "nextToken": "string",
  • "MaxViewWindowDateUTC.ISO8601": "string",
  • "MinViewWindowDateUTC.ISO8601": "string",
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/listStripePayments

Despite the name, this does not fetch live Stripe transactions — it lists stored invoice records; Stripe fields (StripeCustomerID, etc.) come from the database, not a live call. The one exception: a best-effort per-row Stripe lookup back-fills a missing receipt URL when a stored row has a charge id but none.

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), or Subscriber (always scoped to their own token). No anonymous access.

Date window: defaults to the last 2 years when no lower bound is sent.

Size guard: beyond 2000 matching rows, Payments is emptied and message explains why; PaymentCount becomes 0.

Authorizations:
CognitoAuthorizer
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first) and supplies the OperatorID that scopes every result, the Cognito pool used to verify the token, and any source-IP whitelist. Missing origin is 401 'origin missing. '; an origin resolving to no operator is 401 'Operator not found. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) message catalogue, anything else US English. Affects rejection text only - no field in the success body is localized.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT access token. Mandatory unless supplied through the Authorization header, which overrides it. Verified only when the operator record carries a Cognito pool.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token and its preferred_username (or its email resolved through the operator's email cache) identifies the caller.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller, which is rejected 401 'OperatorID Missing. ' without it. It then becomes the operator every result is scoped to, and is deleted from the request before filtering. Ignored for every other caller.

VenueID
string

Two jobs at once: it is the value the Venue role check matches against, AND a result filter (rows whose VenueID differs are dropped). A caller whose only role is venue-level must send it. When it is the only identifier given, it also selects the VenueID index as the query source. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Selects the SubscriberToken index and filters the result. Overwritten with the caller's own token when the caller is classified Subscriber.

EmailAddress
string

Lower-cased and resolved to a SubscriberToken; on success the raw email is dropped from the in-memory filters (invoice rows may not carry it). If it resolves to nothing, the result is empty. Resolution is attempted only when no SubscriberToken was supplied; when one was, the email stays on as an additional exact-match filter against each invoice row's EmailAddress attribute, which many rows do not carry - so that combination can return an empty result.

PhoneNumber.E164
string

Subscriber phone number. For an operator-level or venue-level caller it is also copied to the un-dotted PhoneNumber field the cache resolver reads, and matched against the phone cache verbatim (no normalisation). Resolution is attempted only when no SubscriberToken was supplied; if it resolves to nothing the result is empty, and when a SubscriberToken was supplied this value stays on as an additional exact-match filter instead.

externalSubscriberID
string

The operator's own subscriber identifier, resolved to a SubscriberToken. Resolution is attempted only when no SubscriberToken was supplied; if it resolves to nothing the result is empty, and when a SubscriberToken was supplied this value stays on as an additional exact-match filter instead.

StripeCustomerID
string

Filters the result and, when no subscriber identifier resolved, selects the Stripe-customer index as the query source.

externalSubscriptionID
string

In-memory filter only; matched exactly against the invoice record's attribute of the same name.

externalVenueID
string

In-memory filter only; matched exactly.

UnitID_internal
string

In-memory filter only; matched exactly.

externalVenueUnitID
string

In-memory filter only; matched exactly.

ServicePlanID
string

In-memory filter only; matched exactly.

externalServicePlanID
string

In-memory filter only; matched exactly.

MinInvoiceDateTimeUTC.ISO8601
string <date-time>

Lower bound on the invoice date, inclusive of equal values (rows strictly earlier are dropped). Takes precedence over MinStartDateTimeUTC.ISO8601. When neither is sent the bound defaults to two years before the request. A value that does not parse to a real date disables the lower bound entirely rather than erroring.

MaxInvoiceDateTimeUTC.ISO8601
string <date-time>

Upper bound on the invoice date, inclusive of equal values. Takes precedence over MaxStartDateTimeUTC.ISO8601. Absent means no upper bound.

MinStartDateTimeUTC.ISO8601
string <date-time>

Fallback lower bound, used only when MinInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is applied to the invoice date, not to any subscription start date.

MaxStartDateTimeUTC.ISO8601
string <date-time>

Fallback upper bound, used only when MaxInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is applied to the invoice date.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "StripeCustomerID": "string",
  • "externalSubscriptionID": "string",
  • "externalVenueID": "string",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string",
  • "ServicePlanID": "string",
  • "externalServicePlanID": "string",
  • "MinInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MinStartDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxStartDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "PaymentCount": 1,
  • "NonZeroPaymentCount": 1,
  • "Payments": [
    ],
  • "BillingCycleHours": 720,
  • "DownloadKbps": 100000,
  • "UploadKbps": 100000,
  • "PricePerDownloadGbps.USD": 4,
  • "VenuePriceAdjustment": 0,
  • "VenueUnitPriceAdjustment": 0,
  • "ListBillingCyclePrice.USD": 4999,
  • "NetBillingCyclePrice.USD": 4999,
  • "MinInvoiceDateTimeUTC.ISO8601": "2024-08-20T00:00:00.000Z",
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/listPayments

Returns invoice/payment history as a Payments array plus record counts. Read-only, aside from a best-effort receipt-URL lookup for rows missing one.

Who may call it: an access token is mandatory (no anonymous access). Classified in order: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), or Subscriber — whichever the token matches first.

Scope: a Subscriber caller (including a staff token that doesn't match its intended role) always sees only their own history; a Venue caller is confined to the VenueID it sent, even if a subscriber token from another venue is supplied.

Date window: defaults to the last 2 years when no lower bound is sent.

Size guard: beyond 2000 matching rows, Payments is emptied and message explains why; PaymentCount becomes 0.

Authorizations:
CognitoAuthorizer
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first) and supplies the OperatorID that scopes every result, the Cognito pool used to verify the token, and any source-IP whitelist. Missing origin is 401 'origin missing. '; an origin resolving to no operator is 401 'Operator not found. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) message catalogue, anything else US English. Affects rejection text only - no field in the success body is localized.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT access token. Mandatory unless supplied through the Authorization header, which overrides it. Verified only when the operator record carries a Cognito pool.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token and its preferred_username (or its email resolved through the operator's email cache) identifies the caller.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller, which is rejected 401 'OperatorID Missing. ' without it. It then becomes the operator every result is scoped to, and is deleted from the request before filtering. Ignored for every other caller.

VenueID
string

Two jobs at once: it is the value the Venue role check matches against, AND a result filter (rows whose VenueID differs are dropped). A caller whose only role is venue-level must send it. When it is the only identifier given, it also selects the VenueID index as the query source. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Selects the SubscriberToken index and filters the result. Overwritten with the caller's own token when the caller is classified Subscriber.

EmailAddress
string

Lower-cased and resolved to a SubscriberToken; on success the raw email is dropped from the in-memory filters (invoice rows may not carry it). If it resolves to nothing, the result is empty. Resolution is attempted only when no SubscriberToken was supplied; when one was, the email stays on as an additional exact-match filter against each invoice row's EmailAddress attribute, which many rows do not carry - so that combination can return an empty result.

PhoneNumber.E164
string

Subscriber phone number. For an operator-level or venue-level caller it is also copied to the un-dotted PhoneNumber field the cache resolver reads, and matched against the phone cache verbatim (no normalisation). Resolution is attempted only when no SubscriberToken was supplied; if it resolves to nothing the result is empty, and when a SubscriberToken was supplied this value stays on as an additional exact-match filter instead.

externalSubscriberID
string

The operator's own subscriber identifier, resolved to a SubscriberToken. Resolution is attempted only when no SubscriberToken was supplied; if it resolves to nothing the result is empty, and when a SubscriberToken was supplied this value stays on as an additional exact-match filter instead.

StripeCustomerID
string

Filters the result and, when no subscriber identifier resolved, selects the Stripe-customer index as the query source.

externalSubscriptionID
string

In-memory filter only; matched exactly against the invoice record's attribute of the same name.

externalVenueID
string

In-memory filter only; matched exactly.

UnitID_internal
string

In-memory filter only; matched exactly.

externalVenueUnitID
string

In-memory filter only; matched exactly.

ServicePlanID
string

In-memory filter only; matched exactly.

externalServicePlanID
string

In-memory filter only; matched exactly.

MinInvoiceDateTimeUTC.ISO8601
string <date-time>

Lower bound on the invoice date, inclusive of equal values (rows strictly earlier are dropped). Takes precedence over MinStartDateTimeUTC.ISO8601. When neither is sent the bound defaults to two years before the request. A value that does not parse to a real date disables the lower bound entirely rather than erroring.

MaxInvoiceDateTimeUTC.ISO8601
string <date-time>

Upper bound on the invoice date, inclusive of equal values. Takes precedence over MaxStartDateTimeUTC.ISO8601. Absent means no upper bound.

MinStartDateTimeUTC.ISO8601
string <date-time>

Fallback lower bound, used only when MinInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is applied to the invoice date, not to any subscription start date.

MaxStartDateTimeUTC.ISO8601
string <date-time>

Fallback upper bound, used only when MaxInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is applied to the invoice date.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "StripeCustomerID": "string",
  • "externalSubscriptionID": "string",
  • "externalVenueID": "string",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string",
  • "ServicePlanID": "string",
  • "externalServicePlanID": "string",
  • "MinInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MinStartDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxStartDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "PaymentCount": 1,
  • "NonZeroPaymentCount": 1,
  • "Payments": [
    ],
  • "BillingCycleHours": 720,
  • "DownloadKbps": 100000,
  • "UploadKbps": 100000,
  • "PricePerDownloadGbps.USD": 4,
  • "VenuePriceAdjustment": 0,
  • "VenueUnitPriceAdjustment": 0,
  • "ListBillingCyclePrice.USD": 4999,
  • "NetBillingCyclePrice.USD": 4999,
  • "MinInvoiceDateTimeUTC.ISO8601": "2024-08-20T00:00:00.000Z",
  • "errorProcessing": false
}

/networkoperatorconsole/shoppingcart/getStripeReceiptURL

Returns the Stripe-hosted receipt URL recorded on a subscription row — a single indexed read; Stripe itself is never contacted. A receipt that exists at Stripe but was never written back here reads as an empty string.

No AccessToken — one of a handful of shopping-cart resources that identifies the operator from the request Origin alone.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
StripeClientSecret
required
string

The Stripe client secret stored on the subscription record. Presence is a bare truthiness check, so an empty string, 0 or false are all rejected as missing. The lookup is scoped to the caller's operator.

Responses

Request samples

Content type
application/json
{
  • "StripeClientSecret": "string"
}

Response samples

Content type
application/json
{
  • "StripeReceiptURL": "string",
  • "errorProcessing": false,
  • "SupportedLocales": {
    }
}

/operatorconsole/config/listDisplayOptions

Returns the operator's display-option (branding/theme) profiles.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Public — EVERY other caller, including a completely unauthenticated one. No token is required to call this endpoint. A Public caller must supply DisplayOptionID.

GET reads the query string (merged over the body); its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoAuthNone
header Parameters
Authorization
string

Optional Bearer <jwt> header. takes split(' ')[1] and writes it over the request's AccessToken, so it overrides an AccessToken sent in the body.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT access token, read. Absent/empty means Public, NOT an error. An Authorization: Bearer header overrides whatever is sent here.

OperatorID
string

Target operator, read ONLY on the NetworkSoftwareProvider branch where it is mandatory (401 'OperatorID Missing. ' otherwise) and is deleted from the body once copied to Operator.OperatorID. Ignored for other roles. Built as {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

DisplayOptionID
string

REQUIRED for a Public (unauthenticated) caller - returns 401 'Missing DisplayOptionID. ' without it. Also acts as an exact-match filter, but only when DisplayOptionName was not supplied.

DisplayOptionName
string

Exact-match filter on the item's DisplayOptionName. Evaluated BEFORE DisplayOptionID, so it takes precedence as the filter.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "DisplayOptionID": "string",
  • "DisplayOptionName": "string"
}

Response samples

Content type
application/json
{
  • "DisplayOptions": [
    ],
  • "SupportedLocales": {
    },
  • "message": "",
  • "errorProcessing": true
}

Venues

🏢 Venue Management & Administration

Comprehensive venue management system for property owners, managers, and network operators to oversee venue operations and subscriber services.

Venue Administration

  • 🏗️ Property Setup: Create and configure new venue properties
  • 📋 Unit Management: Building units, floor plans, and occupancy tracking
  • ⚙️ Service Configuration: Available plans, pricing, and service parameters
  • 👥 Staff Management: Venue administrator assignments and permissions
  • 📊 Operations Dashboard: Real-time venue metrics and performance monitoring
  • 🔧 Equipment Management: CPE deployment, monitoring, and maintenance

Multi-Level Management

  • 🏢 Portfolio View: Multi-venue management for property management companies
  • 📈 Analytics Suite: Revenue tracking, occupancy rates, and service adoption
  • 🎯 Marketing Tools: Service promotions, resident communications, and campaigns
  • ⚙️ Integration Hub: Property management system integration and data sync

/venuemgmtconsole/venues/listVenues (GET)

List the operator's venues, role-filtered, from the operator's cached venue list. The operator is resolved from Origin.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue), NetworkOperator (sees every venue), Venue admin/leasing agent (filtered to their own VenueIDs — admin takes precedence when a token holds both), or Public (sees venues only when the operator's shopping cart is enabled) — INCLUDING a request with no access token at all.

Trimmed per venue: internal config sections, Stripe adjustments, dateAddedUTC are removed; a DailyReport is added. A caller whose token carries no SubscriberToken additionally loses externalVenueID, ShoppingCart and DailyReport on any cart-enabled venue.

Read-only.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT, as an alternative to the Authorization header. Optional: with no token at all the caller is resolved as Public rather than rejected.

IdToken
string

Cognito id token. Read only by the shared token validator, which runs only when an access token is also supplied; when present the id token is verified instead of the access token and the username comes from its preferred_username claim or from an email lookup.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller - its absence for such a caller is a 401. Ignored for every other caller.

header Parameters
Authorization
string

Bearer <JWT> Cognito access token. When present the endpoint splits on the space and uses the second segment, overwriting any AccessToken query parameter.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

/venuemgmtconsole/venues/listVenueDetails (GET)

Return the full detail record for one venue: configuration, units, non-expired subscriptions, keypools, core equipment and available service plans. The venue comes back under a key named after its VenueID — read the response as body[VenueID].

What each role gets:

  • NetworkSoftwareProvider (must send OperatorID) and NetworkOperator get the full record; only NetworkOperator sees the clear-text equipment Password.
  • Venue admin/leasing agent gets a reduced record: several fields removed, ShoppingCart.Stripe reduced to just the publishable key, equipment MACAddress/Password withheld.
  • Subscriber gets no venue payload — just message/errorProcessing.
  • Public gets VenueUnits/VenueUnitCount instead of the venue object — the venue's cart-eligible, unoccupied units in a cut-down projection; skipped entirely if the venue's shopping cart is disabled.

Resolving the venue: VenueID directly, or (non-Public callers) derived from externalVenueID. No resolvable venue is a 400.

An unowned venue is not an error — 200 with no venue key.

api-version gate: several fields (VenueUnitSSID, StrictPSK, equipment UnitID_internal/MACAddress) require api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

GET form: parameters come from the query string; responses add Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT, as an alternative to the Authorization header. Optional: with no token at all the caller resolves to the Public role rather than being rejected, and receives a unit list instead of the venue record.

IdToken
string

Cognito id token. Read only by the shared token validator, which runs only when an access token is also supplied; when present the id token is verified instead of the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
string

The venue to describe. Required unless externalVenueID resolves it; if neither does, the request is rejected with 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

The operator's own venue identifier, used to resolve VenueID when it is not supplied directly. Ignored for a Public caller. A lookup that finds no match is not an error - it simply leaves VenueID unresolved, which then produces the 400.

UnitID_internal
string

Narrows the unit set the detail record is built from to this one unit; the venue's subscription, keypool and equipment sections are unaffected. On this resource an unmatched value is NOT an error.

header Parameters
Authorization
string

Bearer <JWT> Cognito access token. When present the endpoint splits on the space and uses the second segment, overwriting any AccessToken query parameter.

api-version
string
Example: 20260417

Feature gate. Send 20260417 or higher to receive NetworkConfiguration.VenueUnitSSID, the per-unit and venue-level StrictPSK, and the equipment UnitID_internal / MACAddress fields. Parsed with parseInt and compared numerically, so a non-numeric value is treated as 0. Below the threshold the endpoint also appends an advisory sentence to message. After 2026-11-17 the gated fields are returned unconditionally.

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": false,
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 0,
  • "property1": {
    },
  • "property2": {
    }
}

/venuemgmtconsole/venues/listVenueLog (GET)

Audit/event log documents for ONE venue from the operator's OpenSearch log indices. VenueID is REQUIRED (401 'VenueID Missing. ' without it) and every query is additionally filtered on it.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, or Venue admin/leasing agent for the requested VenueID. ⚠ A caller who resolves only to the Subscriber category (no operator/venue role) does NOT match this route at all and gets a 500, not a 401.

Filtering: searchText runs a fuzzy match; a whitelist of 13 fields is available, or raw OpenSearch customQuery (replaces the whitelist). Results are newest-first, paged via searchBefore. Administrator values are expanded to a display form; event is always an object.

GET reads the query string (merged over the body); its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token. Absent/empty in both the request and the Authorization header is 401 'AccessToken Missing. '. It is verified only when the operator record resolved from the request Origin carries a Cognito pool; when it does not, the token is never validated, the caller lands in no access category, and the request is refused 401 'Access Denied. '.

IdToken
string

Optional Cognito ID token. Used by the shared token validator only when the access token's username is not already cached: the ID token is then verified instead, and its preferred_username (or its email, resolved through the operator's email index) becomes the caller identity.

OperatorID
string
Example: OperatorID={Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing is 401 'OperatorID Missing. '); it becomes the OperatorID every log query is filtered on and is then removed from the request. Ignored for every other caller, whose operator comes from the request Origin.

VenueID
required
string

REQUIRED. The venue whose logs are returned; a missing or empty value is 401 'VenueID Missing. '.

It has two further effects: it is the value matched against a Venue-role caller's VenueAdministrator/LeasingAgent arrays, and because VenueID is also a whitelisted filter field it is applied as a term filter twice (harmlessly). Composite Vault VenueID, {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

MinViewWindowDateUTC.ISO8601
string
Example: MinViewWindowDateUTC.ISO8601=2026-08-01T00:00:00.000Z

Window start, parsed with the JavaScript Date constructor. DEFAULT: none - when it is omitted NO lower bound is applied at all and the query spans every monthly log index. Supplying it also switches the hit counter to exact mode; without it totalCount is capped (see the 200 response). An unparseable value is 400.

MaxViewWindowDateUTC.ISO8601
string
Example: MaxViewWindowDateUTC.ISO8601=2026-08-19T23:59:59.000Z

Window end, parsed with the JavaScript Date constructor. DEFAULT: now + 60 seconds - the extra minute compensates for OpenSearch Serverless near-real-time indexing lag. An unparseable value is 400.

pageSize
integer
Example: pageSize=250

Page size. DEFAULT 250 when omitted or when the value is falsy (the JSON number 0 and an empty string are falsy and therefore fall back to 250). Any other value is parsed as an integer and clamped to a maximum of 500 by the shared OpenSearch service. Note that the string "0" IS truthy: it yields a zero-size query, an empty log array and hasMore true. A non-numeric value yields NaN and the query fails as a 500.

searchBefore
string

Pagination cursor echoed by a previous response. The cursor is an ARRAY of sort values, which a query string cannot express, so a GET cannot page beyond the first page - use the POST form for pagination.

searchText
string
Example: searchText=authentication failed

Full-text search added as a multi_match (best_fields, operator 'and', fuzziness 'AUTO') across event, function_name, Administrator, SourceIP, SubscriberToken and LogType. It is ANDed with every other filter, INCLUDING a customQuery.

customQuery
string

Not usable on GET. The endpoint only honours customQuery when the received value is a JavaScript object; a query-string value is a string, so the query itself is never applied. Its presence is still detected, however, and it suppresses the whole exact-match filter whitelist, so every other filter field you sent (function_name, LogType, Administrator, SourceIP, SubscriberToken, EquipmentID, KeyPoolID, ServicePlanID and the rest) is dropped with no error, widening the search. The route's own scoping and the date window are unaffected. Use the POST form.

function_name
string

Name of the emitting function/route recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

LogType
string

Log severity/type recorded on the document (e.g. the value the emitter wrote). Filterable, but NOT among the fields projected back by this route. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

Administrator
string

The raw stored administrator identifier (username or email) as written by the emitter - match on the STORED value, not on the display string this route returns after enrichment. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

AdministratorOS
string

Operating system parsed from the emitting request's User-Agent. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

AdministratorBrowser
string

Browser parsed from the emitting request's User-Agent. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

SourceIP
string

Source IP recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

SourceLocale
string

Locale recorded on the log document ('en-us' or 'es-xl'). Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

SubscriberToken
string

SubscriberToken recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

UnitID_internal
string

UnitID_internal recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

EquipmentID
string

EquipmentID recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

KeyPoolID
string

KeyPoolID recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

ServicePlanID
string

ServicePlanID recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

header Parameters
Authorization
string

'Bearer '. When the header is present and non-empty the endpoint takes the substring after the first space and uses it as the AccessToken, OVERWRITING any AccessToken supplied in the request itself. A header with no space produces an empty token and is then treated as a missing one (401 'AccessToken Missing. ').

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else the English one. It affects rejection text only.

Responses

Response samples

Content type
application/json
{
  • "log": [
    ],
  • "currentCount": 250,
  • "totalCount": 10000,
  • "pageSize": 250,
  • "hasMore": true,
  • "searchBefore": [
    ],
  • "MinViewWindowDateUTC.ISO8601": "string",
  • "MaxViewWindowDateUTC.ISO8601": "string",
  • "allowedFilterFields": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/venuemgmtconsole/venue_units/listVenueUnitLog (GET)

Audit/event log documents for ONE venue unit from the operator's OpenSearch log indices. UnitID_internal is REQUIRED — omitting it doesn't hit a validation error, it matches no route branch and fails with 500.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, or Venue admin/leasing agent — a Venue-role caller must also send the VenueID it administers, applied as an extra filter.

Filtering: searchText fuzzy match, a whitelist of 13 fields, or raw OpenSearch customQuery (replaces the whitelist). Results newest-first, paged via searchBefore. Administrator values are expanded to a display form; event is always an object.

GET reads the query string (merged over the body); its response also adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token. Absent/empty in both the request and the Authorization header is 401 'AccessToken Missing. '. It is verified only when the operator record resolved from the request Origin carries a Cognito pool; when it does not, the token is never validated, the caller lands in no access category, and the request is refused 401 'Access Denied. '.

IdToken
string

Optional Cognito ID token. Used by the shared token validator only when the access token's username is not already cached: the ID token is then verified instead, and its preferred_username (or its email, resolved through the operator's email index) becomes the caller identity.

OperatorID
string
Example: OperatorID={Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing is 401 'OperatorID Missing. '); it becomes the OperatorID every log query is filtered on and is then removed from the request. Ignored for every other caller, whose operator comes from the request Origin.

UnitID_internal
required
string
Example: UnitID_internal={VenueID}.{UNIT}.{BUILDING}.{FLOOR}

REQUIRED. The unit whose logs are returned; it is part of the route's branch condition, so a request without it is answered 500, not 400/401. Applied as a term filter (twice, since UnitID_internal is also a whitelisted filter field).

Format: {VenueID}.{UNIT}.{BUILDING}.{FLOOR}, where the last three components are upper-cased, stripped of characters outside A-Z a-z 0-9 _ - and truncated to 20 characters when the unit is created.

VenueID
string

Required for a Venue-role caller: it is the value matched against the caller's VenueAdministrator/LeasingAgent arrays to grant that role, and it is then applied as an additional term filter so the caller sees only that venue's documents. Optional for NetworkSoftwareProvider and NetworkOperator callers, for whom it acts as an ordinary filter field. Composite Vault VenueID, {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

MinViewWindowDateUTC.ISO8601
string
Example: MinViewWindowDateUTC.ISO8601=2026-08-01T00:00:00.000Z

Window start, parsed with the JavaScript Date constructor. DEFAULT: none - when it is omitted NO lower bound is applied at all and the query spans every monthly log index. Supplying it also switches the hit counter to exact mode; without it totalCount is capped (see the 200 response). An unparseable value is 400.

MaxViewWindowDateUTC.ISO8601
string
Example: MaxViewWindowDateUTC.ISO8601=2026-08-19T23:59:59.000Z

Window end, parsed with the JavaScript Date constructor. DEFAULT: now + 60 seconds - the extra minute compensates for OpenSearch Serverless near-real-time indexing lag. An unparseable value is 400.

pageSize
integer
Example: pageSize=250

Page size. DEFAULT 250 when omitted or when the value is falsy (the JSON number 0 and an empty string are falsy and therefore fall back to 250). Any other value is parsed as an integer and clamped to a maximum of 500 by the shared OpenSearch service. Note that the string "0" IS truthy: it yields a zero-size query, an empty log array and hasMore true. A non-numeric value yields NaN and the query fails as a 500.

searchBefore
string

Pagination cursor echoed by a previous response. The cursor is an ARRAY of sort values, which a query string cannot express, so a GET cannot page beyond the first page - use the POST form for pagination.

searchText
string
Example: searchText=authentication failed

Full-text search added as a multi_match (best_fields, operator 'and', fuzziness 'AUTO') across event, function_name, Administrator, SourceIP, SubscriberToken and LogType. It is ANDed with every other filter, INCLUDING a customQuery.

customQuery
string

Not usable on GET. The endpoint only honours customQuery when the received value is a JavaScript object; a query-string value is a string, so the query itself is never applied. Its presence is still detected, however, and it suppresses the whole exact-match filter whitelist, so every other filter field you sent (function_name, LogType, Administrator, SourceIP, SubscriberToken, EquipmentID, KeyPoolID, ServicePlanID and the rest) is dropped with no error, widening the search. The route's own scoping and the date window are unaffected. Use the POST form.

function_name
string

Name of the emitting function/route recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

LogType
string

Log severity/type recorded on the document (e.g. the value the emitter wrote). Filterable, but NOT among the fields projected back by this route. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

Administrator
string

The raw stored administrator identifier (username or email) as written by the emitter - match on the STORED value, not on the display string this route returns after enrichment. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

AdministratorOS
string

Operating system parsed from the emitting request's User-Agent. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

AdministratorBrowser
string

Browser parsed from the emitting request's User-Agent. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

SourceIP
string

Source IP recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

SourceLocale
string

Locale recorded on the log document ('en-us' or 'es-xl'). Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

SubscriberToken
string

SubscriberToken recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

EquipmentID
string

EquipmentID recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

KeyPoolID
string

KeyPoolID recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

ServicePlanID
string

ServicePlanID recorded on the log document. Exact-match term filter. On GET only a single value can be expressed, so the filter is always a one-value exact match.

header Parameters
Authorization
string

'Bearer '. When the header is present and non-empty the endpoint takes the substring after the first space and uses it as the AccessToken, OVERWRITING any AccessToken supplied in the request itself. A header with no space produces an empty token and is then treated as a missing one (401 'AccessToken Missing. ').

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else the English one. It affects rejection text only.

Responses

Response samples

Content type
application/json
{
  • "log": [
    ],
  • "currentCount": 250,
  • "totalCount": 10000,
  • "pageSize": 250,
  • "hasMore": true,
  • "searchBefore": [
    ],
  • "MinViewWindowDateUTC.ISO8601": "string",
  • "MaxViewWindowDateUTC.ISO8601": "string",
  • "allowedFilterFields": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/venues/listVenues

List the operator's venues, role-filtered, from the operator's cached venue list. The operator is resolved from Origin.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue), NetworkOperator (sees every venue), Venue admin/leasing agent (filtered to their own VenueIDs), or Public (sees venues only when the operator's shopping cart is enabled).

Trimmed per venue: internal config sections, Stripe credentials, dateAddedUTC are removed; a DailyReport summary is added. A caller whose token carries no SubscriberToken (NSP, or Public) additionally loses externalVenueID, ShoppingCart and DailyReport.

A venue's ShoppingCart.enableShoppingCart/DisplayOptionID value of the literal Inherit is replaced with the operator's own value before the venue is returned.

Read-only.

Authorizations:
CognitoAuthNone
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first) and supplies the OperatorID whose venue cache is read, the Cognito pool used to verify the token, and any source-IP whitelist. Missing gives 401 'origin missing. '; an origin resolving to no operator gives 401 'Operator not found. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. It affects only the one rejection message this endpoint raises itself ('OperatorID Missing. '); the shared validation literals are English whatever is sent.

Request Body schema: application/json
optional

JSON object. A body is not required: with no access token the caller is simply treated as Public. If a body IS sent it must be valid JSON - a non-empty body that does not parse is rejected 401 with 'Malformed JSON in input. '.

AccessToken
string

Cognito access-token JWT. Optional; absent means the caller is Public. May instead be supplied as an Authorization: Bearer <JWT> header, which overrides this property. When it is present the token verifier runs, but the JWT itself is only cryptographically verified when the resolved operator record carries both a Cognito pool and an app-client id; without those no username is resolved and the caller falls through to Public.

IdToken
string

Cognito id token. When supplied, the verifier validates it instead of the access token and identifies the caller from its preferred_username, or from its email resolved through the operator's email cache. It is also checked against the global sign-out marker.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller, whose request is rejected 401 'OperatorID Missing. ' without it; it is then deleted from the body once consumed. Ignored for every other caller.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

/networkoperatorconsole/venues/listVenues (GET)

List the operator's venues, role-filtered, from the operator's cached venue list (no live DB read). The operator is resolved from the Origin header.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue), NetworkOperator (sees every venue), Venue admin/leasing agent (filtered to their own VenueIDs), or Public — INCLUDING a request with no access token, which is not rejected. A Public caller sees venues only when the operator's shopping cart is enabled, filtered to venues with it enabled themselves.

Trimmed per venue: internal config sections, Stripe credentials, dateAddedUTC are removed; a DailyReport summary is added. A caller whose token carries no SubscriberToken (no token at all, or NSP) additionally loses externalVenueID, ShoppingCart and DailyReport.

Read-only. GET reads the query string (merged after the body) and adds Cache-Control: private, max-age=5. /networkoperatorconsole/shoppingcart/listVenues is an exact alias — same implementation and output.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT. Optional - with no token the caller is treated as Public. May instead be supplied as an Authorization: Bearer <JWT> header, which overrides this parameter.

IdToken
string

Cognito id token. Only consulted during token verification, which itself only runs when an AccessToken is also supplied; when present the id token is verified INSTEAD of the access token, whose own signature is then not checked.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider - omitting it then is a 401. Ignored for every other caller.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

/networkoperatorconsole/venues/addVenue

Creates a venue (property) under the caller's operator, and applies any venue-configuration properties sent in the same body to the new venue.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator of the operator. AccountManager, CustomerSupport and all venue-level/subscriber roles are NOT accepted here. The access token must be in the body — no Authorization header support.

Identifiers are derived, not accepted. VenueID is built from the property management group, country, state, postal code, venue name and city; the NAS-Identifier is derived from the same address components unless a longer one is supplied. Both must be unique — VenueID operator-wide, the NAS-Identifier system-wide across every operator.

On success: the new venue inherits default service plans, VLAN ranges, StrictPSK and notification settings from the operator; an audit entry is written, caches invalidated, a VenueAdded webhook fires if configured, and any other venue-configuration fields sent in the same body are applied immediately (only their message text is surfaced — a rejected field there does not fail the create).

Six missing-field checks, and both duplicate-detection paths, answer HTTP 200 with errorProcessing: true, not a 4xx.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required

JSON body. It is parsed by the legacy field-mapping step before the endpoint's own error handling starts, so a missing, empty or non-JSON body is not answered with a Vault error body on this operation.

AccessToken
required
string

Cognito access-token JWT. It MUST be sent in the body - this operation does not read an Authorization header. Absent or empty gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider; it names the operator to create the venue under and is then deleted from the forwarded body. Absent for that caller gives 401 'OperatorID Missing. '. Ignored for a DomainAdministrator caller.

VenueName
required
string

Display name. Absent or empty gives HTTP 200 with errorProcessing true and 'VenueName missing from request. '. It is stripped of markup and of characters outside letters, digits, dot, underscore, hyphen, ampersand and space, trimmed, and truncated to 40 characters; the first 20 characters of that result, further stripped to letters, digits, underscore and hyphen and upper-cased, become the VenueName_ID component of the VenueID.

AddressLine1
required
string

Street address. Absent or empty gives HTTP 200 with 'AddressLine1 missing from request. '. Sanitised and truncated to 40 characters.

AddressLine2
string

Optional suite/unit line, sanitised and truncated to 40 characters; stored as an empty string when not supplied.

City
required
string

Absent or empty gives HTTP 200 with 'City missing from request. '. Stripped of markup, trimmed and truncated to 40 characters; the first 10 characters of that, stripped to letters, digits, underscore and hyphen and upper-cased, become the City_ID component of the VenueID.

State
required
string

State or province. Absent or empty gives HTTP 200 with 'State missing from request. '. It is upper-cased and then matched against the country's state list by full name first and by abbreviation second; the ABBREVIATION is what gets stored and used in the VenueID. No match gives 401 'Invalid State for the selected country.'; a country with no state list gives 401 'No states found for ' followed by the country code.

Country
string

Country. Absent or empty gives HTTP 200 with 'Country missing from request. '. It is normalised to an ISO 3166 alpha-3 code, so send an ISO 3166 CODE - alpha-2, alpha-3 or numeric (for example US, USA or 840), matched case-insensitively. A country NAME is not accepted. A value that cannot be recognised is NOT reported as an error: the venue is not created, and the call still comes back as HTTP 200 with an empty message and errorProcessing false - confirm the venue exists rather than trusting the status.

Country.ISO3166A3
string

Alias: when present it is copied over Country before the required-field check runs.

PostalCode
required
string

Absent or empty gives HTTP 200 with 'PostalCode missing from request. '. Stripped of markup, trimmed and truncated to 10 characters; the first 10 characters of that, stripped to letters, digits, underscore and hyphen and upper-cased, become the PostalCode_ID component of the VenueID.

NAS-Identifier
string

Optional RADIUS NAS identifier. It is honoured only when the supplied value is LONGER than 7 characters; a value of 7 characters or fewer is discarded and one is generated from the address components instead. A honoured value is stripped to letters, digits, dot, underscore and hyphen, truncated to 253 characters and upper-cased. It must be unique across the ENTIRE system, not just this operator.

externalVenueID
string

The operator's own identifier for the venue. Stripped of markup and of characters outside letters, digits, dot, underscore, hyphen and space, trimmed and truncated to 64 characters; stored as null when not supplied.

NetworkConfiguration
object

Venue network settings applied by the venue-configure step that runs after creation. The legacy flat spellings of the six Minimum/MaximumAutoGeneratedVLAN_* fields and allowOverlappingSubscriptionWiredUnit are folded in here by the field mapping.

Notifications
object

Venue notification settings applied by the venue-configure step. The legacy flat spellings suppressSubscriberEmails, suppressSubscriberSMS, sendSubscriptionAddedEmail, sendSubscriptionEndEmail and WelcomeEmail_countdown_hours are folded in here by the field mapping.

ServicePlanConfiguration
object

Venue default plans (DefaultServicePlanID_LocalWirelessAccess, DefaultServicePlanID_GlobalWirelessPlusLocalWiredAccess, DefaultServicePlanID_Roaming), applied by the venue-configure step. Values not supplied are inherited from the operator record at creation time.

ShoppingCart
object

Venue shopping-cart settings (enableShoppingCart, TrialCycleAdjustment, ShoppingCartPriceAdjustment and a Stripe child), applied by the venue-configure step. The legacy flat spellings are folded in here by the field mapping.

Reporting
object

Venue reporting settings, applied by the venue-configure step; the legacy flat ReportingSubscriptionEnd_lookahead_hours is folded in here.

PMS
object

Property-management-system settings, applied by the venue-configure step. The legacy flat enableRealPageSync, RealPageSiteId and RealPage sync timestamp are folded in here by the field mapping.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueName": "Riverside Apartments",
  • "AddressLine1": "100 Main Street",
  • "AddressLine2": "Building B",
  • "City": "Springfield",
  • "State": "IL",
  • "Country": "USA",
  • "Country.ISO3166A3": "USA",
  • "PostalCode": "60601",
  • "NAS-Identifier": "string",
  • "externalVenueID": "string",
  • "NetworkConfiguration": { },
  • "Notifications": { },
  • "ServicePlanConfiguration": { },
  • "ShoppingCart": { },
  • "Reporting": { },
  • "PMS": { }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "VenueID": "string",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/venues/configureVenueEquipment

Updates the stored record of one piece of network equipment at a venue (VenueID + EquipmentID) — each changed property is appended to an audit narrative returned as message.

⚠ This same logic also serves /admin/deleteVenueEquipmentPermanently, and honors a delete: true request property on THIS route too.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token. Missing or empty rejects with HTTP 401 and message 'AccessToken Missing. '.

VenueID
required
string

Venue that owns the equipment. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. Missing sets errorProcessing=true with message 'VenueID missing from request. ' while the HTTP status stays 200. The value must match the VenueID stored on the equipment record, otherwise the lookup is treated as a miss and returns 404.

EquipmentID
required
string

The equipment record's partition key (its ID attribute). addVenueEquipment keeps a caller-supplied EquipmentID_internal verbatim when its length is >0 and <256, and only otherwise composes VenueID + '._V3EQUIPMENT.' + EquipmentID, writing that value as the row's ID - so the composed form is the DEFAULT, not a guaranteed format; use the id that listVenueEquipment returns. Missing sets errorProcessing=true with message 'EquipmentID missing from request. ' and HTTP status 200.

OperatorID
string

Required only for a Network Software Provider caller; missing rejects with HTTP 401 and 'OperatorID Missing. '. It is moved onto the request context and deleted from the body. Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

Manufacturer
string <= 40 characters

HTML-stripped, trimmed, truncated to 40 characters.

Case-insensitive substring normalisation is applied: a value containing 'riq' becomes 'RiQ', 'mikrotik' becomes 'MikroTik', 'nomadix' becomes 'Nomadix', 'peplink' becomes 'Peplink', 'altiplano' becomes 'Altiplano'. Any other value is stored as the sanitised string - this field is not an enum and no value is rejected. Changing it to one of those five recognised manufacturers also sets remove_gatewayConfigured, which nulls AllGatewaysConfigured and drops this equipment id from gatewaysConfigured on every active subscription at the venue.

Model
string <= 40 characters

HTML-stripped, trimmed, truncated to 40 characters.

MACAddress
string

EUI-48/EUI-64, with or without separators. Stored canonically as uppercase colon-separated. An unparseable value rejects the whole call with HTTP 401 and message 'Invalid MACAddress: ' + the trimmed supplied value + '. '.

UnitID_internal
string or null

Venue unit this equipment serves; format VenueID + '.' + UnitID + '.' + UnitBuilding + '.' + UnitFloor, each component uppercased and stripped to [A-Za-z0-9_-]. Explicit null detaches the equipment from its current unit. A supplied id must exist in venue store-units - absent gives HTTP 404 'Unit not found: ' + id + '. ' - and must be at the same venue, otherwise HTTP 401 'Unit ' + id + ' is not at venue ' + VenueID + '. '. Ids matching /-(TEMP|WIFI)-\d/ are auto-generated sub-units and are refused with HTTP 401 'Cannot attach equipment to auto-generated unit ' + id + '. '. Equipment whose (resulting) EquipmentType is Gateway or Wireless Controller cannot carry a unit at all: HTTP 401 ' equipment serves the whole venue and cannot be attached to unit ' + id + '. '.

EquipmentType
string
Enum: "Gateway" "Firewall" "OLT" "Wireless Controller" "Wi-Fi Access Point" "Switch" "CMTS" "Router" "SmartBox" "StreamBlade" "LAN Load Balancer" "Data Plane" "G.hn Headend" "WAN Load Balancer" "DSL" "Other"

The supplied value is HTML-stripped, trimmed and truncated to 30 characters, then matched case-insensitively. Besides the lower-cased canonical spellings listed in the enum, these aliases are accepted and stored in canonical form: 'wirelesscontroller' -> 'Wireless Controller'; 'wifi access point', 'wi-fiaccesspoint', 'wifiaccesspoint' -> 'Wi-Fi Access Point'; 'lanloadbalancer' -> 'LAN Load Balancer'; 'dataplane' -> 'Data Plane'; 'ghnheadend' -> 'G.hn Headend'; 'wanloadbalancer' -> 'WAN Load Balancer'. Anything else rejects with HTTP 401 and message 'Invalid EquipmentType: ' + value + '. Supported types are Gateway, Firewall, OLT, Wireless Controller, Wi-Fi Access Point, Switch, CMTS, Router, SmartBox, StreamBlade, LAN Load Balancer, Data Plane, G.hn Headend, WAN Load Balancer, DSL, Other.'. Setting it to Gateway when the venue already has 3 gateways rejects with HTTP 401 'Maximum of 3 gateways allowed per venue.'.

WirelessZone
string <= 40 characters

HTML-stripped, trimmed, truncated to 40 characters.

MikrotikPre643
boolean

Only accepted as a real boolean. When the equipment is a Gateway, a change also resets the gateway error counters.

ConnectionProtocol
string
Enum: "http" "https"

Any other value is silently ignored — there is no rejection branch.

IPAddress
string

IPv4 or IPv6, validated as an IP address. A value that fails validation is silently ignored, not rejected.

string or integer

Validated as a port on the string form; a failing value is silently ignored.

Username
string <= 64 characters

Device login. HTML-stripped, trimmed, truncated to 64 characters.

Password
string <password> <= 100 characters

Device password. HTML-stripped, trimmed, truncated to 100 characters. The audit narrative records only 'Updated Password. ', never the value.

Status
string
Enum: "UP" "IN SERVICE" "DOWN"

Compared case-insensitively; both 'UP' and 'IN SERVICE' store 'UP'. Any other value is ignored. Setting a Gateway to DOWN sends an equipment-error notification.

updateACL
boolean

Only boolean true is acted on.

AS CURRENTLY BUILT EVERY updateACL:true REQUEST RETURNS HTTP 500, by one of two paths, so the ACL is never reported as pushed. (1) The equipment IS a MikroTik gateway (EquipmentType 'Gateway', Manufacturer 'Mikrotik'/'MikroTik', IPAddress not 127.0.0.1 -): NetworkEquipment.updateACL assigns response.body = the WHOLE object returned by updateACL_MikroTik -> updateMikroTik ({statusCode, body:'[...]'}), so the JSON call receives an object; validator's assertString throws TypeError('Expected a string but received a Object') (validator 13.15.35), the catch fires answer 500 with message 'Error updating ACL: Expected a string but received a Object. '. (2) Anything else: sets a STRING body of [{ERROR:'Gateway not found. '}], branch fires answer 500. There is therefore no success shape for this flag today.

delete
boolean

PERMANENT DELETE. Set automatically when the request arrives on /admin/deleteVenueEquipmentPermanently, but also honoured when sent in the body on this path. '.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJ...<access token>",
  • "VenueID": "<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "EquipmentID": "<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>._V3EQUIPMENT.<EquipmentID>",
  • "OperatorID": "<Country>.<State>.<PostalCode_ID>.<OperatorName_ID>.<City_ID>",
  • "Manufacturer": "MikroTik",
  • "Model": "RB4011",
  • "MACAddress": "AA:BB:CC:DD:EE:FF",
  • "UnitID_internal": "<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>.<UnitID>.<UnitBuilding>.<UnitFloor>",
  • "EquipmentType": "Gateway",
  • "WirelessZone": "ZONE-1",
  • "MikrotikPre643": false,
  • "ConnectionProtocol": "https",
  • "IPAddress": "192.168.1.100",
  • "Port": "8728",
  • "Username": "admin",
  • "Password": "<device password>",
  • "Status": "UP",
  • "updateACL": true,
  • "delete": false
}

Response samples

Content type
application/json
Example
{
  • "message": "Updated Manufacturer = MikroTik. Updating IPAddress to <IPAddress>. Updating Port to <Port>. Updating Status to UP. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/venues/listVenueUnits

Lists one venue's units. Read-only.

No token required — an absent or unmatched token resolves to the Public role rather than being rejected.

Access: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (matched against the VenueID as sent, before any external-id resolution), Subscriber, or Public.

Two response shapes, both under VenueUnits: a cut-down cart projection for Public callers, and a fuller console projection for everyone else (Subscriber included).

Extra filtering for Subscriber and Public: occupied units are dropped unless the caller already holds them or the unit allows overlapping subscriptions; cart-disabled units are also dropped (a strict false test for Public, a loose one for Subscriber). NetworkSoftwareProvider/NetworkOperator/Venue callers see everything.

api-version gate: StrictPSK and (console projection only) NetworkConfiguration.VenueUnitSSID require api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

Also available as GET, with identical fields sent as query-string parameters.

An unknown venue is not an error — the response is 200 with no VenueUnits key.

Authorizations:
CognitoAuth
header Parameters
api-version
string
Example: 20260417

Parsed as an integer. At 20260417 or higher (or after the 2026-11-17 sunset) the reply gains StrictPSK and, in the console projection, NetworkConfiguration.VenueUnitSSID; below that an upgrade notice is appended to message. A request Origin containing '-preview' overrides whatever is sent with the deployed code branch.

Authorization
string

Optional Bearer <token> alternative to the body's AccessToken. The endpoint takes the second space-separated word and assigns it over AccessToken. A header with no space therefore overwrites a valid body token with nothing and the call degrades to Public.

Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. Optional — omitting it yields Public access rather than a rejection. May instead be supplied as Authorization: Bearer <token>, which overwrites this field.

IdToken
string

Cognito id token. Read by the shared token verifier alongside the access token, and also checked against the global sign-out marker.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller — absent, that caller is rejected 401. For every other caller the operator is derived from the request Origin and this field is ignored.

VenueID
string

Venue whose units are listed. Required unless it can be derived from externalVenueID, externalVenueUnitID or UnitID_internal; otherwise 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

The operator's own venue identifier; resolved to VenueID. Ignored for Public callers. A lookup miss is silent — the request then fails only if VenueID is still absent.

externalVenueUnitID
string

The operator's own unit identifier; resolved to UnitID_internal (and to VenueID when that is absent). Ignored for Public callers. If the lookup matches units but they do not narrow to exactly one, the request is rejected 400. A lookup that matches nothing is silent — with a VenueID also supplied the call returns 200 with the venue's full, unnarrowed unit list.

UnitID_internal
string

Narrows the result to a single unit, and resolves VenueID when that is absent. If the lookup matches units but they do not narrow to exactly one, the request is rejected 400. A lookup that matches nothing is silent — with a VenueID also supplied the call returns 200, narrowed to the units carrying that UnitID_internal. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor}, with each of the last three trimmed to 20 characters, reduced to [A-Za-z0-9_-] and upper-cased.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "externalVenueID": "string",
  • "externalVenueUnitID": "string",
  • "UnitID_internal": "string"
}

Response samples

Content type
application/json
{
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 42,
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/venues/listVenueUnits (GET)

Lists one venue's units. Read-only. GET form — every field is sent as a query-string parameter.

No token required — an absent or unmatched token resolves to the Public role rather than being rejected.

Access: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (matched against the VenueID as sent, before any external-id resolution), Subscriber, or Public.

Two response shapes, both under VenueUnits: a cut-down cart projection for Public callers, and a fuller console projection for everyone else (Subscriber included).

Extra filtering for Subscriber and Public: occupied units are dropped unless the caller already holds them or the unit allows overlapping subscriptions; cart-disabled units are also dropped (a strict false test for Public, a loose one for Subscriber). NetworkSoftwareProvider/NetworkOperator/Venue callers see everything.

api-version gate: StrictPSK and (console projection only) NetworkConfiguration.VenueUnitSSID require api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

An unknown venue is not an error — the response is 200 with no VenueUnits key.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT. Optional — omitting it yields Public access rather than a rejection. May instead be supplied as Authorization: Bearer <token>, which overwrites this field.

IdToken
string

Cognito id token. Read by the shared token verifier alongside the access token, and also checked against the global sign-out marker.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller — absent, that caller is rejected 401. For every other caller the operator is derived from the request Origin and this field is ignored.

VenueID
string
Example: VenueID={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}

Venue whose units are listed. Required unless it can be derived from externalVenueID, externalVenueUnitID or UnitID_internal; otherwise 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

The operator's own venue identifier; resolved to VenueID. Ignored for Public callers. A lookup miss is silent — the request then fails only if VenueID is still absent.

externalVenueUnitID
string

The operator's own unit identifier; resolved to UnitID_internal (and to VenueID when that is absent). Ignored for Public callers. A value matching no unit at all is silent: no narrowing is applied, so with a VenueID also sent the venue's full unit list comes back. The 400 is raised only when the lookup does find units and they still do not reduce to exactly one — for instance when none of them belongs to the VenueID sent alongside.

UnitID_internal
string

Narrows the result to a single unit, and resolves VenueID when that is absent. A value matching no unit at all is not rejected: the narrowing is still applied, so the reply is 200 and, for a VenueID that does resolve, VenueUnits comes back empty. The 400 is raised only when the lookup does find units and they still do not reduce to exactly one — for instance when none of them belongs to the VenueID sent alongside. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor}, with each of the last three trimmed to 20 characters, reduced to [A-Za-z0-9_-] and upper-cased.

header Parameters
api-version
string
Example: 20260417

Parsed as an integer. At 20260417 or higher (or after the 2026-11-17 sunset) the reply gains StrictPSK and, in the console projection, NetworkConfiguration.VenueUnitSSID; below that an upgrade notice is appended to message. A request Origin containing '-preview' overrides whatever is sent with the deployed code branch.

Authorization
string

Optional Bearer <token> alternative to the body's AccessToken. The endpoint takes the second space-separated word and assigns it over AccessToken. A header with no space therefore overwrites a valid body token with nothing and the call degrades to Public.

Responses

Response samples

Content type
application/json
{
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 42,
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/venues/addVenueUnits

Creates one unit inside an existing venue — or, if the derived unit key already exists, updates that unit instead. Despite the plural path name, one unit per call.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator. AccountManager/CustomerSupport are NOT accepted on this route (unlike other venue endpoints).

UnitID_internal is derived, never accepted — built from VenueID/UnitID/UnitBuilding/UnitFloor, each truncated and sanitized. Address fields left out are inherited from the venue.

VLAN handling: below 200 units at the venue, an omitted VLAN auto-generates from the operator's configured range; from 200 units an explicit VLAN becomes mandatory; at 5000 units the venue is closed to new units.

Both the create and already-exists paths run the same body through the unit-configure step afterward, so configuration fields sent alongside are applied in the same request.

Authorizations:
CognitoAuth
header Parameters
Authorization
string

Optional alternative to the body AccessToken. When present and non-empty the value is split on a space and the second element is taken as the access token, overwriting whatever the body carried. A value with no space yields nothing usable and the request is then rejected as if no token had been sent.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue for the localised messages, anything else US English. It affects only the localised subset of message - the venue-unit validation messages are hard-coded English and never translate.

Request Body schema: application/json
required
AccessToken
string

Caller's Cognito JWT access token. May instead be supplied as an Authorization: Bearer <jwt> header, which takes precedence. Neither present -> 401 with message 'AccessToken Missing. '. When the operator has a Cognito pool the token is then verified.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token and identifies the caller by its preferred_username, or failing that by its email resolved through the operator's email cache.

OperatorID
string

Target operator. REQUIRED only for a Network Software Provider caller, where it names the operator the unit is created under and is then removed from the forwarded body; omitting it in that case -> 401 'OperatorID Missing. '. It is not read for a Network Operator caller, whose operator comes from the request Origin.

VenueID
string

Venue the unit belongs to. Not checked by the endpoint; the venue object rejects an absent value with 401 'Invalid VenueID: undefined', rejects the literal string 'global' (case-insensitive) with 401 'Invalid VenueID: ', and rejects a venue that either does not exist or belongs to a different operator with 401 'VenueID not found: '.

externalVenueID
string

Alternative way to select the venue. The operator's venues are listed and, only when EXACTLY ONE carries this external id, it overwrites VenueID. Zero or several matches DELETE any VenueID that was supplied, which then fails as 'Invalid VenueID: undefined'.

UnitID
required
string <= 20 characters

Unit identifier, e.g. an apartment number. REQUIRED: absent or empty returns HTTP 200 carrying errorProcessing true and message 'UnitID missing from request. ', so the service's own address-derived fallback for UnitID can never run on this route. The value is coerced to a string, HTML-stripped, trimmed and truncated to 20 characters; its upper-cased, [A-Za-z0-9_-]-only first 20 characters form the second segment of the derived UnitID_internal.

UnitBuilding
string <= 20 characters

Building identifier. HTML-stripped and truncated to 20 characters, or the literal 'DEFAULT' when absent or empty. Third segment of the derived UnitID_internal.

UnitFloor
string <= 20 characters

Floor identifier. Same handling as UnitBuilding, defaulting to the literal 'DEFAULT'. Fourth segment of the derived UnitID_internal.

purpose
string
Default: "wiredunit"
Enum: "wiredunit" "localwirelessonly" "globalroaming"

Anything outside this set is silently replaced with 'wiredunit' rather than rejected. It selects which auto-generated-VLAN window the unit draws from: the global-wireless-plus-local-wired window for 'wiredunit', the local-wireless window for 'localwirelessonly', the global-roaming window for 'globalroaming'.

integer or string

Explicit VLAN id. A string is parsed to an integer first. Validated with a minimum of 1; out of range -> 401 'VLAN must be between 1-4095. '. When omitted a VLAN is auto-generated ONLY while the venue holds fewer than 200 units; from 200 units, omitting it -> 401 'VLAN must be provided when adding more than 200 units. '.

AddressLine1
string <= 40 characters

Optional. Inherited from the venue when absent; otherwise HTML-stripped and truncated to 40 characters.

AddressLine2
string <= 40 characters

Optional. Inherited from the venue when absent; otherwise truncated to 40 characters.

City
string

Optional. Inherited from the venue when absent.

State
string

Optional. It is validated ONLY when Country (or its Country.ISO3166A3 alias) is supplied in the same request: it is then matched against that country's state list by name and then by abbreviation and STORED AS THE ABBREVIATION; no match -> 401 'Invalid State for the selected country.'; a country with no state list -> 401 'No states found for ' followed by that country. When Country is omitted the value is never validated - it is only HTML-stripped and truncated to 40 characters and stored as sent. When absent it is inherited from the venue.

Country
string

Optional. Country.ISO3166A3 is accepted as an alias and moved onto this key. When absent the venue's country is used, falling back to the literal 'USA'. Send the ISO 3166-1 alpha-3 code: the normalisation step that would convert a country NAME does not run, and an unrecognised value is silently replaced by the venue's country.

Country.ISO3166A3
string

Alias for Country: copied onto it and then removed from the body.

PostalCode
string <= 10 characters

Optional. Coerced to a string; a value that fails postal-code validation is REPLACED by the venue's postal code rather than rejected. Truncated to 10 characters.

string or Array of strings

Existing venue-equipment record id(s) to attach to the new unit - each the equipment record's own id as the venue-equipment listing returns it, not a bare serial number. EVERY id is verified to exist, to belong to this operator and to sit at this VenueID BEFORE the unit is created, so one bad id cannot leave a half-built unit behind: any miss -> 404 'Equipment not found at venue: . ' and nothing is created. The attach itself is performed by the unit-configure step that runs afterwards, which refuses a Gateway or a Wireless Controller because those serve the whole venue.

PrimaryUnitID_internal
string

Links this unit to a primary unit. Stored only when present, and only together with PrimaryUnitID.

PrimaryUnitID
string

Stored only when PrimaryUnitID_internal is also present.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "UnitID": "<unit identifier>",
  • "purpose": "wiredunit"
}

Response samples

Content type
application/json
Example
{
  • "message": "Unit added. ",
  • "UnitID_internal": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.{UnitID}.DEFAULT.DEFAULT",
  • "UnitID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.{UnitID}.DEFAULT.DEFAULT",
  • "vlan": 1050,
  • "errorProcessing": false
}

/networkoperatorconsole/venues/updateVenueAddress

Update a venue's postal address and related identity fields. Changed fields propagate to every unit at the venue and to active subscription payment records; an audit entry is written and the venue cache is invalidated.

Uniqueness: an exact match on the full address against another of the operator's venues is rejected.

Known limits: State and Country are accepted but never saved. Changing PostalCode to a new value currently fails outright (401), and none of the other field changes in that same request are saved either — avoid combining a postal-code correction with other edits until this is fixed.

Field rules: AddressLine1/AddressLine2/VenueName allow letters, digits, space and . _ - & ( ) , ? only (no #, /, '), max 40 characters. externalVenueID follows the same rule at 64 characters. City only rejects HTML and values over 40 characters.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport). Venue-level roles and subscriber tokens cannot use this operation. The access token must be in the request body — no Authorization header support.

Sending clearSuppressedMacs: true clears suppressed MACs instead of updating the address.

Check errorProcessing, not just the HTTP status — some validation failures return 200 with errorProcessing: true, and some return 401 with errorProcessing: false.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required

JSON object. Must be valid JSON - a non-empty non-JSON body is rejected with 401 'Malformed JSON in input. '. Supply only the fields you want changed.

AccessToken
required
string

Operator console access-token JWT. Must be in the body; an Authorization header is not read by this operation.

VenueID
required
string

Venue to change. Format is {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. The venue must belong to the operator the call resolves to, or the request is rejected with 'Venue not found. '.

VenueName
string <= 40 characters

New venue name. Rejected on any sanitiser difference - see the validation rules in the operation description.

AddressLine1
string <= 40 characters

Street address. Rejected on any sanitiser difference; # and / are not accepted.

AddressLine2
string <= 40 characters

Secondary address line. Send a single space character to CLEAR it - the stored value becomes an empty string. Any other value is validated like AddressLine1.

City
string <= 40 characters

City. Rejected only for HTML content, surrounding whitespace, or more than 40 characters.

PostalCode
string

Postal or ZIP code, validated against known formats for any country. CAUTION: changing this to a different value currently fails the whole request - see the operation description.

externalVenueID
string <= 64 characters

The operator's own identifier for this venue. Send a single space character to CLEAR it. Letters, digits, space and . _ - only.

State
string

ACCEPTED BUT NOT SAVED. The venue's stored state is never changed by this operation; the value is used only as part of the duplicate-address comparison. Omit it unless you intend to influence that comparison.

Country
string

ACCEPTED BUT NOT SAVED. Same as State: it takes part only in the duplicate-address comparison, where it is matched against other venues' ISO 3166-1 alpha-3 country. A Country.ISO3166A3 property in the body is read by nothing at all.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider; it is consumed during authorisation and not passed on to the venue update.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "VenueID": "<pmgId>._V3VENUE_.USA.NY.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "VenueName": "Example Apartments",
  • "AddressLine1": "500 Example Avenue",
  • "AddressLine2": "Building 2",
  • "City": "Springfield",
  • "PostalCode": "10001",
  • "externalVenueID": "EXTVENUE001",
  • "State": "NY",
  • "Country": "USA",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Updated AddressLine1 = 500 Example Avenue. Updated City = Springfield. 120 units updated. 45 payments updated. Venue updated. ",
  • "errorProcessing": true,
  • "statusCode": 0
}

/networkoperatorconsole/venues/addConnectWiseCredentials

Stores ConnectWise PSA credentials for one venue — a convenience wrapper over venue-configuration: the five ConnectWise fields may be sent flat (URL, Authorization, serviceboardid, ClientID, CompanyID) and are lifted into Integrations.ConnectWise.*; any other venue-configuration field in the same body is applied exactly as on configureVenue.

Authorization here is a body field (the ConnectWise credential), not the HTTP header — this operation never reads an Authorization request header.

⚠ The credential's allowed character set is narrow (letters, digits, . _ - & ( ) , ?) — a conventional Basic <base64> value is REJECTED, since : and = are stripped by sanitizing.

serviceboardid is read only when it parses as an integer; a board name is silently discarded.

Send a single space " " as URL/Authorization/ClientID/CompanyID to clear a stored value.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport). Venue-level roles are refused. The token must be in the body — no Authorization header support.

A 401 doesn't mean nothing changed — a per-field validation failure records its message and sets 401, but does not stop the rest of the request from being applied.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required

AccessToken and VenueID are required. The five ConnectWise values may be sent flat, as documented here, or nested under Integrations.ConnectWise. Any other venue-configuration property is accepted and applied as on the configureVenue operation.

AccessToken
required
string

Cognito access-token JWT, in the BODY. Absent or empty gives 401 "AccessToken Missing. ". It is verified only when the resolved operator has a Cognito pool configured; without one the token is not verified and the role test then refuses the call.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

VenueID
required
string

The venue whose ConnectWise credentials are set. Absent gives HTTP 200 with errorProcessing: true and the message "VenueID missing from request. ". A venue that does not exist, or belongs to another operator, gives 401 "Venue not found. ". Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; absent in that case gives 401 "OperatorID Missing. ". It becomes the target operator and is removed from the forwarded body. Ignored for a NetworkOperator caller. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

URL
string

ConnectWise API endpoint. Rewritten to Integrations.ConnectWise.URL. Must be a syntactically valid URL with an http or https scheme and a host; anything else gives "Invalid characters in Integrations.ConnectWise.URL." with 401. A single space " " removes the stored value. Stored only when it differs from what is already held.

Authorization
string

ConnectWise API credential — a BODY field, unrelated to the HTTP Authorization header, which this operation ignores. Max 256 characters, and only letters, digits, ., _, -, &, space, (, ), , and ? are permitted; anything else (including the : and = of a Basic <base64> value, and any input longer than the limit) gives "Invalid characters in ConnectWiseAuthorization." with 401 and no write. A single space " " removes the stored value. When it is stored, the value is echoed verbatim into the venue's audit message.

integer or string

ConnectWise service-board identifier, rewritten to Integrations.ConnectWise.serviceboardid. Considered ONLY when the value parses as an integer, so a board name is silently ignored. A numeric-leading value is then checked against the 40-character sanitiser, and a change gives "Invalid characters in ConnectWise.serviceboardid." with 401. There is no single-space removal for this field.

ClientID
string

Rewritten to Integrations.ConnectWise.ClientID. Max 64 characters over letters, digits, ., _, - and space; anything else gives "Invalid characters in ConnectWise.ClientID." with 401. A single space " " removes the stored value.

CompanyID
string

Rewritten to Integrations.ConnectWise.CompanyID. Same rules and character set as ClientID; a violation gives "Invalid characters in ConnectWise.CompanyID." with 401. A single space " " removes the stored value.

object

The nested form of the same five values. Sending them here bypasses the flat rewrite and behaves identically.

clearSuppressedMacs
boolean

Shared with the venue-configuration operation. Strict === true diverts the call into the RADIUS suppressed-MAC clear and NO credential is written; the reply is then one of the suppression-clear bodies described on /networkoperatorconsole/venues/configureVenue.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "URL": "https://connectwise.example.com",
  • "ClientID": "vault-integration",
  • "CompanyID": "example-company",
  • "serviceboardid": 12
}

Response samples

Content type
application/json
Example
{
  • "message": "Updated Integrations.ConnectWise.URL = https://connectwise.example.com. Updated ConnectWiseClientID = vault-integration. Venue updated. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/venues/addPRTGCredentials

Stores PRTG monitoring credentials for one venue — a convenience wrapper over venue-configuration: the three PRTG fields may be sent flat (URL, Username, PasswordHash) and are lifted into Integrations.PRTG.*; any other venue-configuration field in the same body is applied exactly as on configureVenue.

⚠ The credential character set is narrow (letters, digits, . _ - & ( ) , ?, max 256 chars) — punctuation like :, =, /, @ is stripped, producing a rejection rather than a silently-altered value.

Send a single space " " as URL/Username/PasswordHash to clear a stored value.

⚠ PasswordHash is masked on read — venue-detail responses return only the first characters plus ****; a round-trip will not return what was written. The audit message for a password change records only that it changed, never the value.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport). Venue-level roles are refused. Token must be in the body.

A 401 doesn't mean nothing changed — a per-field validation failure records its message and sets 401, but does not stop the rest of the request from being applied.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required

AccessToken and VenueID are required. The three PRTG values may be sent flat, as documented here, or nested under Integrations.PRTG. Any other venue-configuration property is accepted and applied as on the configureVenue operation.

AccessToken
required
string

Cognito access-token JWT, in the BODY. Absent or empty gives 401 "AccessToken Missing. ". It is verified only when the resolved operator has a Cognito pool configured; without one the token is not verified and the role test then refuses the call.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

VenueID
required
string

The venue whose PRTG credentials are set. Absent gives HTTP 200 with errorProcessing: true and the message "VenueID missing from request. ". A venue that does not exist, or belongs to another operator, gives 401 "Venue not found. ". Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; absent in that case gives 401 "OperatorID Missing. ". It becomes the target operator and is removed from the forwarded body. Ignored for a NetworkOperator caller. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

URL
string

PRTG server URL. Rewritten to Integrations.PRTG.URL. Must be a syntactically valid URL with an http or https scheme and a host; anything else gives "Invalid characters in Integrations.PRTG.URL." with 401. A single space " " removes the stored value. Stored only when it differs from what is already held.

Username
string

PRTG account name. Rewritten to Integrations.PRTG.Username. Max 256 characters, and only letters, digits, ., _, -, &, space, (, ), , and ? are permitted; anything else gives "Invalid characters in PRTGUsername." with 401 and no write. A single space " " removes the stored value. When it is stored, the value is echoed verbatim into the venue's audit message.

PasswordHash
string

PRTG password hash or passhash. Rewritten to Integrations.PRTG.PasswordHash. Same 256-character limit and same restricted character set as Username; a violation gives "Invalid characters in PRTGPasswordHash." with 401 and no write. A single space " " removes the stored value. The audit message records only that it changed, and read paths return a masked form of the stored value.

object

The nested form of the same three values. Sending them here bypasses the flat rewrite and behaves identically.

clearSuppressedMacs
boolean

Shared with the venue-configuration operation. Strict === true diverts the call into the RADIUS suppressed-MAC clear and NO credential is written; the reply is then one of the suppression-clear bodies described on /networkoperatorconsole/venues/configureVenue.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "URL": "https://prtg.example.com",
  • "Username": "vault-monitor",
  • "PasswordHash": "1234567890"
}

Response samples

Content type
application/json
Example
{
  • "message": "Updated Integrations.PRTG.URL = https://prtg.example.com. Updated PRTGUsername = vault-monitor. Updated PRTGPasswordHash. Venue updated. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/venues/enableServicePlan

Add one service plan to a venue's available list. This replaces the whole list — the venue's currently available plans are read, the new plan added, and the result submitted as the complete list; anything missing from that read is also removed from the venue. Only a plan belonging to the same operator and not flagged globally-available can be added.

Enabling an already-enabled plan is a silent no-op (200, empty message, nothing written).

Caution: the starting list comes from a cached copy of the venue; if it has diverged from the live record, plans missing from the cache are removed as a side effect. Re-read the venue between rapid successive changes.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport). Venue-level roles and subscriber tokens cannot use this operation.

Sending clearSuppressedMacs: true clears suppressed MACs instead of changing the plan list.

Check errorProcessing, not just the HTTP status — some validation failures return 200 with errorProcessing: true, some return 401 with errorProcessing: false.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

JSON object. Must be valid JSON - a non-empty non-JSON body is rejected with 401 'Malformed JSON in input. '.

AccessToken
required
string

Operator console access-token JWT. Must be in the body; an Authorization header is not read by this operation.

VenueID
required
string

Venue to change. Format is {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. The venue must belong to the operator the call resolves to, or the request is rejected with 'Venue not found. '.

ServicePlanID
string

Service plan to add. Format is {OperatorID}.V3SERVICEPLAN.{PLANNAME}, upper-cased with non-alphanumerics stripped. Optional in the protocol sense: if it is omitted or empty the request is still accepted and simply configures the venue with whatever else the body contains, without touching the plan list.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider; it is consumed during authorisation and not passed on to the venue update.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "VenueID": "<pmgId>._V3VENUE_.USA.NY.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "ServicePlanID": "<OperatorID>._V3SERVICEPLAN_.1GBPS",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Added <ServicePlanID> to venue. <n> units updated. <n> payments updated. Venue updated. ",
  • "errorProcessing": true,
  • "statusCode": 0
}

/networkoperatorconsole/venues/disableServicePlan

Remove one service plan from a venue's list of available service plans.

The plan list is applied as a WHOLE: this operation reads the venue's currently available plans, removes ServicePlanID from that list, and submits the result as the venue's complete plan list. Anything missing from the list that is read is therefore also removed from the venue - see the caution below.

A plan flagged as a globally available plan is never removed from a venue, even when its id is supplied; the request succeeds and simply reports no change. Removing a plan that is already absent is likewise a no-op: HTTP 200, errorProcessing: false, and an EMPTY message. Use the venue listing to confirm the resulting plan set rather than relying on the message.

A plan still in use at the venue cannot be disabled. If any subscription at this venue is active or starts in the future - no end date, or an end date still ahead - and carries the plan as its ServicePlanID or its CurrentServicePlanID, the request is refused with HTTP 401, errorProcessing: true and 'ServicePlan is in use by active or future subscription(s) at this venue and cannot be disabled. '. NOTHING is committed - not the plan removal, and not any other venue change sent in the same body. CurrentServicePlanID is checked because a subscription degraded after a failed payment runs on the degraded plan while its ServicePlanID still names the paid one, and is restored to it on the next successful payment. End or migrate those subscriptions, or move them to another plan, before disabling it.

Caution - this is a whole-list replacement built from a cached copy of the venue. The list this operation starts from is the operator's cached venue data, while the change is applied against the venue's live record. If the two have diverged - a plan enabled moments earlier, or a cache entry that does not yet contain this venue - the plans missing from the cached copy are removed from the venue as a side effect. When several plan changes are made in quick succession, re-read the venue between calls and verify the resulting plan set.

Who may call it. Exactly two kinds of caller are accepted:

  • a NetworkSoftwareProvider - the operator resolved from the Origin header carries a NetworkSoftwareProviderID, the token has a Username and no SubscriberToken; such a caller must also send OperatorID, naming the operator to act on, and omitting it is a 401.
  • a NetworkOperator administrator - the token's AdministrativeAccess.NetworkOperator.DomainAdministrator, .AccountManager or .CustomerSupport contains the resolved operator's id.

Every other caller is rejected with 401 'Access Denied. '. That explicitly includes venue-level roles: a VenueAdministrator or LeasingAgent token CANNOT use this operation, even for a venue it administers, and neither can a subscriber token. The access token must be in the request body - this operation does not read an Authorization header - and an empty or missing AccessToken is 401 'AccessToken Missing. '.

The whole request body is forwarded to the venue-configuration engine, which is shared with configureVenue. Only the fields documented here are interpreted for this operation; any other venue-configuration property present in the body is applied too, including the bulk-delete flags deleteEmptyVenueUnits, deleteVenueifEmpty and forceDelete. Send only the fields you intend to change. One field is an exception: clearSuppressedMacs: true REPLACES the operation instead of adding to it - the hand-off to the configuration engine is skipped entirely, so the plan list is not changed, and the reply is a different 200 body reporting a RADIUS suppressed-MAC clear (message, VenueID, NAS-Identifier, region, cleared, truncated, totalKeys, deletedKeys, counts, suppressed) with no statusCode.

Read errorProcessing and message, not just the HTTP status. Two mismatches are normal here. A request that fails the operation's own field checks is answered with HTTP 200 and errorProcessing: true. Conversely, several validation failures raised while applying the body return HTTP 401 while leaving errorProcessing: false - the text in message is the authoritative signal in that case. A run that changed nothing succeeds with an EMPTY message.

Changes are written to the venue record and cascade: venue units, active subscriptions and their payment records are updated, an audit entry is written, the operator's cached venue data is invalidated, and a VenueUpdated webhook is sent when the operator has a webhook URL configured.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

JSON object. Must be valid JSON - a non-empty non-JSON body is rejected with 401 'Malformed JSON in input. '.

AccessToken
required
string

Operator console access-token JWT. Must be in the body; an Authorization header is not read by this operation.

VenueID
required
string

Venue to change. Format is {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. The venue must belong to the operator the call resolves to, or the request is rejected with 'Venue not found. '.

ServicePlanID
string

Service plan to remove. Format is {OperatorID}.V3SERVICEPLAN.{PLANNAME}, upper-cased with non-alphanumerics stripped. Optional in the protocol sense: if it is omitted or empty the request is still accepted and simply configures the venue with whatever else the body contains, without touching the plan list.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider; it is consumed during authorisation and not passed on to the venue update.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "VenueID": "<pmgId>._V3VENUE_.USA.NY.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "ServicePlanID": "<OperatorID>._V3SERVICEPLAN_.1GBPS",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Removed service plan <ServicePlanID> from venue. <n> units updated. <n> payments updated. Venue updated. ",
  • "errorProcessing": true,
  • "statusCode": 0
}

/networkoperatorconsole/admin/deleteVenuePermanently

Permanently deletes one venue — but only when it's empty (no currently-active subscription). This is the same code path as venue configuration; the operation name alone triggers the delete.

Cascade order when empty: every unit, then equipment, then the venue record, then its messages — plus cache invalidation and a security notification email. Occupied units block the whole delete; nothing is removed.

Every other request field is discarded once the delete is armed — except forceDelete, read just before the body is cleared.

forceDelete does NOT force anything — with occupied units, it just returns 200 saying a subscription delete was initiated (no actual teardown happens; retrying reports the same occupied units until those subscriptions end some other way). Without it, the same situation is a 401. Either way, nothing is deleted.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport). Venue-level roles are refused. Token must be in the body.

⚠ The reply reports intent, not confirmation — a mid-cascade failure is logged, not raised; the response can read "Deleting empty venue . " (200) even though the cascade stopped partway. Confirm a delete by re-listing venues, not by trusting the message.

clearSuppressedMacs: true short-circuits this route entirely into a RADIUS suppression clear and deletes nothing.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito access-token JWT, in the BODY. Absent or empty gives 401 "AccessToken Missing. ". It is verified only when the resolved operator has a Cognito pool configured; without one the token is not verified and the role test then refuses the call.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

VenueID
required
string

The venue to delete. Absent gives HTTP 200 with errorProcessing: true and the message "VenueID missing from request. ". A venue that does not exist, or that belongs to another operator, gives 401 "Venue not found. ". Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; absent in that case gives 401 "OperatorID Missing. ". It becomes the target operator and is removed from the forwarded body. Ignored for a NetworkOperator caller. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

forceDelete
boolean
Default: false

Strict === true, and read only when the venue has occupied units. True turns the occupied-units rejection into an HTTP 200 whose message claims a subscription delete was initiated and asks you to retry shortly; false or absent makes it a 401. Neither value deletes anything while units are occupied, and no subscription teardown actually runs — see the description.

clearSuppressedMacs
boolean

Shared with the venue-configuration operation. Strict === true diverts the call into the RADIUS suppressed-MAC clear and NO delete happens; the reply is then one of the suppression-clear bodies described on /networkoperatorconsole/venues/configureVenue. Do not send it here unless that is the intent.

Calling-Station-Id
string

Read only alongside clearSuppressedMacs. Has no meaning for the delete.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}"
}

Response samples

Content type
application/json
Example
{
  • "message": "Deleting empty venue {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/admin/deleteAllVenueUnitsPermanently

Permanently deletes every EMPTY unit of one venue (empty = no active subscription references it) — the venue itself and its occupied units are kept.

⚠ Unlike the single-unit/single-equipment delete paths, this does NOT blank the request body — any other venue-configuration property sent alongside is also applied to the venue in the same call.

Related venue-level cache keys are invalidated only in the finalization block, which is skipped when the call errored. No api-version gating on this path.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Caller's Cognito JWT, sent in the body. Absent/empty rejects with 401 and message 'AccessToken Missing. '; when present it is verified by request validation.

VenueID
required
string

Venue whose empty units are deleted. Format built as '{pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}'. Absent/empty returns HTTP 200 with errorProcessing true and message 'VenueID missing from request. '. The venue record must exist AND carry the caller's OperatorID, otherwise 401 'Venue not found. '.

OperatorID
string

Required only for a Network Software Provider caller; it becomes the target operator and is then deleted from the body. Missing for an NSP caller rejects with 401 'OperatorID Missing. '. Ignored for a Network Operator caller. Format built as '{Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}'.

forceDelete
boolean
Default: false

Read only when the venue has occupied units. false/absent -> the response is 401 'Venue has occupied unit(s). '. true -> HTTP 200 whose message reports that a subscription delete was initiated and asks the caller to retry in a few minutes. In BOTH cases the empty units are still deleted, because the delete block is not gated on errorProcessing.

clearSuppressedMacs
boolean

Shared-handler flag. When strictly true (=== true) the endpoint short-circuits into the suppressed-MAC clearing path and NEVER calls venue/configure, so no unit is deleted and the 200 body is one of the four suppression-clear bodies instead. Do not send it on this resource unless that is the intent.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}"
}

Response samples

Content type
application/json
Example
{
  • "message": "Deleting 42 empty units from venue <VenueID>. Venue updated.",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/admin/deleteVenueUnitPermanently

Permanently deletes one venue unit — the request body is blanked, so no other unit property sent alongside is applied.

⚠ A Subscriber-category token is ALSO admitted on this path but is NOT given the delete flag — instead their body is rewritten to clear the unit's SSIDs, which REMOVES every SSID from the unit if their subscription is the sole active one there (refused otherwise). No api-version gating on this path.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Caller's Cognito JWT. Absent/empty rejects with 401 and message 'AccessToken Missing. '.

UnitID_internal
required
string

Absent/empty returns HTTP 200 with errorProcessing true and message 'UnitID_internal missing from request. '.

OperatorID
string

Required only for a Network Software Provider caller; it becomes the target operator and is then deleted from the body. Missing for an NSP caller rejects with 401 'OperatorID Missing. '. Ignored for a Network Operator caller. Format built as '{Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}'.

forceDelete
boolean
Default: false

Read UNCONDITIONALLY, the first statement of the delete branch, before the attached-equipment check, the pending-decommission check and the subscription query; it is only CONSUMED, where active subscriptions exist. false/absent with active subscriptions -> 401 'Unit has active subscriptions.'. true with active subscriptions -> HTTP 200 with a 'retry in a few minutes' message and the unit is NOT deleted on this call. It does NOT override the attached-equipment block.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJ...<jwt>",
  • "UnitID_internal": "{VenueID}.{UNITID}.{UNITBUILDING}.{UNITFLOOR}"
}

Response samples

Content type
application/json
Example
{
  • "message": "Deleting empty unit <UnitID_internal>.",
  • "errorProcessing": false
}

/venuemgmtconsole/subscribers/resendCodeforTandC

Sends the subscriber-console password-reset code — or, for an account that has never accepted the Terms and Conditions, the welcome message with its temporary password. Despite the name, this is the general subscriber password-reset module.

No authentication is required — an unauthenticated request is accepted and classified Public.

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), Subscriber (always their own account only), or Public.

Delivery: NotificationChannel: "SMS" forces SMS to the subscriber's stored phone number (bypassing suppression) when one exists; otherwise email is sent. An EmailAddress/PhoneNumber in the request is only used to look the subscriber up, never as a destination.

Privacy for unauthenticated callers: a Public caller always gets the same 200 success body, whether or not the subscriber exists or is reachable — this prevents account enumeration. Authenticated callers get the real rejection instead.

Authorizations:
CognitoAuth
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first), and that record supplies the OperatorID, the Cognito pool used to verify the token and any source-IP whitelist. A request with neither 'origin' nor 'Origin' is rejected 401 'origin missing. '; an origin that resolves to no operator is rejected 401 'Operator not found. '.

Authorization
string

Optional on this route. When non-empty the value is split on a space and element [1] is taken as the AccessToken, OVERWRITING any AccessToken in the request body. A value with no space yields undefined, which is then treated as no token at all - the request is processed as an anonymous Public call rather than rejected.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) message catalogue, anything else US English. This affects the response 'message' text only.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT access token. Optional. Overwritten by the Authorization header when that header is present. Verified only when the operator record carries a Cognito pool; a token that fails verification is rejected 401.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token and its preferred_username (or, failing that, its email resolved through the operator's email cache) identifies the caller.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller, which is rejected 401 'OperatorID Missing. ' without it. It then replaces the operator context and is removed from the request before the identifier lookups run. Ignored for every other caller.

VenueID
string

Read only by the role check: a caller whose venue-level role list contains this exact VenueID is classified 'Venue'. It does NOT scope the reset and it is not required for operator-level callers - but a venue staff member who omits it is classified 'Subscriber' and resets their own password instead of the target's. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Identifies the target subscriber directly. Highest precedence of the four identifiers. Ignored for a caller classified 'Subscriber', whose own token always wins.

externalSubscriberID
string

The operator's own subscriber identifier; resolved to a SubscriberToken. Used only when SubscriberToken is absent.

EmailAddress
string

Subscriber email address; lower-cased and resolved to a SubscriberToken. Used only when SubscriberToken and externalSubscriberID are absent. Look-up only - the reset is delivered to the address stored on the subscriber record.

PhoneNumber
string

Lowest precedence of the four identifiers. Note the un-dotted name: a 'PhoneNumber.E164' property is not read by this route.

NotificationChannel
string

Passed straight through to the notification engine. The only value with an effect is the exact string 'SMS', which sends the code by SMS to the subscriber's stored phone number and bypasses every suppression flag - but only when the subscriber record has a phone number; without one the request falls back to email. Any other value, or none, sends email when the subscriber record has an email address.

Domain
string

Read only when the resolved operator is the NetworkSoftwareProvider itself: it stages a second operator record for admin use. It does not select the operator whose subscriber is reset - use OperatorID for that.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string",
  • "NotificationChannel": "string",
  • "Domain": "string"
}

Response samples

Content type
application/json
{
  • "message": "Code to reset password sent to account. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/venues/listPropertyManagementGroups

Lists the property-management groups recorded on the operator's cached record — read-only, no database query, no venue linkage (so a venue-level caller sees the operator's full list, not a narrowed one).

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or a caller holding a VenueAdministrator/LeasingAgent role for a supplied VenueID. Anyone else, including an unauthenticated request, is refused.

Note: an NSP's OperatorID only sets which operator id is USED in the call — the groups returned still come from the operator resolved from the request Origin, so a provider can't read another operator's list this way.

GET responses carry Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. May instead be sent as Authorization: Bearer <JWT>, which overwrites this value. If neither is supplied the call is refused 401 Access Denied. - this endpoint has no separate 'token missing' message.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 OperatorID Missing. otherwise) and deleted from the body once accepted. Ignored for every other caller. See the NetworkSoftwareProvider caveat in the operation summary: it does not switch which operator's groups are returned. Built as {Country.ISO3166A3}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

VenueID
string

REQUIRED for a caller whose only rights are venue-level: the request is authorised only when this venue appears among the VenueAdministrator and LeasingAgent venues on the caller's token. It does NOT filter the response - the full operator list is returned either way. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string"
}

Response samples

Content type
application/json
{
  • "PropertyManagementGroups": {
    },
  • "PropertyManagementGroupsCount": 2,
  • "message": "",
  • "errorProcessing": false
}

/networkoperatorconsole/venues/listPropertyManagementGroups (GET)

Lists the property-management groups recorded on the operator's cached record — read-only, no database query, no venue linkage (so a venue-level caller sees the operator's full list, not a narrowed one).

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or a caller holding a VenueAdministrator/LeasingAgent role for a supplied VenueID. Anyone else, including an unauthenticated request, is refused.

Note: an NSP's OperatorID only sets which operator id is USED in the call — the groups returned still come from the operator resolved from the request Origin, so a provider can't read another operator's list this way.

GET responses carry Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT. Not marked required at the parameter level because it may instead arrive in the Authorization header, but with neither present the call is refused 401 Access Denied. .

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 OperatorID Missing. otherwise). Ignored for every other caller, and see the NetworkSoftwareProvider caveat in the operation summary: it does not switch which operator's groups are returned.

VenueID
string

REQUIRED for a caller whose only rights are venue-level: the request is authorised only when this venue appears among the VenueAdministrator and LeasingAgent venues on the caller's token. It does NOT filter the response. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

header Parameters
api-version
string

Accepted by the platform but not read by this operation - no field of this response is version-gated.

Responses

Response samples

Content type
application/json
{
  • "PropertyManagementGroups": {
    },
  • "PropertyManagementGroupsCount": 2,
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/add

Creates a venue (property) under the caller's operator. VenueID and the NAS-Identifier are DERIVED, not accepted — built from sanitized/truncated/uppercased address components (VenueName/City/PostalCode), unless a NAS-Identifier longer than 7 characters is explicitly supplied.

Both must be free: VenueID is the table partition key; the NAS-Identifier is checked for uniqueness across the ENTIRE system (every operator, every PMG) via a global index.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Caller's Cognito JWT, sent in the body. This endpoint does NOT read an Authorization header. Absent/empty -> 401 'AccessToken Missing. '; present, it is verified by request validation when the operator has a CognitoPool.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; it then becomes the target operator and is deleted from the forwarded body. Missing for an NSP caller -> 401 'OperatorID Missing. '. Ignored for a NetworkOperator caller. Format is built as '{Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}'.

VenueName
required
string

Venue display name. Empty/absent -> HTTP 200 with errorProcessing true and message 'VenueName missing from request. '. Sanitised to A-Z a-z 0-9. _ - & and space, trimmed, truncated to 40 characters; its first 20 characters, uppercased and stripped to [A-Za-z0-9_-], become the VenueName_ID segment of the VenueID.

AddressLine1
required
string

Street address. Absent -> 200 'AddressLine1 missing from request. '. Sanitised and truncated to 40 characters. Not part of the VenueID.

AddressLine2
string

Optional second address line, sanitised and truncated to 40 characters; stored as '' when absent. Never validated by the endpoint.

City
required
string

Absent -> 200 'City missing from request. '. HTML-stripped and truncated to 40 characters; its first 10 characters, uppercased and stripped to [A-Za-z0-9_-], become the City_ID segment.

State
required
string

State or province. The submitted value is HTML/entity-stripped and trimmed into cleanedinput, then matched against the country's state list in two passes. Pass 1 is the full NAME and IS case-insensitive: state.name.toUpperCase == cleanedinput.toUpperCase. Pass 2 runs only if pass 1 found nothing and is the ABBREVIATION with a raw == and NO case folding: state.abbreviation == cleanedinput - cleanedinput is the trimmed request value, NOT uppercased (State is uppercased only later, after validation has already run). Stored abbreviations are upper-case (e.g. 'AL'), so a lower-case abbreviation such as 'il' matches neither pass and is rejected. Send the full name in any case, or the abbreviation in UPPER case. On a match the ABBREVIATION is what gets stored (falling back to the name when the list entry has none). Absent -> 200 'State missing from request. '. No match -> 401 'Invalid State for the selected country.'. A country with no state list at all -> 401 'No states found for ' + .

Country
string

ISO 3166 country CODE - alpha-2, alpha-3 or numeric, in any case. runs countries.getAlpha3Code(countries.getName(Country.replace(/\W/g,''),'en'),'en').toUpperCase, and i18n-iso-countries' getName takes a code, not a name: a full country NAME (e.g. 'United States') makes getName return undefined, getAlpha3Code return undefined, and.toUpperCase throw - see the 200 response, shape (d). Country.ISO3166A3 is accepted as an alias and copied over Country twice, once in the endpoint and again in the service; because the endpoint's copy happens BEFORE its presence test, a body carrying only Country.ISO3166A3 is legal - which is why Country is not in required. With neither present -> 200 'Country missing from request. '. A code that resolves to something other than exactly 3 characters -> 401 'Invalid Country ' + .

Country.ISO3166A3
string

Alias for Country; when present it overwrites Country. Because the endpoint copies it BEFORE the Country presence test, supplying this field alone satisfies the country requirement. Same ISO 3166 alpha-3 code format expected.

PostalCode
required
string

Absent -> 200 'PostalCode missing from request. '. Validated as a postal code; failure -> 401 'Invalid PostalCode ' + . Truncated to 10 characters; its first 10 characters, uppercased and stripped to [A-Za-z0-9_-], become the PostalCode_ID segment.

externalVenueID
string

Optional external identifier. Sanitised to [A-Za-z0-9._- and space], truncated to 64 characters; stored as null when absent.

NAS-Identifier
string

Optional RADIUS NAS-Identifier. Honoured ONLY when longer than 7 characters; that value is then stripped to [A-Za-z0-9._-], truncated to 253 characters and uppercased. A 1-7 character value is silently discarded and the identifier is auto-generated as '....' - that branch applies only .slice(0, 253).toUpperCase with NO character stripping, although its three *ID components were already stripped to [A-Za-z0-9-]. Either way the result must be unique across every operator in the system - it is checked against the operator-agnostic NASIdentifierIndex GSI.

object

Stored flattened as the venue attribute FCCLabeldisplayLabel.

object

Only WirelessOnlyPlanVLANOffset is read on this path; the rest reach the venue through the configure call.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueName": "<venue display name>",
  • "AddressLine1": "<street address>",
  • "City": "<city>",
  • "State": "<state name or abbreviation>",
  • "Country": "USA",
  • "PostalCode": "<postal code>"
}

Response samples

Content type
application/json
Example
{
  • "message": "Venue added {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.Venue updated.",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "errorProcessing": false
}

/operatorconsole/venues/addVenueEquipment

Register one piece of network equipment at a venue. Create only — an existing record is rejected, not updated.

The add and the configure are one unit of work. Immediately after the row is written, configureVenueEquipment runs against it with the same body — that's what actually persists Manufacturer, Model, EquipmentType, connection details, MACAddress, UnitID_internal, etc. If the configure step rejects, the just-created row is DELETED again and the message becomes 'Equipment not added. ' plus the configure failure — so a corrected retry is never blocked by 'Equipment already exists. '.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
string

Cognito JWT. May be sent in the body or as Authorization: Bearer <token>; the header wins.

OperatorID
string

Target operator. REQUIRED for a NetworkSoftwareProvider caller, deleted from the body once accepted.

VenueID
required
string

REQUIRED. Venue id in the form <pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>.

EquipmentID
required
string

REQUIRED. Operator-chosen identifier; it becomes the suffix of the stored key <VenueID>._V3EQUIPMENT.<EquipmentID>.

EquipmentID_internal
string

Optional explicit primary key. Honoured only when its length is 1-255, otherwise it is overwritten with the derived value.

ConnectionProtocol
required
string
Enum: "http" "https"

REQUIRED. The check is ['http','https'].includes(value) - exact lower-case match.

IPAddress
required
string

REQUIRED. Must be a string and pass an IP address or an IP address.

Port
required
string

REQUIRED. Coerced to a string and checked as a port, so a JSON number is accepted.

Username
required
string <= 64 characters

REQUIRED. Rejected when the length is not < 65.

Password
required
string <= 100 characters

REQUIRED. Rejected when the length is not < 101. Masked before any response logging.

Manufacturer
string

Optional. HTML tags and entities stripped, trimmed, truncated to 20 characters.

Model
string

Optional. Same sanitisation, 20 characters.

EquipmentType
string

Optional. Sanitised and truncated to 20 characters by the endpoint, then matched case-insensitively by configureVenueEquipment and stored in canonical form - Gateway, Firewall, OLT, Wireless Controller, Wi-Fi Access Point, Switch, CMTS, Router, SmartBox, StreamBlade, LAN Load Balancer, Data Plane, G.hn Headend, WAN Load Balancer, DSL, Other (space-free spellings such as wifiaccesspoint are accepted). An unrecognised value is rejected 401. Gateway is additionally capped at 3 per venue.

MACAddress
string

Optional. Accepted with or without separators; stored in canonical upper-case colon-separated form by the configure half.

UnitID_internal
string

Optional unit the equipment serves. Rejected when the EquipmentType is a gateway or a wireless controller (both serve the whole venue), when the unit is an auto-generated dynamic sub-unit (its id matching -TEMP-<n> or -WIFI-<n>), or when no such unit exists at the supplied VenueID.

WirelessZone
string

Optional pass-through to the configure half; sanitised and truncated to 40 characters there.

MikrotikPre643
boolean

Optional pass-through; stored only when exactly true or false.

Status
string

Optional pass-through; acted on only when the upper-cased value is UP, IN SERVICE or DOWN.

updateACL
boolean

Optional pass-through. Only the literal true triggers it. It pushes this deployment's source addresses to the device; every failure mode in that block is a 500 that rolls the whole add back.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "EquipmentID": "string",
  • "EquipmentID_internal": "string",
  • "ConnectionProtocol": "http",
  • "IPAddress": "string",
  • "Port": "string",
  • "Username": "string",
  • "Password": "string",
  • "Manufacturer": "string",
  • "Model": "string",
  • "EquipmentType": "string",
  • "MACAddress": "string",
  • "UnitID_internal": "string",
  • "WirelessZone": "string",
  • "MikrotikPre643": true,
  • "Status": "string",
  • "updateACL": true
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "EquipmentID_internal": "string",
  • "errorProcessing": false,
  • "statusCode": 200
}

/operatorconsole/venues/addVenueUnit

Creates a unit (apartment/room/port) inside an existing venue — or, if the derived unit already exists, quietly switches to updating it instead. UnitID_internal is DERIVED from venue/unit/building/floor, not accepted; any address field left out is inherited from the venue.

VLAN handling, three paths: an explicit vlan is range-checked (1–4095); otherwise the service picks the first free VLAN in the configured window for the unit's purpose while the venue holds under 200 units; at 200+ units an explicit VLAN becomes mandatory; at 5000 units the venue is closed to new units.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Caller's Cognito JWT. May instead be supplied as Authorization: Bearer <jwt>, which the endpoint splits on a space and copies into the body first. Neither -> 401 'AccessToken Missing. '.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; it becomes the target operator and is deleted from the forwarded body. Missing then -> 401 'OperatorID Missing. '. Ignored for a NetworkOperator caller.

VenueID
string

Venue the unit belongs to. NOT checked by the endpoint - the service rejects an absent value 401 'Invalid VenueID: undefined', the literal string 'global' (case-insensitive) 401 'Invalid VenueID: ', and a venue that either does not exist or belongs to a different operator 401 'VenueID not found: '. Format: '{pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}' (documented, built).

externalVenueID
string

Alternative way to select the venue: the service lists the operator's venues and, only when EXACTLY ONE matches, overwrites VenueID with it. Zero or multiple matches DELETE any VenueID that was supplied, which then fails as 'Invalid VenueID: undefined'.

UnitID
required
string

Unit identifier. Absent/empty -> HTTP 200 with errorProcessing true and message 'UnitID missing from request. ', so the service's own AddressLine-derived fallback is unreachable on this route. Coerced to a string, HTML-stripped, trimmed and truncated to 20 characters; its uppercased, [A-Za-z0-9_-]-stripped first 20 characters form the second segment of UnitID_internal.

UnitBuilding
string

Building identifier. HTML-stripped and truncated to 20 characters, or the literal 'DEFAULT' when absent/empty. Third segment of UnitID_internal.

UnitFloor
string

Floor identifier. Same handling; defaults to 'DEFAULT'. Fourth segment of UnitID_internal.

purpose
string
Default: "wiredunit"
Enum: "wiredunit" "localwirelessonly" "globalroaming"

Anything not in this set is silently replaced with 'wiredunit'. It selects which Minimum/MaximumAutoGeneratedVLAN_* window the auto-generated VLAN is drawn from: GlobalWirelessPlusLocalWiredAccess for wiredunit, LocalWirelessAccess for localwirelessonly, GlobalWirelessRoaming for globalroaming.

integer or string

Explicit VLAN. A string is parseInt-ed first. Validated by request validation with min 1; out of range -> 401 'VLAN must be between 1-4095. '. When omitted, one is auto-generated only while the venue holds FEWER THAN 200 units; at 200 or more, omitting it -> 401 'VLAN must be provided when adding more than 200 units. '.

AddressLine1
string

Optional; inherited from the venue when absent, otherwise HTML-stripped and truncated to 40 characters.

AddressLine2
string

Optional; inherited from the venue when absent, otherwise truncated to 40 characters.

City
string

Optional; inherited from the venue when absent.

State
string

Optional. When supplied it is validated against the resolved country's state list and stored as the ABBREVIATION; no match -> 401 'Invalid State for the selected country.'; a country with no state list -> 401 'No states found for ' + . When absent it is inherited from the venue and never validated.

Country
string

Optional; Country.ISO3166A3 is accepted as an alias and moved onto Country. When absent, the venue's country is used, falling back to the literal 'USA'. See the note about the inverted normalisation guard.

Country.ISO3166A3
string

Alias for Country; copied onto Country and then deleted.

PostalCode
string

Optional. Coerced to a string; if it is not a postal code it is REPLACED by the venue's postal code rather than rejected. Truncated to 10 characters.

string or Array of strings

Existing venue-equipment record id(s) to attach to the new unit - each the equipment record's own ID, not a bare serial. EVERY id is verified up front to exist, belong to this operator AND sit at this VenueID before the unit is created, so one bad id cannot leave a half-built unit behind: any miss -> 404 'Equipment not found at venue: . '. The attach itself is performed later.

PrimaryUnitID_internal
string

Links this unit to a primary unit. Stored only when present, together with PrimaryUnitID.

PrimaryUnitID
string

Stored only when PrimaryUnitID_internal is also present.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "UnitID": "<unit identifier>",
  • "purpose": "wiredunit"
}

Response samples

Content type
application/json
Example
{
  • "message": "Unit added. ",
  • "UnitID_internal": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.{UnitID}.DEFAULT.DEFAULT",
  • "UnitID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.{UnitID}.DEFAULT.DEFAULT",
  • "vlan": 1050,
  • "errorProcessing": false
}

/operatorconsole/venues/configure

Updates one venue's configuration. No GET route for this path. The whole request body is forwarded unchanged to the venue-configure service, whose response replaces the body wholesale (hence the statusCode field inside the body).

Sending clearSuppressedMacs: true clears RADIUS suppression counters instead of updating the venue — handled entirely in this endpoint. ServicePlanID is INERT here (the rewrite that consumes it only fires on enableServicePlan/disableServicePlan) — use ServicePlanConfiguration.ServicePlanIDs instead.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport). Venue-level roles are deliberately excluded — admitting them would grant write access to every venue setting, including deletion.

The access token must be in the body — no Authorization header support.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

AccessToken and VenueID are the only two fields every call needs. Everything else is optional and is applied only when present; the whole body is forwarded verbatim.

AccessToken
required
string

Cognito JWT, in the body - this endpoint does NOT accept an Authorization header. Absent or empty gives 401 with message 'AccessToken Missing. ' (translations.json the localized message).

VenueID
required
string

The venue to configure. Absent gives a 200 whose body carries errorProcessing true and message 'VenueID missing from request. ' - the endpoint sets statusCode explicitly to 200 on that branch. The service re-checks it and answers 401 'Invalid Venue' if it is still empty. Ownership is enforced, which loads the row by ID and discards it unless its OperatorID matches the caller's; a mismatch yields 401 'Venue not found. '. Format is the venue-id form built by - {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and DELETED from the forwarded body, so the service never sees it.

clearSuppressedMacs
boolean

Strict === true. Runs the RADIUS suppression clear INSTEAD of configuring the venue - no venue field is written on this path. Any other value, including the string 'true', falls through to the normal configure.

Calling-Station-Id
string

Read ONLY when clearSuppressedMacs is true. Narrows the clear to one client MAC; any separator style is accepted and normalised (separators stripped, lowercased) before use. A non-empty value that is not a MAC after normalisation is rejected with message 'Invalid Calling-Station-Id. ' and statusCode 200 - deliberately, so a malformed MAC can never fall through to the venue-wide delete. Omitting it clears every suppressed MAC at the venue.

VenueName
string

Max 40 chars, Sanitised; if sanitising changes the string the service appends 'Invalid characters in VenueName.' and sets statusCode 401.

externalVenueID
string

A single space ' ' REMOVES the stored value. Otherwise sanitised with idField; a change from the input appends 'Invalid characters in externalVenueID.' and sets statusCode 401.

AddressLine1
string

Sanitised; a change appends 'Invalid characters in AddressLine1.' with statusCode 401. When any address field changes, the venue's whole address is checked for uniqueness within the operator: the comparison is over SIX fields at once - AddressLine1, AddressLine2, City, State, Country.ISO3166A3 and PostalCode - each taken from the request when supplied and from the stored record otherwise, and the venue's own row is excluded by ID. So a venue that differs in only AddressLine2 or State does NOT clash. A clash gives errorProcessing true, statusCode 401 and the message 'Address is assigned to another venue - ' + the other venue's VenueName.

AddressLine2
string

A single space ' ' REMOVES the stored value. Otherwise sanitised with nameAndAddress at 40 chars; a change from the input appends 'Invalid characters in AddressLine2.' with statusCode 401.

City
string

Sanitised; a change appends 'Invalid characters in City.' with statusCode 401.

State
string

Accepted by the API but NEVER STORED by this endpoint: the entire State. It is NOT inert, though: the request's State is read (falling back to the stored venue's State) and compared as one of the six terms of the address-uniqueness check, so supplying it can change whether that 401 fires.

PostalCode
string

Validated as a postal code; a failure appends 'Invalid characters in PostalCode.' and sets statusCode 401.

Country.ISO3166A3
string

ISO 3166 alpha-3. Accepted by the API but NEVER STORED by this endpoint: the country validation and write block, including the Country.ISO3166A3. Note the address-uniqueness check reads the PLAIN Country key off the request, not this one, and compares it against each candidate venue's stored 'Country.ISO3166A3' attribute.

AuthCounterEnabled
boolean

Per-venue RADIUS auth-counter opt-in, at the TOP level of the body (not under NetworkConfiguration). Written only when the value is a literal true/false AND differs from the stored value.

object
object
object
object
object
object
object
object
DisplayOptionID
string

Display-option template id. Sanitised with idField; a change from the input appends 'Invalid characters in DisplayOptionID.' with statusCode 401. The display-option NAME is derived by stripping the prefix + '.V3DISPLAY.' from the id, which is the id's construction rule.

deleteVenueifEmpty
boolean

Strict === true. Deletes the venue when it has no active subscriptions, and CLEARS the rest of the request body first, so no other field in the same call is applied. Occupied units set the message 'Venue has ' + n + ' occupied unit(s). '; without forceDelete that branch also sets errorProcessing true and statusCode 401.

deleteEmptyVenueUnits
boolean

Deletes every unit with no active subscription. Occupied units block it the same way.

forceDelete
boolean

With either delete flag, starts subscription teardown for occupied units instead of failing outright; the message then gains ' Initiated subscription delete for occupied units. It may take few minutes to disable equipment. Please retry deletion after few minutes. ' and the caller must retry.

ServicePlanID
string

INERT on this path. The endpoint only rewrites it into ServicePlanConfiguration.ServicePlanIDs for the '/venues/enableServicePlan' and '/venues/disableServicePlan' resources; on '/venues/configure' the lookup still runs but update_serviceplans stays false, so the field is forwarded to an object that never reads it. Use ServicePlanConfiguration.ServicePlanIDs instead.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "VenueID": "string",
  • "OperatorID": "string",
  • "clearSuppressedMacs": true,
  • "Calling-Station-Id": "string",
  • "VenueName": "string",
  • "externalVenueID": "string",
  • "AddressLine1": "string",
  • "AddressLine2": "string",
  • "City": "string",
  • "State": "string",
  • "PostalCode": "string",
  • "Country.ISO3166A3": "string",
  • "AuthCounterEnabled": true,
  • "NetworkConfiguration": {
    },
  • "FCCLabel": {
    },
  • "PMS": {
    },
  • "Integrations": {
    },
  • "ServicePlanConfiguration": {
    },
  • "Notifications": {
    },
  • "Reporting": {
    },
  • "ShoppingCart": {
    },
  • "DisplayOptionID": "string",
  • "deleteVenueifEmpty": true,
  • "deleteEmptyVenueUnits": true,
  • "forceDelete": true,
  • "ServicePlanID": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "VenueID": "string",
  • "NAS-Identifier": "string",
  • "Calling-Station-Id": "string",
  • "region": "string",
  • "cleared": true,
  • "truncated": true,
  • "readErrors": 0,
  • "totalKeys": 0,
  • "deletedKeys": 0,
  • "counts": {
    },
  • "suppressed": {
    },
  • "errorProcessing": true
}

/operatorconsole/venues/configureVenueEquipment

Updates one existing piece of network equipment at a venue — also the permanent-delete path for it. The row is matched by EquipmentID AND must belong to the caller's operator AND the submitted VenueID — any mismatch is a 404.

Side effects: a ConnectionProtocol/IPAddress/Port/Username/Password change, or Status → UP, on a Gateway triggers a provisioning re-drive (clears AllGatewaysConfigured, drops this equipment from every active subscription's gatewaysConfigured list, re-seeds PendingGatewayEnable). ⚠ A Manufacturer change to RiQ/MikroTik/Nomadix/Peplink/Altiplano triggers the SAME re-drive regardless of equipment type — not just on Gateways. Those changes (plus MikrotikPre643) also clear the equipment error counters; a Manufacturer change alone does not. Status → DOWN on a Gateway sends an equipment-error notification.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Caller's Cognito JWT, sent in the body - this endpoint does NOT accept an Authorization header. Absent/empty -> 401 'AccessToken Missing. '; present, it is verified by request validation when the operator has a CognitoPool.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; it becomes the target operator and is deleted from the forwarded body. Missing then -> 401 'OperatorID Missing. '.

VenueID
required
string

The venue that must own the equipment. Absent/empty -> HTTP 200 with errorProcessing true and message 'VenueID missing from request. '. It is not just a scope hint: the service requires the stored record's VenueID to equal this value or the request 404s. Format: '{pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}'.

EquipmentID
required
string

The equipment record's own primary key, of the form '._V3EQUIPMENT.' as listVenueEquipment returns it - not a bare serial number (the same convention is documented). Absent/empty -> HTTP 200 with errorProcessing true and message 'EquipmentID missing from request. '. Unknown, or owned by another operator or venue -> 404.

delete
boolean

Exactly true (=== true) PERMANENTLY deletes the equipment record and BLANKS the rest of the request body first, so no other property in the same call is applied. The equipment's OpenSearch log documents are marked for later removal by OpenSearchCleaner; a failure there is reported as a 500. No confirmation flag, no dry run, no undo.

Manufacturer
string

HTML-stripped, trimmed, truncated to 40 characters, then canonicalised by SUBSTRING match (case-insensitive): a value containing 'riq' becomes 'RiQ', 'mikrotik' -> 'MikroTik', 'nomadix' -> 'Nomadix', 'peplink' -> 'Peplink', 'altiplano' -> 'Altiplano'; anything else is stored as submitted. Setting it to one of those five canonical values sets remove_gatewayConfigured, which re-drives provisioning for every active subscription at the venue. Unlike every other trigger in this object this one is NOT gated on the record being a Gateway - there is no equipment_type test, and the Manufacturer block runs before equipment_type is read - so it also fires on a Switch, an Access Point or any other EquipmentType. It does NOT clear the equipment error counters.

Model
string

HTML-stripped, trimmed, truncated to 40 characters. No validation beyond that.

MACAddress
string

Accepted with or without separators and STORED CANONICALLY as uppercase colon-separated, so any input spelling maps to one value. Anything else -> 401 'Invalid MACAddress: ' + + '. '.

EquipmentType
string
Enum: "Gateway" "Firewall" "OLT" "Wireless Controller" "Wi-Fi Access Point" "Switch" "CMTS" "Router" "SmartBox" "StreamBlade" "LAN Load Balancer" "Data Plane" "G.hn Headend" "WAN Load Balancer" "DSL" "Other"

Matched case-insensitively, and several spellings without spaces or hyphens are also accepted ('wirelesscontroller', 'wifiaccesspoint', 'wi-fiaccesspoint', 'lanloadbalancer', 'dataplane', 'ghnheadend', 'wanloadbalancer'); the canonical value above is what gets stored. Anything else -> 401 'Invalid EquipmentType: ' + + '. Supported types are Gateway, Firewall, OLT, Wireless Controller, Wi-Fi Access Point, Switch, CMTS, Router, SmartBox, StreamBlade, LAN Load Balancer, Data Plane, G.hn Headend, WAN Load Balancer, DSL, Other.' Gateway and Wireless Controller are VENUE-ONLY types: setting one while the record is (or is becoming) attached to a unit -> 401. A venue may hold at most three Gateways -> 401 'Maximum of 3 gateways allowed per venue.'.

UnitID_internal
string or null

Attaches this equipment to a unit, or - when sent as JSON null (strictly ===) - DETACHES it. A non-empty value is rejected 401 when the record's effective EquipmentType is Gateway or Wireless Controller, 401 'Cannot attach equipment to auto-generated unit ' + + '. ' when the id matches /-(TEMP|WIFI)-\d/, 404 'Unit not found: ' + + '. ' when the unit belongs to another venue.

WirelessZone
string

HTML-stripped, trimmed, truncated to 40 characters.

MikrotikPre643
boolean

Must be exactly true or false and differ from the stored value. On a Gateway it clears the equipment error counters but does NOT re-drive provisioning.

ConnectionProtocol
string
Enum: "http" "https"

Only these two exact lowercase values are honoured; anything else is silently ignored. On a Gateway a change re-drives provisioning and clears the error counters.

IPAddress
string

Must be an IP address as IPv4 or IPv6; anything else is silently IGNORED, not rejected. On a Gateway a change re-drives provisioning and clears the error counters.

integer or string

Coerced to a string and validated as a port; anything else is silently IGNORED. On a Gateway a change re-drives provisioning and clears the error counters.

Username
string

Management-interface username. HTML-stripped, trimmed, truncated to 64 characters. On a Gateway a change re-drives provisioning and clears the error counters. NOTE the audit message echoes the value: 'Updated Username = . ' (double space before '=').

Password
string <password>

Management-interface password. HTML-stripped, trimmed, truncated to 100 characters. The audit message deliberately does NOT echo it - it is the literal 'Updated Password. '. On a Gateway a change re-drives provisioning and clears the error counters.

Status
string

Accepted case-insensitively as 'UP', 'IN SERVICE' or 'DOWN'; both 'UP' and 'IN SERVICE' store the value 'UP'. Any other value is silently ignored. On a Gateway, ->UP re-drives provisioning and clears the error counters, while ->DOWN sends an equipment-error notification titled 'Gateway DOWN'.

updateACL
boolean

Exactly true (the test is [true].includes(value)) pushes this deployment's management source IPs to the device via NetworkEquipment.updateACL. The IP set is chosen from the DOMAIN / API_DOMAIN environment of the running stack. Every failure mode here is a 500, and a successful push adds an update_acl key to the response body.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "EquipmentID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}._V3EQUIPMENT.<equipment id>",
  • "Status": "UP"
}

Response samples

Content type
application/json
Example
{
  • "message": "Updating Status to UP. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/operatorconsole/venues/configureVenueUnit

Updates one existing venue unit — also the delete path for an empty unit.

Who may call it: a NetworkSoftwareProvider, a NetworkOperator DomainAdministrator/AccountManager/CustomerSupport, or the subscriber themself (who must hold an ACTIVE subscription on that exact unit) — venue-level roles are deliberately excluded, since no field is individually role-gated and admitting them would grant write access to Stripe keys, PMS bindings and unit deletion.

For a Subscriber caller, the whole request body is replaced with just UnitID_internal and NetworkConfiguration.VenueUnitSSID (capped at 4 entries) before the update runs.

Removing an SSID cascades — stripped from every unit of the venue and every subscription on this unit.

AccessToken is body-only — this endpoint never reads an Authorization header.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Caller's Cognito JWT, sent in the body - this endpoint does NOT accept an Authorization header. Absent/empty -> 401 'AccessToken Missing. '; present, it is verified by request validation when the operator has a CognitoPool.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller; it becomes the target operator and is deleted from the forwarded body. Missing then -> 401 'OperatorID Missing. '.

UnitID_internal
required
string

The unit's primary key. Absent/empty -> HTTP 200 with errorProcessing true and message 'UnitID_internal missing from request. '. Format is '...' as built by; the VenueID part is itself '{pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}'. The unit must exist AND its venue must belong to the caller's operator, else 401 'Unit does not belong to this operator.'.

object

Network settings. NetworkData is accepted as an alias and copied over this key by the endpoint.

object

Alias: the endpoint copies this whole object onto NetworkConfiguration, overwriting it. Send one or the other, not both.

deleteEmptyVenueUnit
boolean

Exactly true (=== true) DELETES the unit instead of updating it, and BLANKS the rest of the request body first, so no other property in the same call is applied. Attached equipment blocks the delete outright and forceDelete does NOT override that -> 401 'Unit has equipment attached (<up to 5 ids>). Detach the equipment before deleting the unit.'. Subscriptions with pending gateway decommission also block it -> 401.

forceDelete
boolean

Read only inside the delete path, and only when the unit has ACTIVE subscriptions. Absent/false -> 401 'Unit has active subscriptions.'. Exactly true -> the message becomes 'Unit has active subscriptions. Initiated subscription delete. It may take few minutes to disable equipment. Please retry deletion after few minutes. ' and the unit is NOT deleted this call. It never overrides the attached-equipment block.

string or Array of strings

Existing venue-equipment record id(s) to attach to this unit - each the equipment record's own ID as listVenueEquipment returns it, of the form '._V3EQUIPMENT.'. EVERY id is verified up front (exists, this operator's, at this unit's venue) so one bad id cannot leave earlier ids attached -> 404 'Equipment not found at venue: . '. Each attach is then delegated, which refuses a Gateway or Wireless Controller because those serve the whole venue. The attach block runs AFTER the unit's own update, so a bad EquipmentID does not suppress legitimate property changes.

externalVenueUnitID
string

External identifier. Rejected 401 'Invalid characters in externalVenueUnitID.' when the value changes under HTML sanitisation, and 401 'Duplicate externalVenueUnitID at ' when another unit already holds it.

UnitID
string

Renames the unit's display id. Rejected 401 'Invalid characters in UnitID.' on a sanitisation mismatch. NOTE this does NOT change UnitID_internal, which stays the primary key.

UnitBuilding
string

Rejected 401 'Invalid characters in UnitBuilding.' on a sanitisation mismatch.

UnitFloor
string

Rejected 401 'Invalid characters in UnitFloor.' on a sanitisation mismatch.

AddressLine1
string

Rejected 401 'Invalid characters in AddressLine1.' on a sanitisation mismatch.

AddressLine2
string

A single SPACE (' ') CLEARS the stored value; any other value is sanitised and rejected 401 'Invalid characters in AddressLine2.' on a mismatch.

City
string

Rejected 401 'Invalid characters in City.' on a sanitisation mismatch.

State
string

Rejected 401 'Invalid characters in State.' on a sanitisation mismatch.

Country
string

Country.ISO3166A3 is accepted as an alias. Rejected 401 'Invalid characters in Country.' on a sanitisation mismatch or 401 'Invalid Country: ' + when normalisation throws.

Country.ISO3166A3
string

Alias for Country.

PostalCode
string

Validated unless it is the literal string '0'; failure -> 401 'PostalCode validation failed'.

integer or string

New VLAN for the unit. A non-integer-parsable value is DELETED from the body rather than rejected. Otherwise validated by request validation with min 1; out of range -> 401 'vlan should be between 1-4095. '. A successful change also nulls AllGatewaysConfigured, gatewaysConfigured and 'R1ConfiguredUTC.ISO8601' on the unit's subscriptions, forcing re-provisioning.

SMSCode
string

Short code for SMS enrolment; coerced to a string, trimmed and truncated to 6 characters. Rejected 401 'Invalid characters in SMSCode.' when the value changes under sanitisation - which includes containing a SPACE, because the API also splits on ' ' and keeps the first token. Must be unique across EVERY unit of EVERY venue of the operator, else 401 'Duplicate SMSCode.'.

integer or string

RealPage PMS unit id. A non-integer string is coerced to 0, and 0 or negative -> 401 'RealPageUnitID should be a positive number.'.

object

Only ONE notification field is still honoured at unit level; suppressSubscriberEmails, sendSubscriptionAddedEmail and sendSubscriptionEndEmail were moved to operator+venue level on 2026-08-12 and are ignored here.

object

Shopping-cart settings. The Stripe key blocks that used to live here are not served, so ShoppingCart.Stripe.* is accepted by the field mapper but written by nothing.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "UnitID_internal": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.{UnitID}.DEFAULT.DEFAULT",
  • "NetworkConfiguration": {
    }
}

Response samples

Content type
application/json
Example
{
  • "message": "Removed ssids <old ssid> from VenueUnitSSID. Added <new ssid> to VenueUnitSSID.",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueDailyReport

Per-venue daily usage report as a fixed hourly series, read from a cache written by a scheduled job — not computed live.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin for the requested VenueID. No anonymous fallthrough — an unrecognized caller (including a tokenless request) is refused.

Report window: the requested date (or 'now'), converted to the venue's LOCAL start-of-day and expressed in UTC. Because the cache key is written using the timezone offset at write time and read using the offset at report time, the lookup probes several nearby cache-key variants before giving up.

A VenueID that doesn't match one of the operator's cached venues returns HTTP 200 with errorProcessing: true, not a 4xx.

Read-only. An unexpected exception is caught and NOT converted to an error status — the caller gets 200 with an empty result rather than a 5xx.

GET and POST behave identically; GET also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
string

Cognito JWT. Verified by request validation only when non-empty; an absent token is not reported as such but falls through to 'Access Denied. ' 401. Overridden by an Authorization: Bearer header if one is sent.

OperatorID
string

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing -> 401 'OperatorID Missing. '); on success it is copied onto Operator.OperatorID and deleted from the request body. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Built.

VenueID
string

Venue to report on. Absent/empty -> HTTP 200 with errorProcessing true and 'Missing VenueID. '. Not present exactly once in the cached venues list -> HTTP 200 with errorProcessing true and 'Invalid VenueID. '. Also the value matched against the token's VenueAdministrator list for the Venue role.

UsageReportStartDateUTC.ISO8601
string

Optional. Any string accepted by the JavaScript Date constructor; read and passed to new Date. Defaults to now. It is NOT the returned window verbatim - it is snapped back to the venue's local start of day and then decremented 1 ms to form the cache key.

An unparseable value does not error (new Date does not throw): every derived timestamp becomes NaN, all six cache probes miss and UsageData comes back empty.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}"
}

Response samples

Content type
application/json
{
  • "UsageData": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueDailyReport (GET)

Per-venue daily usage report as a fixed hourly series, read from a cache written by a scheduled job — not computed live.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin for the requested VenueID. No anonymous fallthrough — an unrecognized caller (including a tokenless request) is refused.

Report window: the requested date (or 'now'), converted to the venue's LOCAL start-of-day and expressed in UTC. Because the cache key is written using the timezone offset at write time and read using the offset at report time, the lookup probes several nearby cache-key variants before giving up.

A VenueID that doesn't match one of the operator's cached venues returns HTTP 200 with errorProcessing: true, not a 4xx.

Read-only. An unexpected exception is caught and NOT converted to an error status — the caller gets 200 with an empty result rather than a 5xx.

GET and POST behave identically; GET also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT. Verified by request validation only when non-empty; an absent token is not reported as such but falls through to 'Access Denied. ' 401.

Overridden by an Authorization: Bearer header if one is sent. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

OperatorID
string
Example: OperatorID={Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing -> 401 'OperatorID Missing. '); on success it is copied onto Operator.OperatorID and deleted from the request body. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

VenueID
string
Example: VenueID={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}

Venue to report on. Absent/empty -> HTTP 200 with errorProcessing true and 'Missing VenueID. '. Not present exactly once in the cached venues list -> HTTP 200 with errorProcessing true and 'Invalid VenueID. '. Also the value matched against the token's VenueAdministrator list for the Venue role. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

UsageReportStartDateUTC.ISO8601
string

Optional. Any string accepted by the JavaScript Date constructor; read and passed to new Date. Defaults to now. It is NOT the returned window verbatim - it is snapped back to the venue's local start of day and then decremented 1 ms to form the cache key.

An unparseable value does not error (new Date does not throw): every derived timestamp becomes NaN, all six cache probes miss and UsageData comes back empty. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

Responses

Response samples

Content type
application/json
{
  • "UsageData": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueEquipment

Network equipment registered at one venue. GET and POST behave identically; GET reads the query string and adds Cache-Control.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin — note LeasingAgent is NOT accepted here, unlike listVenueDailyReport/listVenueLatestSnapshot.

Field visibility: a Venue-role caller doesn't receive Manufacturer, Model, MACAddress, WirelessZone, ConnectionProtocol, IPAddress, Port or MikrotikPre643; Password is returned only to a small internal support allow-list regardless of role.

A VenueID that exists but belongs to another operator is NOT an error — it returns 200 with an empty equipment list. Unlike its siblings, this endpoint DOES check for a missing token explicitly.

Read-only.

Authorizations:
CognitoAuth
Request Body schema: application/json
optional
AccessToken
string

Cognito JWT. REQUIRED: absent or empty is rejected 401 'AccessToken Missing. '. Verified by request validation only when the origin's operator record carries SignOn.Cognito.CognitoPool. Overridden by an Authorization: Bearer header if one is sent.

OperatorID
string

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing -> 401 'OperatorID Missing. '); on success it is copied onto Operator.OperatorID and deleted from the request body. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Built.

VenueID
string

Venue whose equipment is listed. Absent/empty -> HTTP 200 with errorProcessing true and 'VenueID missing from request. '. A venue that is not in the caller's operator's cached venue list is NOT rejected - it returns 200 with Equipment [] and both counts 0. Also the value matched against the token's VenueAdministrator list for the Venue role.

UnitID_internal
string

Optional filter. Coerced to a string and trimmed, then matched with === against each equipment record's UnitID_internal - exact and case-sensitive. Because venue-level equipment carries UnitID_internal '', supplying this excludes every gateway and wireless controller. EquipmentCount and EquipmentUPCount describe the filtered set.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}"
}

Response samples

Content type
application/json
{
  • "Equipment": [
    ],
  • "EquipmentCount": 0,
  • "EquipmentUPCount": 0,
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueEquipment (GET)

Network equipment registered at one venue. GET and POST behave identically; GET reads the query string and adds Cache-Control.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin — note LeasingAgent is NOT accepted here, unlike listVenueDailyReport/listVenueLatestSnapshot.

Field visibility: a Venue-role caller doesn't receive Manufacturer, Model, MACAddress, WirelessZone, ConnectionProtocol, IPAddress, Port or MikrotikPre643; Password is returned only to a small internal support allow-list regardless of role.

A VenueID that exists but belongs to another operator is NOT an error — it returns 200 with an empty equipment list. Unlike its siblings, this endpoint DOES check for a missing token explicitly.

Read-only.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT.

REQUIRED: absent or empty is rejected 401 'AccessToken Missing. '. Verified by request validation only when the origin's operator record carries SignOn.Cognito.CognitoPool.

Overridden by an Authorization: Bearer header if one is sent. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

OperatorID
string
Example: OperatorID={Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing -> 401 'OperatorID Missing. '); on success it is copied onto Operator.OperatorID and deleted from the request body. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

VenueID
string
Example: VenueID={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}

Venue whose equipment is listed. Absent/empty -> HTTP 200 with errorProcessing true and 'VenueID missing from request. '. A venue that is not in the caller's operator's cached venue list is NOT rejected - it returns 200 with Equipment [] and both counts 0. Also the value matched against the token's VenueAdministrator list for the Venue role. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

UnitID_internal
string
Example: UnitID_internal={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.{UnitID}.{UnitBuilding}.{UnitFloor}

Optional filter. Coerced to a string and trimmed, then matched with === against each equipment record's UnitID_internal - exact and case-sensitive. Because venue-level equipment carries UnitID_internal '', supplying this excludes every gateway and wireless controller. EquipmentCount and EquipmentUPCount describe the filtered set. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

Responses

Response samples

Content type
application/json
{
  • "Equipment": [
    ],
  • "EquipmentCount": 0,
  • "EquipmentUPCount": 0,
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueLatestSnapshot

Latest cached utilization snapshot for the caller's venue portfolio — a per-venue map plus a portfolio rollup. Not scoped to a single venue by default; VenueID merely narrows it.

Roles: NetworkSoftwareProvider (must send OperatorID, sees the whole operator), NetworkOperator (sees the whole operator), or Venue admin (narrowed to their own venues). No anonymous fallthrough — an unrecognized caller is refused.

Data comes from a maintained cache (venueutil<OperatorID>), not a live query — a venue changed moments ago may not be reflected yet. A VenueID the caller can't see is silently ignored, not rejected — the response falls back to the caller's entire portfolio rather than emptying.

Read-only. GET and POST behave identically; GET also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoAuth
Request Body schema: application/json
optional
AccessToken
string

Cognito JWT. Verified by request validation only when non-empty; an absent token is not reported as such but falls through to 'Access Denied. ' 401. Overridden by an Authorization: Bearer header if one is sent.

OperatorID
string

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing -> 401 'OperatorID Missing. '); on success it is copied onto Operator.OperatorID and deleted from the request body. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Built.

VenueID
string

OPTIONAL - omitting it returns the caller's whole portfolio. When supplied it narrows Utilization to that venue, but only if the id is already in the caller's filtered map; an id that is not a key of that map leaves the un-narrowed map in place - no error, no empty result. It is ALSO the value tested by the Venue role branch, so a venue administrator MUST supply it or be rejected 401.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>"
}

Response samples

Content type
application/json
{
  • "Summary": {
    },
  • "Utilization": {
    },
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueLatestSnapshot (GET)

Latest cached utilization snapshot for the caller's venue portfolio — a per-venue map plus a portfolio rollup. Not scoped to a single venue by default; VenueID merely narrows it.

Roles: NetworkSoftwareProvider (must send OperatorID, sees the whole operator), NetworkOperator (sees the whole operator), or Venue admin (narrowed to their own venues). No anonymous fallthrough — an unrecognized caller is refused.

Data comes from a maintained cache (venueutil<OperatorID>), not a live query — a venue changed moments ago may not be reflected yet. A VenueID the caller can't see is silently ignored, not rejected — the response falls back to the caller's entire portfolio rather than emptying.

Read-only. GET and POST behave identically; GET also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT. Verified by request validation only when non-empty; an absent token is not reported as such but falls through to 'Access Denied. ' 401.

Overridden by an Authorization: Bearer header if one is sent. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

OperatorID
string
Example: OperatorID={Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing -> 401 'OperatorID Missing. '); on success it is copied onto Operator.OperatorID and deleted from the request body. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

VenueID
string
Example: VenueID={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}

OPTIONAL - omitting it returns the caller's whole portfolio. When supplied it narrows Utilization to that venue, but only if the id is already in the caller's filtered map; an id that is not simply leaves the unnarrowed map in place. It is ALSO the value tested by the Venue role branch, so a venue administrator MUST supply it or be rejected 401. Read from the query string only because the endpoint itself merges the query string into the request body on a GET; the endpoint code below that point cannot tell a query parameter from a body field.

Responses

Response samples

Content type
application/json
{
  • "Summary": {
    },
  • "Utilization": {
    },
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueRSSIDailyReport

One venue's RSSI (signal strength) histogram for a single report day — how many RADIUS-accounted connections were recorded at each RSSI value. Written by RADIUS session accounting with an 8-day TTL; a report date older than about a week returns an all-zero distribution rather than an error.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent for the requested VenueID. No anonymous fallthrough.

A VenueID that doesn't match one of the operator's cached venues returns Invalid VenueID. .

On success, RSSIDistribution is back-filled with a zero-connection entry for every RSSI value 1–127 the cache didn't supply, so a response always carries at least 127 entries even on a day with no data.

No Bearer-header fallback (unlike listVenueUnit6mReport/listVenueUnits) — the token must be sent as the AccessToken query parameter. GET responses also carry Cache-Control: private, max-age=5.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT access token. Validated only when non-empty; if omitted no role can be resolved and the request is denied 401.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
required
string

Venue whose RSSI histogram is returned; must be in the operator's cached venue list. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UsageReportStartDateUTC.ISO8601
string

Report day, parsed with new Date. Optional - defaults to the current time. Whatever is supplied is forced to 23:59:59.999 before the cache key is built, so only the calendar day matters. Sent as a literal dotted key name.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "UsageReportStartDateUTC.ISO8601": "string"
}

Response samples

Content type
application/json
{
  • "UsageReportStartDateUTC": "2019-08-24T14:15:22Z",
  • "RSSIDistribution": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueRSSIDailyReport (GET)

One venue's RSSI (signal strength) histogram for a single report day — how many RADIUS-accounted connections were recorded at each RSSI value. Written by RADIUS session accounting with an 8-day TTL; a report date older than about a week returns an all-zero distribution rather than an error.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent for the requested VenueID. No anonymous fallthrough.

A VenueID that doesn't match one of the operator's cached venues returns Invalid VenueID. .

On success, RSSIDistribution is back-filled with a zero-connection entry for every RSSI value 1–127 the cache didn't supply, so a response always carries at least 127 entries even on a day with no data.

No Bearer-header fallback (unlike listVenueUnit6mReport/listVenueUnits) — the token must be sent as the AccessToken query parameter. GET responses also carry Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
required
string

Cognito JWT access token. Validated only when non-empty; if omitted no role can be resolved and the request is denied 401.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
required
string

Venue whose RSSI histogram is returned; must be in the operator's cached venue list. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UsageReportStartDateUTC.ISO8601
string

Report day, parsed with new Date. Optional - defaults to the current time. Whatever is supplied is forced to 23:59:59.999 before the cache key is built, so only the calendar day matters. Sent as a literal dotted key name.

Responses

Response samples

Content type
application/json
{
  • "UsageReportStartDateUTC": "2019-08-24T14:15:22Z",
  • "RSSIDistribution": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueUnit6mReport

A fixed 180-entry daily bandwidth series (~6 months) for one venue unit, back-filled with zeros for missing days — the count is always 180, driven by a loop bound rather than the data. Rows come from the daily report scheduler (181-day TTL).

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent for the requested VenueID. No anonymous fallthrough.

Lookups: VenueID must be one of the operator's cached venues, then UnitID_internal must match exactly one of that venue's cached units — a non-match returns Invalid UnitID_internal. (still carrying UsageData: [], since that key is set before the match check).

GET merges query-string parameters into the same request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoAuth
header Parameters
Authorization
string

Optional Bearer <token> alternative to the body's AccessToken. The endpoint takes the second space-separated word and assigns it over the request's AccessToken.

Request Body schema: application/json
required
AccessToken
string

Cognito JWT access token; may instead be supplied as Authorization: Bearer <token>, which overwrites this field. Validated only when non-empty; if neither is present no role resolves and the request is denied 401.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
required
string

Venue that owns the unit; must be in the operator's cached venue list. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UnitID_internal
required
string

Unit whose usage series is returned; must match exactly one entry of the venue's cached unit list. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor} with each of the last three trimmed to 20 characters, stripped to [A-Za-z0-9_-] and upper-cased.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "UnitID_internal": "string"
}

Response samples

Content type
application/json
{
  • "UsageData": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueUnit6mReport (GET)

A fixed 180-entry daily bandwidth series (~6 months) for one venue unit, back-filled with zeros for missing days — the count is always 180, driven by a loop bound rather than the data. Rows come from the daily report scheduler (181-day TTL).

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent for the requested VenueID. No anonymous fallthrough.

Lookups: VenueID must be one of the operator's cached venues, then UnitID_internal must match exactly one of that venue's cached units — a non-match returns Invalid UnitID_internal. (still carrying UsageData: [], since that key is set before the match check).

GET merges query-string parameters into the same request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT access token; may instead be supplied as Authorization: Bearer <token>, which overwrites this field. Validated only when non-empty; if neither is present no role resolves and the request is denied 401.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
required
string

Venue that owns the unit; must be in the operator's cached venue list. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UnitID_internal
required
string

Unit whose usage series is returned; must match exactly one entry of the venue's cached unit list. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor} with each of the last three trimmed to 20 characters, stripped to [A-Za-z0-9_-] and upper-cased.

header Parameters
Authorization
string

Optional Bearer <token> alternative to the AccessToken query parameter; the endpoint takes the second space-separated word and assigns it over the request's AccessToken.

Responses

Response samples

Content type
application/json
{
  • "UsageData": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueUnits

Lists one venue's units — also serves the self-service shopping cart. No token required; an absent or unmatched token resolves to the Public role.

Access: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the requested VenueID), Subscriber, or Public.

Two response shapes, both under VenueUnits: a cut-down cart projection for Public callers, a fuller console projection for everyone else.

Extra filtering for Subscriber and Public: occupied units are dropped unless the caller already holds them; cart-disabled units are also dropped. NetworkSoftwareProvider/NetworkOperator/Venue callers see everything.

api-version gate: StrictPSK and (console projection) NetworkConfiguration.VenueUnitSSID require api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

An unknown venue is not an error — 200 with no VenueUnits key.

Authorizations:
CognitoAuth
header Parameters
api-version
string

Parsed with parseInt. At >= 20260417 (or after the 2026-11-17 sunset) the response gains StrictPSK and, in the console projection, NetworkConfiguration.VenueUnitSSID; below that a deprecation notice is appended to message. An origin containing '-preview' overrides whatever is sent with the deployed CODE_BRANCH.

Authorization
string

Optional Bearer <token> alternative to AccessToken. The endpoint takes the second space-separated word and assigns it over the request's AccessToken.

Request Body schema: application/json
required
AccessToken
string

Cognito JWT access token; may instead be supplied as Authorization: Bearer <token>, which overwrites this field. Optional - omitting it yields Public access rather than a rejection.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
string

Venue whose units are listed. Required unless it can be derived from externalVenueID, externalVenueUnitID or UnitID_internal; otherwise 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

Operator's own venue identifier; resolved to VenueID through venue_ext<OperatorID>:<externalVenueID>. Ignored for Public callers. A miss is silent - the request then fails only if VenueID is still absent.

externalVenueUnitID
string

Operator's own unit identifier; resolved to UnitID_internal (and VenueID when absent) through venueunit_ext<OperatorID>:<externalVenueUnitID>. Ignored for Public callers. If the lookup returns a row set that does not narrow to exactly one unit, the request is rejected 400.

UnitID_internal
string

Restricts the result to a single unit and resolves VenueID when it is absent. If the lookup returns a row set that does not narrow to exactly one unit, the request is rejected 400. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor} with each of the last three trimmed to 20 characters, stripped to [A-Za-z0-9_-] and upper-cased.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "externalVenueID": "string",
  • "externalVenueUnitID": "string",
  • "UnitID_internal": "string"
}

Response samples

Content type
application/json
{
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 0,
  • "message": "string",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenueUnits (GET)

Lists one venue's units — also serves the self-service shopping cart. No token required; an absent or unmatched token resolves to the Public role.

Access: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the requested VenueID), Subscriber, or Public.

Two response shapes, both under VenueUnits: a cut-down cart projection for Public callers, a fuller console projection for everyone else.

Extra filtering for Subscriber and Public: occupied units are dropped unless the caller already holds them; cart-disabled units are also dropped. NetworkSoftwareProvider/NetworkOperator/Venue callers see everything.

api-version gate: StrictPSK and (console projection) NetworkConfiguration.VenueUnitSSID require api-version: 20260417 or higher; below that, a version-upgrade notice is appended to message on every response.

An unknown venue is not an error — 200 with no VenueUnits key.

GET form: parameters come from the query string; responses add Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT access token; may instead be supplied as Authorization: Bearer <token>, which overwrites this field. Optional - omitting it yields Public access rather than a rejection.

OperatorID
string

Target operator. Required only for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
string

Venue whose units are listed. Required unless it can be derived from externalVenueID, externalVenueUnitID or UnitID_internal; otherwise 400. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

externalVenueID
string

Operator's own venue identifier; resolved to VenueID through venue_ext<OperatorID>:<externalVenueID>. Ignored for Public callers. A miss is silent - the request then fails only if VenueID is still absent.

externalVenueUnitID
string

Operator's own unit identifier; resolved to UnitID_internal (and VenueID when absent) through venueunit_ext<OperatorID>:<externalVenueUnitID>. Ignored for Public callers. If the lookup returns a row set that does not narrow to exactly one unit, the request is rejected 400.

UnitID_internal
string

Restricts the result to a single unit and resolves VenueID when it is absent. If the lookup returns a row set that does not narrow to exactly one unit, the request is rejected 400. Format is {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor} with each of the last three trimmed to 20 characters, stripped to [A-Za-z0-9_-] and upper-cased.

header Parameters
api-version
string

Parsed with parseInt. At >= 20260417 (or after the 2026-11-17 sunset) the response gains StrictPSK and, in the console projection, NetworkConfiguration.VenueUnitSSID; below that a deprecation notice is appended to message. An origin containing '-preview' overrides whatever is sent with the deployed CODE_BRANCH.

Authorization
string

Optional Bearer <token> alternative to AccessToken. The endpoint takes the second space-separated word and assigns it over the request's AccessToken.

Responses

Response samples

Content type
application/json
{
  • "VenueUnits": [
    ],
  • "VenueUnitCount": 0,
  • "message": "string",
  • "errorProcessing": false
}

/operatorconsole/venues/listVenues

List the operator's venues, role-filtered, from the operator's cached venue list. The operator is resolved from Origin.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue), NetworkOperator (sees every venue), Venue admin/leasing agent (filtered to their own VenueIDs), or Public — INCLUDING a request with no access token at all. A Public caller sees venues only when the operator's shopping cart is enabled.

Trimmed per venue: internal config sections, Stripe adjustments, dateAddedUTC are removed; a DailyReport is added.

Read-only. GET reads the query string (merged after validation) and adds Cache-Control: private, max-age=5.

Authorizations:
CognitoAuth
Request Body schema: application/json
optional

JSON object. A body is not required: with no AccessToken the caller is simply treated as Public. If a body IS sent it must be valid JSON - request validation rejects a non-JSON non-empty body with 401 'Malformed JSON in input. '.

AccessToken
string

Cognito access-token JWT. Optional; absent means Public. May instead be supplied as an Authorization: Bearer <JWT> request header, which overrides this property.

IdToken
string

Cognito id token, honoured only when an AccessToken is also present.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller; ignored otherwise.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

/operatorconsole/venues/listVenues (GET)

List the operator's venues, role-filtered, from the operator's cached venue list. The operator is resolved from Origin.

Roles: NetworkSoftwareProvider (must send OperatorID, sees every venue), NetworkOperator (sees every venue), Venue admin/leasing agent (filtered to their own VenueIDs), or Public — INCLUDING a request with no access token at all. A Public caller sees venues only when the operator's shopping cart is enabled.

Trimmed per venue: internal config sections, Stripe adjustments, dateAddedUTC are removed; a DailyReport is added.

Read-only. GET reads the query string (merged after validation) and adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT. Optional: with no token the caller is treated as Public. Merged from the query string. May instead be supplied as an Authorization: Bearer <JWT> request header - see the operation description.

IdToken
string

Cognito id token. Read only inside validateAccessToken, which itself runs only when an AccessToken is also supplied; when present the id token is verified instead of the access token and the username comes from preferred_username or an email lookup.

OperatorID
string

Target operator. Required ONLY when the caller is a NetworkSoftwareProvider; its absence for such a caller is a 401. Ignored for every other caller.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "VenueList": {
    },
  • "VenueCount": 0,
  • "UnitCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "UnitCount_LocalWirelessAccess": 0,
  • "UnitCount_GlobalWirelessRoaming": 0,
  • "PolicyCount_GlobalWirelessPlusLocalWiredAccess": 0,
  • "PolicyCount_LocalWirelessAccess": 0,
  • "DeviceCount": 0,
  • "OnlineDeviceCount": 0
}

Subscribers

👥 Subscriber Database & Management

Complete subscriber database management system for tracking, monitoring, and administering all subscriber accounts and services.

Subscriber Database

  • 📋 Account Registry: Comprehensive subscriber information and service history
  • 🔍 Search & Filtering: Advanced search capabilities with multi-criteria filtering
  • 📊 Bulk Operations: Mass updates, imports, and data management tools
  • 📈 Analytics Engine: Subscriber behavior, churn analysis, and lifecycle tracking
  • 🔄 Data Synchronization: External system integration and data consistency
  • 📋 Compliance Management: Data privacy, retention policies, and audit trails

Management Tools

  • 👤 Profile Management: Detailed subscriber profiles and service configurations
  • 💳 Financial Overview: Payment history, billing status, and revenue tracking
  • 🎯 Segmentation: Customer segmentation for targeted communications and offers
  • 📊 Reporting Suite: Comprehensive subscriber analytics and business intelligence

/venuemgmtconsole/subscribers/validateEmailAddress

Looks a subscriber up by email address and returns their cached profile. Performs no email-format validation and writes nothing — it either returns the profile or rejects.

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, or Venue admin/leasing agent for the requested VenueID. There is no subscriber or Public fallback — a plain subscriber token is refused even for their own address.

Lookup runs only when EmailAddress is at least 5 characters; the profile is returned only when exactly one cached record matches and belongs to the caller's operator. Anything else is 401 'Subscriber not found.'.

⚠ Known quirk: the lookup runs even for an already-rejected request — a caller with no access token, or refused with 'Access Denied. ', can still have profile fields written into the body of their 401. Documented as shipped, not as intended behavior.

Authorizations:
CognitoUserPool
header Parameters
Authorization
string

Bearer <jwt>. When the header is present and non-empty the endpoint takes the part after the first space and writes it over the AccessToken carried in the request, so the header WINS over an AccessToken field. A header with no space yields an undefined token, which then fails the mandatory-token gate with 401 'AccessToken Missing. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else (and an absent header) selects English.

Request Body schema: application/json
optional
EmailAddress
required
string <email> >= 5 characters

The subscriber's email. Ignored unless its length is at least 5, and lower-cased by the shared request sanitiser before the operator-namespaced cache read. Absent or shorter than 5 characters produces 401 'Subscriber not found.', not a validation error.

AccessToken
string

Cognito JWT. Overridden by the Authorization header when that is present; missing from both is 401 'AccessToken Missing. '. It is only cryptographically verified when the Origin-resolved operator has a Cognito pool configured.

IdToken
string

Optional Cognito ID token, read only by the shared token validation and only when the access token's username was not already cached; in that case the ID token is the one verified and the username comes from its preferred_username claim, falling back to an email-to-username cache lookup.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it becomes the operator context and is then deleted from the request. Ignored for every other role, whose operator comes from the request Origin.

VenueID
string

Used ONLY to grant the Venue role - it must appear in the token's VenueAdministrator or LeasingAgent list. It does not filter the lookup, though a Venue caller's resolved subscriber must hold at least one venue the caller administers. Format is {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}; no example is shown because any realistic value names a real venue.

SubscriberToken
string

Accepted by the parser but DELETED before the lookup, so it has no effect on this operation.

externalSubscriberID
string

Accepted by the parser but DELETED before the lookup, so it has no effect on this operation.

PhoneNumber
string

Accepted by the parser but DELETED before the lookup, so it has no effect on this operation.

Responses

Request samples

Content type
application/json
{
  • "EmailAddress": "subscriber@example.com",
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "PhoneNumber": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "GivenName": "string",
  • "FamilyName": "",
  • "PhoneNumber": "",
  • "PhoneNumber.E164": "",
  • "locale": "en-us",
  • "contactpref_sms": false,
  • "contactpref_email": true,
  • "errorProcessing": false
}

/venuemgmtconsole/subscribers/validateEmailAddress (GET)

Looks a subscriber up by email address and returns their cached profile. Performs no email-format validation and writes nothing — it either returns the profile or rejects.

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, or Venue admin/leasing agent for the requested VenueID. There is no subscriber or Public fallback — a plain subscriber token is refused even for their own address.

Lookup runs only when EmailAddress is at least 5 characters; the profile is returned only when exactly one cached record matches and belongs to the caller's operator. Anything else is 401 'Subscriber not found.'.

⚠ Known quirk: the lookup runs even for an already-rejected request — a caller with no access token, or refused with 'Access Denied. ', can still have profile fields written into the body of their 401. Documented as shipped, not as intended behavior.

GET form: fields come from the query string; responses add Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
EmailAddress
required
string <email> >= 5 characters
Example: EmailAddress=subscriber@example.com

The subscriber's email. Ignored unless its length is at least 5; it is the only usable lookup key on this operation. Absent or shorter than 5 characters produces 401 'Subscriber not found.', not a validation error. Marked required because without it the call cannot succeed.

AccessToken
string

Cognito JWT, merged into the request body. Not marked required because it may instead arrive in the Authorization header, which overrides it - but one of the two MUST be present or the call is 401 'AccessToken Missing. '.

IdToken
string

Optional Cognito ID token, read only by the shared token validation and only when the access token's username was not already cached; in that case the ID token is the one verified and the username comes from its preferred_username claim.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it becomes the operator context and is then deleted from the request. Ignored for every other role.

VenueID
string

Used ONLY to grant the Venue role - it must appear in the token's VenueAdministrator or LeasingAgent list. It does not filter the lookup, though a Venue caller's resolved subscriber must hold at least one venue the caller administers. Format is {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}; no example is shown because any realistic value names a real venue.

SubscriberToken
string

Accepted by the parser but DELETED before the lookup, so it has no effect on this operation.

externalSubscriberID
string

Accepted by the parser but DELETED before the lookup, so it has no effect on this operation.

PhoneNumber
string

Accepted by the parser but DELETED before the lookup, so it has no effect on this operation.

header Parameters
Authorization
string

Bearer <jwt>. When the header is present and non-empty the endpoint takes the part after the first space and writes it over the AccessToken carried in the request, so the header WINS over an AccessToken field. A header with no space yields an undefined token, which then fails the mandatory-token gate with 401 'AccessToken Missing. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else (and an absent header) selects English.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "GivenName": "string",
  • "FamilyName": "",
  • "PhoneNumber": "",
  • "PhoneNumber.E164": "",
  • "locale": "en-us",
  • "contactpref_sms": false,
  • "contactpref_email": true,
  • "errorProcessing": false
}

/venuemgmtconsole/subscribers/listMessages (GET)

Returns messages sent to a subscriber. The same handler is also mounted on the operator console under a different path — behavior is decided entirely by the caller's role, not the URL.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (confined to venues it administers), or Subscriber. A caller supplying none of PhoneNumber.E164/EmailAddress/SubscriberToken/externalSubscriberID is treated as reading its own messages.

⚠ Naming a subscriber by bare PhoneNumber reclassifies the caller as a Subscriber — the Venue-scope confinement and SubscriberToken ownership check are then bypassed.

VenueID narrows to that venue's messages; without it, an operator/venue caller naming a subscriber by SubscriberToken must pass an ownership check that the token belongs to the calling operator. Messages have a six-month TTL — nothing older than ~180 days is returned.

GET reads the query string; its response adds Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token. Absent/empty both here and in the Authorization header is 401 'AccessToken Missing. '. It is verified only when the operator record resolved from the request Origin carries a Cognito pool.

IdToken
string

Optional Cognito ID token. Used by the shared token validator only when the access token's username is not already cached: the ID token is verified instead and its preferred_username, or its email resolved through the operator's email index, becomes the caller identity.

OperatorID
string
Example: OperatorID={Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}

REQUIRED for a NetworkSoftwareProvider caller (missing is 401 'OperatorID Missing. '); it then becomes the operator context used for both the subscriber lookup and the ownership check, and is removed from the request. Ignored for every other caller.

VenueID
string

Two effects: it is the value matched against a caller's VenueAdministrator/LeasingAgent arrays to grant the Venue role, and when non-empty it switches the read to the venue+subscriber index so only that venue's messages are returned. When it is absent the subscriber index is used and an operator/venue caller that named the subscriber by SubscriberToken must pass the ownership check. Composite Vault VenueID, {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Target subscriber; highest-precedence lookup key. Ignored for a Subscriber caller, which always reads its own token. Supplying it is what triggers the operator-ownership check on the no-VenueID path.

externalSubscriberID
string

Subscriber lookup key, used when SubscriberToken is absent; resolved through the operator's external-ID index.

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

Subscriber lookup key, used when SubscriberToken and externalSubscriberID are absent. On GET the value is merged into the request AFTER the shared request sanitiser has run, so that lower-casing pass never sees it; the address is lower-cased where the cache key is built, so the lookup is still case-insensitive.

PhoneNumber.E164
string

Subscriber lookup key of last resort, and only for a NetworkSoftwareProvider, NetworkOperator or Venue caller - only for those roles is it copied to the internal PhoneNumber field the resolver reads. The phone index is matched by exact string, so the value must be stored exactly as it is sent. Note the key contains a literal dot.

PhoneNumber
string

Subscriber lookup key read directly by the resolver, after SubscriberToken, externalSubscriberID and EmailAddress and matched against the operator's phone index by exact string. Unlike PhoneNumber.E164 it is not role-gated, and it is not one of the four keys the Subscriber fallback tests, so a request that carries it alone is treated as a Subscriber caller: the Venue-scope confinement and the SubscriberToken ownership check are both skipped. For a NetworkSoftwareProvider, NetworkOperator or Venue caller a supplied PhoneNumber.E164 overwrites this value.

header Parameters
Authorization
string

'Bearer '. When present and non-empty the substring after the first space is used as the AccessToken, OVERWRITING any AccessToken in the query string. A header with no space yields an empty token and is then treated as missing (401 'AccessToken Missing. ').

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else the English one. Affects rejection text only.

Responses

Response samples

Content type
application/json
{
  • "messages": {
    },
  • "message": "",
  • "errorProcessing": false
}

/venuemgmtconsole/subscribers/listSessions (GET)

Returns a fixed 168-entry hourly bandwidth roll-up for one subscriber, covering the last 7 days (falls back to the session cluster when device-bandwidth isn't configured).

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), or Subscriber. The subscriber is selected by PhoneNumber.E164, EmailAddress, SubscriberToken or externalSubscriberID; if none are sent (or the caller is a subscriber), the caller's own usage is returned. A Venue-role caller is limited to subscribers sharing a venue with them.

Window: the last 7 days, hourly buckets (168 total) — the storage layer expires accounting data after 8 days, making 7 days the practical maximum.

Two fields that don't filter, despite their names: VenueID does not narrow the totals (both branches sum the same data); Calling-Station-Id only replaces the reported device list per hour, the octet totals still cover every device.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT, merged into the request body. Not marked required because it may instead arrive in the Authorization header - but one of the two MUST be present or the call is 401 'AccessToken Missing. '. It is only cryptographically verified when the Origin-resolved operator has a Cognito pool configured.

IdToken
string

Optional Cognito ID token, read only by the shared token validation and only when the access token's username was not already cached; in that case the ID token is the one verified and the username comes from its preferred_username claim.

OperatorID
string

Target operator. Read ONLY on the NetworkSoftwareProvider branch, where it is mandatory (401 'OperatorID Missing. ' otherwise) and is deleted from the request once copied into the operator context. Ignored for every other role.

VenueID
string

Grants the Venue role (it must appear in the caller's VenueAdministrator or LeasingAgent list). It is also compared against each stored session's venue, but that comparison changes nothing - both branches add the same figures - so it does NOT scope the usage figures. Format is {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}; no example is shown because any realistic value names a real venue.

SubscriberToken
string

Target subscriber, used verbatim when present - it short-circuits the other three lookup keys. No operator-ownership check is applied to it on this endpoint.

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

Subscriber lookup key; used only when no SubscriberToken and no externalSubscriberID were supplied. NOTE a GET-only quirk: the shared request sanitiser lower-cases EmailAddress BEFORE the query string is merged, so on a GET it is the cache-key builder that lower-cases it instead. The effect is the same.

externalSubscriberID
string

Operator-side subscriber identifier, resolved through an operator-namespaced cache key; used only when no SubscriberToken was supplied.

PhoneNumber.E164
string

LITERAL dotted parameter name. For an operator/venue-role caller it is copied onto PhoneNumber and resolved through the operator-namespaced phone cache. E.164 form; no example is shown because any realistic value is a real subscriber's number.

PhoneNumber
string

The key the cache lookup actually reads. A request carrying only this resolves the subscriber by phone, after first being re-labelled Subscriber.

Calling-Station-Id
string

Device MAC. Hyphens become colons and the value is upper-cased, then colons are stripped and it is lower-cased. It does NOT filter the octet figures - it only replaces the per-hour device list in the response with this one value.

header Parameters
Authorization
string

Bearer <jwt>. When the header is present and non-empty the endpoint takes the part after the first space and writes it over the AccessToken carried in the request, so the header WINS over an AccessToken field. A header with no space yields an undefined token, which then fails the mandatory-token gate with 401 'AccessToken Missing. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else (and an absent header) selects English.

Responses

Response samples

Content type
application/json
{
  • "UsageData": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/venuemgmtconsole/subscribers/listSubscriberLog (GET)

Returns one subscriber's audit and event log, newest first. The subscriber is identified by SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber, tried in that order.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (any subscriber of the operator), a Venue admin/leasing agent (only a subscriber with a subscription, current or past, at a venue they administer — otherwise reported as not found), or the Subscriber themself (always their own log).

Filtering: searchText runs a fuzzy match; a whitelist of exact-match fields is available, or raw OpenSearch customQuery (which replaces the whitelist). The date window defaults to now for the upper bound and is unbounded below unless you send a lower bound — sending one also switches totalCount from a capped estimate to an exact count. Results are newest-first, paged via searchBefore.

GET reads parameters from the query string: only single-valued filters are supported — array filters, customQuery and paging past the first page require the POST form. Responses carry Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string
Example: AccessToken=<Cognito JWT access token>

Cognito access token, as an alternative to the Authorization header. Absent from both gives 401 'AccessToken Missing. '.

SubscriberToken
string
Example: SubscriberToken=<SubscriberToken>

The subscriber whose log is wanted, given directly. Highest priority of the four identifier parameters. For a Subscriber caller this value is IGNORED and replaced with the caller's own token. It is also on the exact-match filter whitelist, so supplying it adds a second, identical term clause - harmless.

externalSubscriberID
string
Example: externalSubscriberID=EXT-SUB-1

The operator's own subscriber identifier. Used only when SubscriberToken is absent. Resolved through the operator's external-id index and must match exactly one record.

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

The subscriber's email address. Used only when SubscriberToken and externalSubscriberID are both absent. Lower-cased before the index lookup and must match exactly one record.

PhoneNumber
string
Example: PhoneNumber=+15555550123

The subscriber's phone number. Lowest priority - used only when none of the three above is present. Matched verbatim (no normalisation is applied at this point), so it must be in the same form the operator's phone index was written with.

VenueID
string
Example: VenueID={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}

Doubles as the venue-scope selector and as an exact-match filter. A caller whose only role is VenueAdministrator or LeasingAgent is classified as a Venue caller ONLY if this matches a venue they hold; the same value is then forced onto the query as a VenueID term, so their view of the subscriber's log is limited to that venue.

OperatorID
string

The operator whose log is wanted. REQUIRED for a NetworkSoftwareProvider caller, which otherwise gets 401 'OperatorID Missing. '. For every other caller the operator is taken from the request Origin and this parameter has no effect.

MinViewWindowDateUTC.ISO8601
string <date-time>
Example: MinViewWindowDateUTC.ISO8601=2026-08-01T00:00:00.000Z

Lower bound of the @timestamp range. DEFAULTS TO NONE - omit it and the query has no lower bound. Supplying it also switches total counting to exact mode; without it totalCount is capped at 10000. An unparseable value is a 400.

MaxViewWindowDateUTC.ISO8601
string <date-time>
Example: MaxViewWindowDateUTC.ISO8601=2026-08-19T23:59:59.999Z

Upper bound of the @timestamp range. Defaults to the request time plus a 60-second OpenSearch indexing-lag buffer. An unparseable value is a 400.

pageSize
integer [ 1 .. 500 ]
Default: 250
Example: pageSize=250

Entries per page, capped at 500. Omit it for the default of 250. Because the value arrives as a string, '0' is truthy here and produces an empty page rather than the default.

searchText
string
Example: searchText=password reset

Fuzzy full-text search across event, function_name, Administrator, SourceIP, SubscriberToken and LogType (best_fields, operator 'and', fuzziness AUTO).

function_name
string

Exact-match filter on the function_name field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query. The Vault function or route that emitted the entry.

LogType
string

Exact-match filter on the LogType field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query. For example 'INFO' or 'ERROR' - the emitter's own label, not a validated enum. Note that LogType is filterable but is NOT among the fields this resource returns.

Administrator
string

Exact-match filter on the Administrator field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

AdministratorOS
string

Exact-match filter on the AdministratorOS field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

AdministratorBrowser
string

Exact-match filter on the AdministratorBrowser field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

SourceIP
string

Exact-match filter on the SourceIP field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

SourceLocale
string

Exact-match filter on the SourceLocale field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

UnitID_internal
string

Exact-match filter on the UnitID_internal field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query. Format: {VenueID}.{UNITID}.{UNITBUILDING}.{UNITFLOOR}.

EquipmentID
string

Exact-match filter on the EquipmentID field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

KeyPoolID
string

Exact-match filter on the KeyPoolID field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

ServicePlanID
string

Exact-match filter on the ServicePlanID field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

header Parameters
Authorization
string
Example: Bearer <Cognito JWT access token>

Bearer token for authentication, and the preferred way to authenticate this form. When present, the second whitespace-separated word of the header REPLACES any AccessToken supplied as a query parameter.

Accept-Language
string
Example: en-US

Selects the language of the error messages. A first tag beginning with 'es' selects Spanish (Latin America); anything else selects English (US). It has no effect on the log entries themselves.

Responses

Response samples

Content type
application/json
Example
{
  • "log": [
    ],
  • "currentCount": 2,
  • "totalCount": 2,
  • "pageSize": 250,
  • "hasMore": false,
  • "MinViewWindowDateUTC.ISO8601": "2026-08-01T00:00:00.000Z",
  • "MaxViewWindowDateUTC.ISO8601": "2026-08-19T12:01:00.000Z",
  • "allowedFilterFields": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/addKey

Create a subscriber and their subscription (Wi-Fi key) at a venue unit. If SubscriberToken already identifies an existing subscriber of this operator, no new subscription is created — only externalSubscriberID, externalSubscriptionID and contactpref_sms are updated on the subscriber and their subscriptions.

Requires NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the resolved operator.

Wi-Fi key. Supply NewKey / UserPartofKey / LegacyPSK to choose the key, or omit it to auto-generate one. If the venue unit has StrictPSK enabled, a supplied key must meet the strict complexity rules (8-63 characters, an uppercase, a lowercase, a digit and one special character) or the request is rejected; an auto-generated key is always made compliant.

Set ignore_subscription to create only the subscriber, without a venue unit or subscription.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT for an operator staff member.

SubscriberToken
string

Presence with length > 0 switches the call into the update-only branch - no key is created. Omit it to create.

EmailAddress
string

Sanitised; a value that sanitises to falsy is rejected. Also used to find an existing subscriber.

PhoneNumber.E164
string

Subscriber phone in E.164. Note the dotted name - the shopping cart posts plain PhoneNumber, console callers post PhoneNumber.E164. A value whose string form contains 'null' is dropped outright. Never echoed back: it is deleted from the response.

GivenName
string

Sanitised; a value that sanitises to falsy is rejected.

FamilyName
string

Sanitised; a value that sanitises to falsy is rejected.

externalSubscriberID
string

Operator's own subscriber id. Trimmed to 64 chars and used to find an existing subscriber; resolving to more than one subscriber is an error.

externalSubscriptionID
string

Operator's own subscription id. Auto-generated as a UUID when absent on the create path.

contactpref_sms
boolean

SMS contact preference. The two branches use DIFFERENT operators. contactpref_email is NOT caller-settable - it is hard-coded true on the subscriber and on the subscription record.

locale
string

Subscriber locale. NOT validated - any other value is silently COERCED to 'en-us' rather than rejected: on the create path overwrites anything that is not exactly 'en-us' or 'es-xl' with 'en-us' (an absent locale defaults to 'en-us'), and the value written onto the subscription record is re-resolved the same way. The two values the code recognises are 'en-us' and 'es-xl'.

UnitID_internal
string

Preferred way to name the venue unit; also used to pick up venue-level Stripe config. May be sent flat or inside PolicyforSubscriberKey.

externalVenueUnitID
string

Alternative unit selector.

VenueID
string

Scopes the unit search. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (documented, worked value).

externalVenueID
string

Scopes the unit search by the operator's own venue id.

UnitID
string

Address-tuple unit selector; trimmed and truncated to 40 chars. May be sent flat or inside PolicyforSubscriberKey.

UnitBuilding
string

Address-tuple selector, trimmed to 40 chars.

UnitFloor
string

Address-tuple selector, trimmed to 40 chars.

AddressLine1
string

Address-tuple selector, trimmed to 40 chars.

AddressLine2
string

Address-tuple selector, trimmed to 40 chars.

City
string

Address-tuple selector, trimmed to 40 chars.

State
string

Address-tuple selector, trimmed to 40 chars.

Country.ISO3166A3
string

Address-tuple selector, trimmed to 40 chars.

PostalCode
string

Address-tuple selector, trimmed to 40 chars.

PolicyforSubscriberKey
object

Optional wrapper. The endpoint copies UnitID_internal, UnitID, UnitBuilding, UnitFloor, AddressLine1, AddressLine2, City, State, Country.ISO3166A3 and PostalCode out of it onto the request root and then deletes it. Any other key nested here is lost.

ServicePlanID
string

Service plan to subscribe to. When neither this nor externalServicePlanID is given, the unit's DefaultServicePlanID is used, then the operator's defaults.

externalServicePlanID
string

Alternative plan selector.

UserPartForNewKey
string

User-chosen portion of the generated PSK, 1-40 characters, WPA-valid. UserPartofKey is accepted as an alias and renamed on arrival. When no LegacyPSK is in play the stored psk is this value + '.' + the SubscriberToken; if it is absent the code substitutes a 1-character random string - or, when the resolved StrictPSK is true for the unit, an 8-character string carrying an uppercase, a lowercase, a digit and a special character (special drawn from !#+-=@_). Where the resolved StrictPSK is true for the unit this field is REFUSED with 401 (the composed value contains a '.' and can never be StrictPSK-compliant): omit it to have a compliant key generated, or supply a compliant full key instead.

UserPartofKey
string

Alias for UserPartForNewKey.

LegacyPSK
string

Import an existing PSK: 8-63 characters, WPA-valid, and if it contains a dot the final segment must be 5 characters or fewer. Accepted only for this route - every other caller has it deleted - and it must not already be in use by a live subscription. NewKey is accepted as an alias and renamed onto this field.

WARNING: when the request carries NO NewKey and NO UserPartForNewKey, and the operator record has CustomPSK === true, the auto-generator OVERWRITES this value with a random PSK. To import a PSK on such an operator, send it as NewKey (which is renamed with no CustomPSK check) or supply UserPartForNewKey.

NewKey
string

Alias for LegacyPSK, renamed onto it at with no CustomPSK check - unlike a directly-supplied LegacyPSK it is never overwritten by auto-generator.

InvoiceDateTimeUTC.ISO8601
string

Anchor date for the first invoice; must parse to a valid Date. Supplying it forces TrialCycles to 0. Accepted only for this route.

StartDateTimeUTC.ISO8601
string

Subscription start. A past value is replaced by now; a future value on a wired unit is normalised to local start-of-day unless doNotResetDatetoMidnight is strictly true.

EndDateTimeUTC.ISO8601
string

Subscription end. A past value is dropped; a future value on a wired unit is normalised to local end-of-day unless doNotResetDatetoMidnight is strictly true.

doNotResetDatetoMidnight
boolean

Only a strict true suppresses the midnight normalisation - the string "true" does not.

ignore_subscription
any

Any truthy value skips venue-unit resolution and subscription creation entirely.

RealPageLeaseID
string

Stored on the new subscription when supplied.

EntrataLeaseID
string

Stored on the new subscription when supplied.

EntrataCustomerID
string

Stored on the new subscription when supplied.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "string",
  • "PhoneNumber.E164": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "externalSubscriberID": "string",
  • "externalSubscriptionID": "string",
  • "contactpref_sms": true,
  • "locale": "en-us",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string",
  • "VenueID": "string",
  • "externalVenueID": "string",
  • "UnitID": "string",
  • "UnitBuilding": "string",
  • "UnitFloor": "string",
  • "AddressLine1": "string",
  • "AddressLine2": "string",
  • "City": "string",
  • "State": "string",
  • "Country.ISO3166A3": "string",
  • "PostalCode": "string",
  • "PolicyforSubscriberKey": { },
  • "ServicePlanID": "string",
  • "externalServicePlanID": "string",
  • "UserPartForNewKey": "string",
  • "UserPartofKey": "string",
  • "LegacyPSK": "string",
  • "NewKey": "string",
  • "InvoiceDateTimeUTC.ISO8601": "string",
  • "StartDateTimeUTC.ISO8601": "string",
  • "EndDateTimeUTC.ISO8601": "string",
  • "doNotResetDatetoMidnight": true,
  • "ignore_subscription": null,
  • "RealPageLeaseID": "string",
  • "EntrataLeaseID": "string",
  • "EntrataCustomerID": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "Status": "string",
  • "Username": "string",
  • "locale": "string",
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "StripeCustomerID": "string",
  • "StripeSetupIntentId": "string",
  • "StripeClientSecret": "string",
  • "StripePublishableKey": "string",
  • "CustomerID": "string",
  • "SetupIntentId": "string",
  • "paymentFailed": true,
  • "FirstInvoiceDateUTC.ISO8601": "string",
  • "Subscription": { },
  • "errorProcessing": false
}

/networkoperatorconsole/admin/deleteSubscriberTransactionsPermanently

Deletes a subscriber's subscription/transaction history — the subscriber account, Cognito user and any admin access are left in place (that's deleteSubscriberAccountPermanently, which calls this as its first step).

Ends every still-active subscription first (attempting any owed Stripe refund), then REFUSES to proceed while any subscription is still mid-activation or has gateways to decommission — only then batch-deletes the rows and invalidates the related PSK-policy caches.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token. Absent rejects with HTTP 401 and message 'AccessToken missing from request'. The operator scope (OperatorID) is NOT taken from the token: it is resolved from the request Origin header, which request validation.validateUIDomain records and getCognitoData maps to the operator record. The token supplies only the AdministrativeAccess arrays, which are checked against that OperatorID.

Format: a Cognito JWT access token string. The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the resolved OperatorID, otherwise HTTP 401 'Administrative Access denied (2). ' (message, statusCode).

SubscriberToken
string

Subscriber identity. SubscriberToken is used directly when it is a non-empty string; otherwise the service calls request validation, which resolves the token from exactly one alternative field in this priority order: externalSubscriberID, then EmailAddress (lower-cased before lookup), then PhoneNumber - note the plain name PhoneNumber, NOT 'PhoneNumber.E164'. Each alternative is a reverse-index lookup that yields a token only on an exact single hit, so a value that is absent from the cache resolves to '' and the request is rejected with 401 'Subscriber missing in request. '.

Format: the subscriber's opaque vault token, which is also the Cognito username.

externalSubscriberID
string

Alternative identifier, used only when SubscriberToken is absent or empty. Resolved through the operator's external-subscriber-id index.

EmailAddress
string

Alternative identifier, used only when SubscriberToken and externalSubscriberID are both absent or empty. Resolved through the operator's external-subscriber-id index lower-cased}'.

PhoneNumber
string

Last-resort alternative identifier. Resolved through the operator's external-subscriber-id index. The field is named PhoneNumber, not 'PhoneNumber.E164'; the value is used verbatim with no normalisation.

property name*
additional property
any

Responses

Request samples

Content type
application/json
Example
{
  • "AccessToken": "<cognito-access-token>",
  • "SubscriberToken": "<subscriber-token>"
}

Response samples

Content type
application/json
Example
{
  • "message": "Transactions removed. ",
  • "EndDateTimeUTC.ISO8601": "2026-08-19T12:00:00.000Z",
  • "errorProcessing": false
}

/networkoperatorconsole/admin/deleteSubscriberAccountPermanently

Permanently deletes a subscriber account in strict stages, each skipped once a prior stage fails: (1) end every active subscription and batch-delete the subscription rows; (2) remove the subscriber's admin access, using the email captured BEFORE deletion; (3) mark the subscriber's OpenSearch log documents for deletion (performed later by a cleaner job).

Irreversible for the subscription/subscriber data; the OpenSearch marking step is safely retryable.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token. Absent rejects with HTTP 401 and message 'AccessToken missing from request'. The operator scope (OperatorID) is NOT taken from the token: it is resolved from the request Origin header, which request validation.validateAPIRequestHygeine records (validateUIDomain, only RESOLVES that origin to a domain record) and getCognitoData maps to the operator record. The token supplies only the AdministrativeAccess arrays, which are checked against that OperatorID.

Format: a Cognito JWT access token string. The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the resolved OperatorID, otherwise HTTP 401 'Administrative Access denied (2). ' (message, statusCode).

SubscriberToken
string

Subscriber identity. SubscriberToken is used directly when it is a non-empty string; otherwise the service calls request validation, which resolves the token from exactly one alternative field in this priority order: externalSubscriberID, then EmailAddress (lower-cased before lookup), then PhoneNumber - note the plain name PhoneNumber, NOT 'PhoneNumber.E164'. Each alternative is a reverse-index lookup that yields a token only on an exact single hit, so a value that is absent from the cache resolves to '' and the request is rejected with 401 'Subscriber missing in request. '.

Format: the subscriber's opaque vault token, which is also the Cognito username used for the ListUsers/DeleteUser calls.

externalSubscriberID
string

Alternative identifier, used only when SubscriberToken is absent or empty. Resolved through the operator's external-subscriber-id index.

EmailAddress
string

Alternative identifier, used only when SubscriberToken and externalSubscriberID are both absent or empty. Resolved through the operator's external-subscriber-id index lower-cased}'.

PhoneNumber
string

Last-resort alternative identifier. Resolved through the operator's external-subscriber-id index. The field is named PhoneNumber, not 'PhoneNumber.E164'.

Reason
string

Optional free text. It is never validated and never affects the outcome; it is only concatenated into the audit-log event string written by removeAdminAccess. Omitting it makes that log line end with the literal 'undefined', because the concatenation is unguarded.

property name*
additional property
any

Responses

Request samples

Content type
application/json
Example
{
  • "AccessToken": "<cognito-access-token>",
  • "SubscriberToken": "<subscriber-token>"
}

Response samples

Content type
application/json
Example
{
  • "message": "Admin access removed - <subscriber-token>. Subscriber account deleted.",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/enableSubscriberConsole Deprecated

Not implemented — do not use. This path is routed, but no operation runs behind it. An authenticated, authorised request returns HTTP 200 with errorProcessing: false and an otherwise empty body; nothing in the request is read and nothing is written. Because the status is 200, the failure is silent.

To give a subscriber working console access, call /networkoperatorconsole/subscribers/resendCodeforTandC. It sets a password-reset code on the subscriber and sends them the reset-or-welcome message by email or SMS. A subscriber managed through an external identity provider cannot be enabled this way.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT access token of the calling console user. Required in the body - this endpoint does not read an Authorization header.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>"
}

Response samples

Content type
application/json
{
  • "SupportedLocales": {
    },
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/resendCodeforTandC

Sends the subscriber-console password-reset code — or, for an account that has never accepted the Terms and Conditions, the welcome message with its temporary password. Despite the name, this is the general subscriber password-reset module (also used by the venue-management and unauthenticated subscriber-console reset routes).

No authentication is required — an unauthenticated request is accepted and classified Public.

Who may call it: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), Subscriber (always their own account only), or Public.

Delivery: NotificationChannel: "SMS" forces SMS to the subscriber's stored phone number (bypassing suppression) when one exists; otherwise email is sent. An EmailAddress/PhoneNumber in the request is only used to look the subscriber up, never as a destination.

Privacy for unauthenticated callers: a Public caller always gets the same 200 success body, whether or not the subscriber exists or is reachable — this prevents account enumeration. Authenticated callers get the real rejection instead.

Authorizations:
CognitoAuthorizer
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first), and that record supplies the operator id, the Cognito pool used to verify the token and any source-IP whitelist. A request with neither 'origin' nor 'Origin' is rejected 401 'origin missing. '; an origin that resolves to no operator is rejected 401 'Operator not found. '.

Authorization
string

Optional on this route. When non-empty the value is split on a space and the second element is taken as the access token, OVERWRITING any AccessToken in the request body. A value with no space yields nothing usable, and the request is then processed as an anonymous Public call rather than rejected.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. It affects the success and not-found message text; the notification-engine literals are never localised.

Request Body schema: application/json
optional
AccessToken
string

Caller's Cognito JWT access token. OPTIONAL on this route - there is no missing-token rejection. Overwritten by the Authorization header when that header is present. Verified only when the operator record carries a Cognito pool; a token that fails verification is rejected 401.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token, and its preferred_username - or, failing that, its email resolved through the operator's email cache - identifies the caller.

OperatorID
string

Required ONLY for a Network Software Provider caller, which is rejected 401 'OperatorID Missing. ' without it. It then replaces the operator context and is removed from the request before the identifier lookups run. Ignored for every other caller.

VenueID
string

Read ONLY by the role check: a caller whose venue-level grants contain this exact value is classified Venue. It does NOT scope the reset, and operator-level callers do not need it - but a venue staff member who omits it is classified Subscriber and resets their OWN password instead of the target's.

SubscriberToken
string

Identifies the target subscriber directly. Highest precedence of the four identifiers. Ignored for a caller classified Subscriber, whose own token always wins.

externalSubscriberID
string

The operator's own subscriber identifier, resolved to a subscriber token through the external-id cache. Used only when SubscriberToken is absent.

EmailAddress
string

Subscriber email address; lower-cased and resolved to a subscriber token through the email cache. Used only when SubscriberToken and externalSubscriberID are absent. LOOK-UP ONLY - the reset is delivered to the address stored on the subscriber record, not to this one.

PhoneNumber
string

Subscriber phone number, matched against the phone cache EXACTLY as supplied with no normalisation, so it must be sent in the same form it was stored. Lowest precedence of the four identifiers. Note the un-dotted name: a 'PhoneNumber.E164' property is not read by this route.

NotificationChannel
string

Passed straight through to the notification engine. The only value with an effect is the exact string 'SMS', which sends the code by SMS to the subscriber's stored phone number and bypasses every suppression flag - but only when the subscriber record HAS a phone number; without one the request falls back to email. Any other value, or none, sends email when the subscriber record has an email address.

Domain
string

Accepted but ignored on this route: it has no effect on which subscriber is reset, on what is sent, or on the response. It does NOT select the operator whose subscriber is reset - use OperatorID for that.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "{Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}",
  • "VenueID": "{pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string",
  • "NotificationChannel": "SMS",
  • "Domain": "string"
}

Response samples

Content type
application/json
Example
{
  • "message": "Code to reset password sent to account. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/subscribers/removeKey Deprecated

Not implemented — do not use. This path is routed, but no operation runs behind it. An authenticated, authorised request returns HTTP 200 with errorProcessing: false and an otherwise empty body, and the subscription is left completely untouched — no field is written and no cache entry is invalidated. Because the status is 200, the failure is silent.

To end a subscriber's key, call /networkoperatorconsole/subscribers/resetSubscriptionEndDate with endImmediately: true and one subscriber or subscription identifier (SubscriberToken, EmailAddress, UnitID_internal, SetupIntentId or StripeClientSecret).

To rotate a PSK rather than end it, use /networkoperatorconsole/subscribers/resetKey.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token (JWT). Verified by token validation The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the operator resolved from the request Origin header, otherwise the request is rejected with "Administrative Access denied (2). ".

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJFWEFNUExFIiwiYWxnIjoiUlMyNTYifQ.EXAMPLE.EXAMPLE"
}

Response samples

Content type
application/json
{
  • "SupportedLocales": {
    },
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/resetKey

Rotates a subscriber's Wi-Fi pre-shared key. You identify the CURRENT key, supply the NEW one, and the rotation is written across every subscription of that subscriber that carries the current key, with the PMK caches rebuilt so the new key starts authenticating and the old one stops.

Who may call it. Three callers are accepted. (a) A Network Software Provider: the operator resolved from the request Origin carries a NetworkSoftwareProviderID and the token carries a Username and no SubscriberToken; OperatorID is then mandatory and is deleted from the forwarded body. (b) A Network Operator admin whose AccessToken.AdministrativeAccess.NetworkOperator DomainAdministrator, AccountManager or CustomerSupport list contains the operator id - all three roles are live here. (c) Any caller whose token carries a SubscriberToken, who is treated as the subscriber themselves. A venue administrator or leasing agent has NO venue-scoped branch on this operation - that clause is disabled in the source - so such a caller is admitted only via (c), as an ordinary subscriber acting on their own key. Everyone else is refused with 401 'Access Denied. '.

Whose key gets reset. For an operator or provider caller, the target subscriber is resolved from whichever of PhoneNumber.E164, EmailAddress, SubscriberToken or externalSubscriberID is present in the body; if NONE of the four is present the caller is silently reclassified as a subscriber and the reset targets the SubscriberToken carried by their own access token: for a Network Operator admin that is their own key, while a Network Software Provider's token carries no SubscriberToken at all - that is part of what selects branch (a) - so such a call is refused 401 'Subscriber not found.' and no key is touched. A target that cannot be resolved gives 401 'Subscriber not found.'.

Identifying the current key. Supply psk (the current pre-shared key itself). CurrentKeyID - the WPA2 pairwise master key - remains accepted as a legacy alternative until 17 November 2026, after which only psk is accepted. When CurrentKeyID is used, it is resolved to the PSK through a reverse-lookup cache and, failing that, by recomputing the key derivation over the subscriber's active keys across their presentable SSIDs.

Supplying the new key. Send either NewKey (the complete key) or UserPartForNewKey, from which the stored key is built as the user part, a dot, and the SubscriberToken. Exactly one of the two must be present. Where the resolved StrictPSK is true for the target subscription (escalate-only: operator OR venue OR unit), a full NewKey is MANDATORY - UserPartForNewKey is refused there, because the composed value contains a '.' and can never be StrictPSK-compliant. A missing NewKey in that case returns 401 'This subscription requires NewKey. UserPartForNewKey is not accepted where StrictPSK applies.'; a supplied NewKey that fails the strict contract (8-63 characters, an uppercase, a lowercase, a digit and one special from !#+,-/:=@_ with no other non-alphanumeric, no '.', not starting with a special, no run of 8 identical characters) returns 401 'New key does not meet the StrictPSK requirement for this venue unit. ...'; and if that policy cannot be resolved the reset is refused 401 'Unable to verify the password policy for this subscription. Try again.' rather than proceeding. A UserPartForNewKey containing a '.' is refused 401 'UserPartForNewKey has invalid characters. It cannot contain a period.' on every operator, StrictPSK or not.

dryRun validates everything - length, character set, format and uniqueness across the operator - and returns 'Strong Wi-Fi password. ' with HTTP 200 WITHOUT rotating anything.

Two request-shape failures return HTTP 200, not 4xx. Omitting the current-key identifier and omitting the new key are both reported as HTTP 200 with errorProcessing true and an explanatory message; the status is explicitly set to 200 at those two checks. Every other refusal on this operation is a 401, a 409 or a 503.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. May instead be supplied as Authorization: Bearer <JWT>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider; absent in that case gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and DELETED from the forwarded body.

SubscriberToken
string

Identifies the target subscriber for an operator or provider caller. For a subscriber caller the value from the token is used instead. Note that when psk is supplied, the target subscriber is derived from the PSK and this value is used only to narrow the match.

EmailAddress
string <email>

Alternative way for an operator or provider caller to identify the target subscriber. Lower-cased by the shared request sanitiser.

PhoneNumber.E164
string

Alternative way for an operator or provider caller to identify the target subscriber. When present it is also copied onto a PhoneNumber property before resolution.

externalSubscriberID
string

Alternative way for an operator or provider caller to identify the target subscriber, by the operator's own identifier for them.

psk
string

The subscriber's CURRENT pre-shared key. This is the supported way to identify the key being rotated. It must resolve to exactly one subscriber of the operator, otherwise the call fails with 'Current key not found.'. Required from 17 November 2026 onward.

CurrentKeyID
string

LEGACY alternative to psk: the WPA2 pairwise master key for the current PSK, as a hex string. It is resolved to the PSK through a reverse-lookup cache, and failing that by recomputing the key derivation over the subscriber's active keys across their presentable SSIDs (which requires SubscriberToken to be resolvable). From 17 November 2026 it is no longer accepted and psk becomes mandatory.

NewKey
string

The complete new pre-shared key. Send this OR UserPartForNewKey. Longer than 63 characters gives 401 'NewKey cannot be more than 63 characters.'; characters outside the WPA-permitted set give 401 'NewKey has invalid characters.'. After assembly the key must be at least 8 and at most 63 characters, must differ from the current key, and - when it contains a dot with a final segment longer than 5 characters - that final segment must be the target's SubscriberToken, otherwise 401 'New key in incompatible format.'.

UserPartForNewKey
string

Alternative to NewKey: the stored key becomes this value, a dot, and the target's SubscriberToken. Longer than 40 characters gives 401 'UserPartForNewKey cannot be more than 40 characters.'; characters outside the permitted set give 401 'UserPartForNewKey has invalid characters. It cannot contain a period.'.

dryRun
boolean

Truthy (this is a plain truthiness test, so the string '0' counts as true and the number 0 does not) runs every validation, including the operator-wide uniqueness check, and returns 200 with 'Strong Wi-Fi password. ' WITHOUT writing anything. It also suppresses the duplicate-PSK metric.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "psk": "string",
  • "CurrentKeyID": "string",
  • "NewKey": "string",
  • "UserPartForNewKey": "string",
  • "dryRun": true
}

Response samples

Content type
application/json
{
  • "message": "Password reset successful.",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/subscribers/modifySubscriptionPrice

Changes the venue-level and/or unit-level price adjustment on exactly one active subscription — response carries only the audit sentence, no pricing object.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token (JWT). Verified by token validation The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the operator resolved from the request Origin header, otherwise the request is rejected with "Administrative Access denied (2). ".

NewVenueUnitPriceAdjustment
integer

New unit-level price adjustment, in the currency's minor unit (cents). Send a number.

GATE: the call is rejected with "NewVenuePriceAdjustment/NewVenueUnitPriceAdjustment not found. " only when BOTH this and NewVenuePriceAdjustment are isNaN. Because isNaN(null)/isNaN("")/isNaN([])/isNaN(true) are all false, such values pass the gate: they then produce the audit sentence 'Updated unit-level price adjustment to NaN. ' (parseInt(value)/100) and, because the write uses the RAW the request body value rather than the parseInt result, the raw value is persisted onto VenueUnitPriceAdjustment - a numeric STRING is likewise stored as a string, which the type: integer declaration here does not enforce. A value equal to the subscription's current VenueUnitPriceAdjustment makes the row fail the filter and the call returns "Active subscription not found. ".

NewVenuePriceAdjustment
integer

New venue-level price adjustment, in the currency's minor unit (cents). Identical gate and identical raw-write behaviour as NewVenueUnitPriceAdjustment (isNaN gate, sentence, raw write, no-change filter).

StripeClientSecret
string

Stripe setup-intent client secret stored on the subscription. Used to find the subscription only when it is longer than 4 characters AND startsWith('seti_') - the lookup is the record store; otherwise SetupIntentId is used.

SetupIntentId
string

The vault SubscriptionID. Looked up, which queries the SubscriptionID-index on the SubscriptionID attribute. It is NOT a Stripe 'seti_...' identifier; that is StripeClientSecret. Used only when StripeClientSecret is absent, and only when longer than 4 characters. Either this or StripeClientSecret must be present, otherwise the call is rejected with "SetupIntentId or StripeClientSecret missing from request. ".

VenueID
string

Optional extra filter; when longer than 4 characters, candidate subscriptions whose VenueID differs are discarded. VenueID format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (worked example).

Reason
string

Optional free text stored as the reason on the appended audit event. Not echoed in the response.

Responses

Request samples

Content type
application/json
{
  • "VenueID": "pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO",
  • "NewVenueUnitPriceAdjustment": -500,
  • "Reason": "Retention credit approved by support",
  • "AccessToken": "<Cognito JWT access token>",
  • "StripeClientSecret": "<the subscription's Stripe setup-intent client secret, which begins seti_>"
}

Response samples

Content type
application/json
{
  • "message": "Updated unit-level price adjustment to -5.",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/applyOneTimeCredit

Applies a one-time credit to a subscription's next invoice by writing BillingCyclePriceAdjustment.

Selection: located by SetupIntentId or StripeClientSecret, filtered to the caller's operator, VenueID (if supplied), started, not ended, and with a DIFFERENT adjustment than requested — exactly one row must survive. The adjustment must be a NEGATIVE integer.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
Any of
AccessToken
required
string

Cognito JWT access token of the calling console user. Required in the body - this endpoint does not read an Authorization header.

NewBillingCyclePriceAdjustment
required
integer <= -1

Credit for the next invoice, in minor units of the subscription's currency; it must end up a NEGATIVE integer. Two guards apply, in this order. (1) tests isNaN(the request body?.NewBillingCyclePriceAdjustment) and, when true, returns 401 'NewBillingCyclePriceAdjustment not found. '. isNaN is NOT a presence check: it is true only when the property is absent/undefined or holds something that does not coerce to a number (for example 'abc', {} or [1,2]). The values '', null, [] and true all coerce to a number, so they PASS this guard. (2) After the SetupIntentId/StripeClientSecret guard, applies parseInt rejects anything that is not < 0 with 401 'NewBillingCyclePriceAdjustment cannot be converted to negative number. '. parseInt(''), parseInt(null), parseInt([]) and parseInt(true) are all NaN, so those four values are rejected HERE and not with the 'not found. ' message; 0 and any positive number are rejected here too. A numeric string such as '-500' is accepted, because parseInt converts it. This value REPLACES any existing BillingCyclePriceAdjustment on the subscription (it is not additive), and a value equal to the current one filters the subscription out, producing 'Active subscription not found. '.

SetupIntentId
required
string

The VAULT SubscriptionID of the subscription to credit - NOT a Stripe setup-intent id. It is looked up and is used only when its length is > 4. It is the same value the console receives as SetupIntentId from listSubscriptions.

StripeClientSecret
string

Alternative lookup key, used only when SetupIntentId is absent or <= 4 characters (the record store on the caller's OperatorID). This one IS a Stripe value: the client_secret of the Stripe SetupIntent, stored and expected to start with 'seti_'.

VenueID
string

Optional. Applied as a filter only when longer than 4 characters: candidate subscriptions whose VenueID differs are discarded. Format: {pmgID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode}.{VenueName}.{City} (example).

Reason
string

Optional free text recorded on the subscription's Events audit entry. It is not returned in the response and not sent to Stripe.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJleGFtcGxlIiwiYWxnIjoiUlMyNTYifQ.<redacted>.<redacted>",
  • "SetupIntentId": "3f2b9c1e-7d4a-4c8b-9f10-2a6e5b0d7c31",
  • "NewBillingCyclePriceAdjustment": -500,
  • "Reason": "Service outage goodwill credit"
}

Response samples

Content type
application/json
{
  • "message": "Applying one-time adjustment of -$5.00 to next bill due on Sep 1, 2026",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/modifyVenueUnit

Moves an existing subscription to a different unit at the same venue.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or a Venue admin/leasing agent for the subscription's actual venue (which may differ from the VenueID sent).

What the move does: the subscription is found by SubscriptionID (or StripeClientSecret if absent) and must be active and at this operator. The target unit must exist, belong to the same venue, not be a sub-unit, and have no other live subscription. On success: unit/address fields are rewritten, VLAN/SSID/gateway markers reset so activation re-runs, an audit entry written, caches invalidated.

No match is not an error — 200 with an empty message, whether nothing matched, the target unit equals the current one, or the caller's access category doesn't satisfy the tighter internal guard.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required

JSON body. It is parsed by the field-mapping step before the endpoint's own error handling starts, so a missing, empty or non-JSON body is not answered with a Vault error body on this resource.

AccessToken
string

Cognito access-token JWT. May also be sent as Authorization: Bearer <JWT>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider; absent in that case gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and DELETED from the forwarded body.

VenueID
string

What gates Venue-role access: the caller's AdministrativeAccess.Venue.VenueAdministrator or AdministrativeAccess.LeasingAgent array must contain this exact value. It is NOT used to look the subscription up, and the service's own venue check uses the subscription's venue instead. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriptionID
string

Identifies the subscription to move. The record must belong to the caller's operator and must not have an end date in the past. The legacy name SetupIntentId is accepted and renamed to this field before processing.

SetupIntentId
string

Legacy alias for SubscriptionID; renamed and removed from the body by the field-mapping step. Despite the name it holds a Vault SubscriptionID, not a Stripe identifier.

StripeClientSecret
string

Alternative subscription lookup, used only when SubscriptionID is absent. Matches live subscriptions of the caller's operator carrying that client secret.

object

Target unit wrapper. Produced automatically when the legacy NewUnitID_internal field is sent.

NewUnitID_internal
string

Legacy alias for VenueUnit.UnitID_internal; renamed into that nested field and removed from the body by the field-mapping step.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriptionID": "string",
  • "SetupIntentId": "string",
  • "StripeClientSecret": "string",
  • "VenueUnit": {
    },
  • "NewUnitID_internal": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "errorProcessing": false,
  • "statusCode": 0
}

/networkoperatorconsole/subscribers/resetSubscriptionStartDate

Moves the start date of a subscription that hasn't started yet — identified by the REQUIRED UnitID_internal and a start date matching the subscription's CURRENT start exactly.

For a wired unit, the new start snaps to local start-of-day (unless doNotResetDatetoMidnight is true); a start in the past is clamped to now. Preponing a start triggers an overlap check and is rejected if another subscription would overlap.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
Any of
AccessToken
required
string

Cognito access token (JWT). Verified by token validation The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the operator resolved from the request Origin header, otherwise the request is rejected with "Administrative Access denied (2). ".

UnitID_internal
required
string

Internal venue-unit id, of the form '{VenueID}.{UNITID}.{UNITBUILDING}.{UNITFLOOR}' (composed by). REQUIRED by this operation's own guard - missing it is rejected with "UnitID_internal missing from request. " - and it is the id the write targets: the subscription record is selected on this value (fed). It is NOT necessarily the unit that Venue.getVenueUnitSummary loads for the venue/timezone/purpose lookup: that helper resolves a unit in the order AddressLine1 > externalVenueUnitID > UnitID > UnitID_internal, so a body that also carries AddressLine1, externalVenueUnitID or UnitID resolves a DIFFERENT unit for the wired-unit start-of-day snap and the overlap check while the write still targets the subscriptions of the UnitID_internal named here. Send UnitID_internal alone unless that is intended.

StartDateTimeUTC.ISO8601
required
string <date-time>

The subscription's CURRENT start date, used to select the row. Required - missing it is rejected with "StartDateTimeUTC.ISO8601 missing from request. ". If it is already in the past the call is rejected with "Cannot modify start date. Subscription has already started. ".

NewStartDateTimeUTC.ISO8601
required
string <date-time>

The requested new start date. Required - missing it is rejected with "NewStartDateTimeUTC.ISO8601 missing from request. "; identical to StartDateTimeUTC.ISO8601 is rejected with "NewStartDateTimeUTC.ISO8601 cannot be same as StartDateTimeUTC. "; on/after the subscription's end date is rejected with "ERROR: NewStartDateTimeUTC.ISO8601 cannot be after EndDateTimeUTC.ISO8601. ".

doNotResetDatetoMidnight
boolean

Compared with === true, so only the boolean true has an effect; any other value leaves the snap in place. When true it skips the local start-of-day snap, which is itself applied only when the resolved unit's purpose is 'wiredunit'.

Reason
string

Optional free text stored as the reason on the appended audit event. Not echoed in the response.

VenueID
string

Optional. Narrows the venue scope of the Venue.getVenueUnitSummary unit lookup; when both it and externalVenueID are omitted, every venue of the operator is listed and searched. Format built by as '{pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}'.

externalVenueID
string

Optional alternative to VenueID for scoping the unit lookup; it takes PRECEDENCE over VenueID and is matched against the operator's venues.

SubscriberToken
required
string

Subscriber identifier. One of SubscriberToken / EmailAddress / PhoneNumber.E164 / externalSubscriberID must be supplied - token validation rejects otherwise with "EmailAddress, PhoneNumber.E164, SubscriberToken or externalSubscriberID missing from request. ". Generated as 8 letters - two groups of one upper-cased letter followed by three lower-case letters, drawn from the alphabet 'abcdefghjkmnpqrtuvwxyz' (with).

EmailAddress
string <email>

Alternative subscriber identifier; lower-cased and used as the Cognito 'email' filter.

PhoneNumber.E164
string

Alternative subscriber identifier; a leading '+' is added if missing, then used as the Cognito 'phone_number' filter.

externalSubscriberID
string

Alternative subscriber identifier; trimmed to 64 characters and resolved to a SubscriberToken via the operator's external-id index.

AddressLine1
string

Optional unit-lookup field read by Venue.getVenueUnitSummary. It OUTRANKS every other unit selector: when present, externalVenueUnitID / UnitID / UnitID_internal are not used to find the unit at all. Trimmed and sliced to 40 characters, then matched exactly against the unit's AddressLine1.

AddressLine2
string

Optional additional filter on the unit lookup; trimmed and sliced to 40 characters, matched exactly.

UnitID
string

Optional unit-lookup field. Ranks above UnitID_internal and below externalVenueUnitID; trimmed and sliced to 40 characters, then compared against the unit record's ID.

externalVenueUnitID
string

Optional unit-lookup field, ranked above UnitID and UnitID_internal.

UnitBuilding
string

Optional additional filter on the unit lookup.

UnitFloor
string

Optional additional filter on the unit lookup.

City
string

Optional additional filter on the unit lookup.

State
string

Optional additional filter on the unit lookup.

Country.ISO3166A3
string

Optional additional filter on the unit lookup.

PostalCode
string

Optional additional filter on the unit lookup.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJFWEFNUExFIiwiYWxnIjoiUlMyNTYifQ.EXAMPLE.EXAMPLE",
  • "UnitID_internal": "{VenueID}.{UNITID}.{UNITBUILDING}.{UNITFLOOR}",
  • "StartDateTimeUTC.ISO8601": "2026-09-01T04:00:00.000Z",
  • "NewStartDateTimeUTC.ISO8601": "2026-09-15T04:00:00.000Z",
  • "Reason": "Move-in delayed at tenant request",
  • "EmailAddress": "subscriber@example.com"
}

Response samples

Content type
application/json
{
  • "UnitID_internal": "{VenueID}.{UNITID}.{UNITBUILDING}.{UNITFLOOR}",
  • "SubscriberToken": "<SubscriberToken>",
  • "NewStartDateTimeUTC.ISO8601": "2026-09-15T04:00:00.000Z",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/getRefundAmount

Intended to quote the unused-service refund for ending a subscription — send StripeClientSecret.

⚠ AS WRITTEN THIS OPERATION CANNOT RETURN A QUOTE — the calculation references two undeclared identifiers, which under ES-module strict mode throws a ReferenceError whenever exactly one active subscription matches. The intended response fields (UnusedRefundAmount, MaxRefundAmount, EndDateTimeUTC.ISO8601) are therefore unreachable and not documented as response fields — and even if reached, MaxRefundAmount would hold the matched-subscription ARRAY, not an amount.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT access token of the calling console user. Required in the body - this endpoint does not read an Authorization header.

StripeClientSecret
required
string

The subscription's Stripe client secret - the client_secret of the Stripe SetupIntent, stored and expected to start with 'seti_'. Used as the key of the OperatorID-StripeClientSecret GSI. Missing or empty returns 401 'StripeClientSecret missing from request.' (401).

EndDateTimeUTC.ISO8601
required
string <date-time>

Proposed subscription end date, ISO-8601. A falsy/absent value returns 401 'EndDateTimeUTC.ISO8601 missing from request.' (401).

endImmediately
boolean

Optional. Skips BOTH the venueunit cache lookup and the local end-of-day adjustment. Note the contrast with doNotResetDatetoMidnight in the same block, which really is strict (=== true).

doNotResetDatetoMidnight
boolean

Optional. Suppresses the local end-of-day adjustment that is otherwise applied for a unit whose purpose is 'wiredunit'. It is only consulted when endImmediately did not already skip the block.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJleGFtcGxlIiwiYWxnIjoiUlMyNTYifQ.<redacted>.<redacted>",
  • "StripeClientSecret": "seti_XXXXXXXXXXXX_secret_XXXXXXXXXXXX",
  • "EndDateTimeUTC.ISO8601": "2026-09-30T23:59:59.999Z"
}

Response samples

Content type
application/json
{
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/resetSubscriptionEndDate

Sets, moves or removes the end date of one subscription, optionally refunding through Stripe. EXACTLY ONE subscription is selected using whichever identifiers were supplied as filters — more than one match is rejected.

An empty-string NewEndDateTimeUTC.ISO8601 removes the end date; otherwise the new end is written together with PendingDeactivation, cancellation metadata and a recomputed ProvisioningStatus. endImmediately forces the end to now.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
Any of
AccessToken
required
string

Cognito access token (JWT). Verified by token validation The caller must hold NetworkOperatorAdministrator, NetworkOperatorAccountManager or CustomerSupport for the operator resolved from the request Origin header, otherwise the request is rejected with "Administrative Access denied (2). ".

NewEndDateTimeUTC.ISO8601
string

The new end date. Required unless endImmediately is true (which overwrites it with 'now'). Only a value that is falsy AND not loosely equal to "" (absent, undefined, null) falls through and is rejected with "NewEndDateTimeUTC.ISO8601 missing from request. ".

endImmediately
boolean

Forces the end date to the current time and skips the end-of-day snap. The check is LOOSE: boolean true, the string "true", the number 1 and the string "1" all trigger it. When it fires, NewEndDateTimeUTC.ISO8601 is overwritten with the current time and the flag is normalised to boolean true.

doNotResetDatetoMidnight
boolean

Skips the local end-of-day snap applied to wired units.

requestedRefundAmount
integer

Refund amount in the currency's minor unit (cents). When greater than 0 it is passed into the refund calculation.

CancellationReasons
Array of strings

Free-text reasons; stored on the subscription as CancellationReasons and forwarded to the SubscriptionEndDateAdjustment webhook. A non-array or empty value is normalised to an empty array. Not echoed in the response.

StripeClientSecret
string

The subscription's Stripe setup-intent client secret; selects the subscription on the OperatorID-StripeClientSecret index. Takes precedence over SetupIntentId. The literal "undefined" is treated as absent.

SetupIntentId
required
string

The vault SubscriptionID, used to select the subscription (read only when StripeClientSecret is absent; the lookup is the record store, which queries the SubscriptionID-index on the SubscriptionID attribute). It is NOT a Stripe 'seti_...' identifier - that is StripeClientSecret.

UnitID_internal
string

Selects subscriptions at this venue unit. FORMAT: composed at as {VenueID}.{UnitID}.{UnitBuilding}.{UnitFloor}, where each of the last three components is coerced to a string, truncated to 20 chars, stripped of every character outside [A-Za-z0-9_-] and upper-cased. It is NOT a bare unit label.

SubscriberToken
string

Subscriber identifier; resolved by token validation and then used as a subscription filter. FORMAT: an 8-character token generated by the platform over the alphabet 'abcdefghjkmnpqrtuvwxyz' - i.e. 8 letters with positions 1 and 5 upper-case and no i/l/o/s. There is no 'sub_' prefix. Note trims and slices an inbound value to 16 chars.

EmailAddress
string <email>

Alternative subscriber identifier. If subscriber lookup fails, the call continues only when SubscriberToken, SetupIntentId, UnitID_internal or StripeClientSecret was supplied; otherwise it is rejected with "Subscriber not found. ".

PhoneNumber.E164
string

Alternative subscriber identifier.

externalSubscriberID
string

Alternative subscriber identifier. Opaque caller-supplied string (the subscriber's operator/PMS-side id); the code only compares it for equality and no format is imposed anywhere in the API, so no example is given.

VenueID
string

Filter: only subscriptions at this venue are considered. VenueID format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (worked example).

externalVenueID
string

Filter on the subscription's externalVenueID. Opaque caller-supplied string (the venue's operator/PMS-side id); the code only compares it for equality and no format is imposed anywhere in the API, so no example is given.

externalVenueUnitID
string

Filter on the subscription's externalVenueUnitID. Opaque caller-supplied string (the unit's operator/PMS-side id); the code only compares it for equality and no format is imposed anywhere in the API, so no example is given.

UnitID
string

Filter on the subscription's UnitID. Opaque caller-supplied string (the unit label as stored on the subscription); the code only compares it for equality and no format is imposed anywhere in the API, so no example is given.

UnitBuilding
string

Filter on the subscription's UnitBuilding. Opaque caller-supplied string (the building label as stored on the subscription); the code only compares it for equality and no format is imposed anywhere in the API, so no example is given.

UnitFloor
string

Filter on the subscription's UnitFloor. Opaque caller-supplied string (the floor label as stored on the subscription); the code only compares it for equality and no format is imposed anywhere in the API, so no example is given.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJFWEFNUExFIiwiYWxnIjoiUlMyNTYifQ.EXAMPLE.EXAMPLE",
  • "EmailAddress": "subscriber@example.com",
  • "VenueID": "pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO",
  • "NewEndDateTimeUTC.ISO8601": "2026-10-31T03:59:59.000Z",
  • "CancellationReasons": [
    ]
}

Response samples

Content type
application/json
Example
{
  • "message": "Subscription end date updated to 2026-10-31T03:59:59.000Z",
  • "EndDateTimeUTC.ISO8601": "2026-10-31T03:59:59.000Z",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/refundPayment

Issues a Stripe refund against a single paid invoice, identified by its per-payment Stripe client secret (pi_..._secret_... — NOT the subscription's seti_ secret). Stripe credentials are resolved from the invoice's unit → venue, falling back to the operator record.

RefundAmount is capped at the invoice's remaining refundable balance (BillingCyclePrice minus AmountRefunded).

⚠ The refund itself is created via Stripe here, but the bookkeeping (AmountRefunded) and the subscriber notification e-mail are written later by the charge.refunded webhook — not by this call. A failure of the post-refund audit write is swallowed; the refund is still reported successful.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT access token of the calling console user. Required in the body - this endpoint does not read an Authorization header.

StripeClientSecret
required
string

The invoice's per-payment Stripe client secret. Missing/empty returns 401 'StripeClientSecret missing from request.'

RefundAmount
required
integer

Amount to refund in minor units. Validated with isNaN(parseInt(...)), so a non-numeric or absent value returns 401 'RefundAmount missing from request.'. Silently capped at the invoice's remaining refundable balance.

Currency
required
string
Enum: "USD" "GBP" "CNY" "CAD" "INR" "AUD" "LKR"

ISO 4217 code, upper-case. Must be one of the billing-supported set, else 401 'Currency missing from request.'; it must additionally equal the invoice's currency, else 400 'Currency does not match the original invoice currency. '

VenueID
string

Optional. When supplied, the invoice is looked up on the invoice VenueID GSI first; the operator-partition lookup is the fallback. VenueID format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (worked example).

Reason
string

Optional. Forwarded to Stripe ONLY when it is exactly 'requested_by_customer', 'duplicate' or 'fraudulent'; any other value is dropped from the Stripe call but still recorded verbatim on the subscription's Events audit entry.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJleGFtcGxlIiwiYWxnIjoiUlMyNTYifQ.<redacted>.<redacted>",
  • "StripeClientSecret": "pi_XXXXXXXXXXXX_secret_XXXXXXXXXXXX",
  • "RefundAmount": 1500,
  • "Currency": "USD",
  • "VenueID": "pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO",
  • "Reason": "requested_by_customer"
}

Response samples

Content type
application/json
{
  • "message": "Initiated refund <stripe_refund_id> for APIRequestBody.Currency 1500",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/forgetSubscriberDevices

Forgets a subscriber's remembered devices — the whole device map, or one device by Calling-Station-Id (MAC, normalised). Only the subscriber-side map is touched; per-venue device maps are unaffected. This uses the same request path as updateSubscriberPII (with forgetSubscriberDevices implied), so any other field that endpoint accepts is still read and applied — send only what you mean.

Who may actually forget devices is narrower than who passes the initial role gate: only an operator admin, an NSP, or the subscriber acting on their own token. A Venue admin/leasing agent passes the gate but the forget itself is silently skipped — 200, empty message, nothing forgotten.

Subscriber resolution and cross-operator protection work exactly as in updateSubscriberPII.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required

AccessToken is required, plus a lookup key identifying the subscriber. Omitting every lookup key does NOT fail - it targets the caller's own account. OperatorID is required for a NetworkSoftwareProvider caller only. The fields listed here are the ones relevant to this operation; every other field of the shared subscriber-configure body is still accepted and still acted on.

AccessToken
required
string

Cognito access-token JWT. May also be sent as Authorization: Bearer <jwt>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. The token is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and used in preference to it when present.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and DELETED from the forwarded body.

SubscriberToken
string

Primary lookup key, used verbatim when present and NOT ownership-checked at resolution time. Whatever the caller sends is overwritten with the resolved token before the work runs, and for a Subscriber-role caller it is overridden again with the caller's own token.

externalSubscriberID
string

Lookup key, resolved through the operator-scoped index. It is ALSO a writable field on this path (operator-admin or NSP only), and a value that the API changes gives 401 'Invalid characters in externalSubscriberID.' - so send it only when you intend it as the lookup key and it is already in canonical form.

EmailAddress
string <email>

Lookup key, resolved through the operator-scoped email index and lower-cased on the way in. It is ALSO a writable field (DomainAdministrator or NSP only), so sending an address that differs from the subscriber's current one will attempt to CHANGE it - and can be refused 401 'Email Address is associated with another account.'. Prefer SubscriberToken as the lookup key.

PhoneNumber.E164
string

Copied onto PhoneNumber by the endpoint before anything else, so it behaves exactly like PhoneNumber below. Unlike the plain spelling, it is what the self-target test counts as a lookup key, so this is the field to send when identifying a subscriber by phone number.

PhoneNumber
string

Lookup key, and likewise a writable field: sending a number that differs from the stored one attempts to change it and can fail 401 'Invalid PhoneNumber. Invalid PhoneNumber. ' or 'PhoneNumber is associated with another account.'. It does not work as the ONLY lookup key: the plain spelling does not suppress the self-target fallback, so such a request is retargeted at the caller's own account - send 'PhoneNumber.E164' instead.

VenueID
string

Not used by the forget. It only gates Venue-role access at the request gate - and a Venue caller cannot perform the forget anyway. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Calling-Station-Id
string

Optional. When supplied non-empty (after trimming), the forget is narrowed to this single device. The value is normalised - hyphens and colons stripped, lower-cased - and must then be a 12-hex-digit MAC: if it is not, the call is refused 401 'Invalid Calling-Station-Id. ' and does NOT fall through to deleting everything. A well-formed MAC that is not in the subscriber's device map gives 401 'Device not found. '. On success the normalised value is echoed back in the response body. Omit the field entirely to forget every device.

forgetSubscriberDevices
boolean

Not required and not read from the request on this path: reaching this resource sets it to true regardless of what the body contains. Sending false does NOT prevent the forget.

forgetSubscriptions
boolean

Strict === true. Operator-admin or NSP only. Ends every active subscription the subscriber holds with this operator, immediately, and then clears their device map.

forgetSubscriber
boolean

Strict === true. Operator-admin or NSP only. Deletes the subscriber, including the Cognito user. Refused 401 'Subscriber has active subscriptions.' while any active subscription remains - run forgetSubscriptions first.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "PhoneNumber": "string",
  • "VenueID": "string",
  • "Calling-Station-Id": "02aabbccddee",
  • "forgetSubscriberDevices": true,
  • "forgetSubscriptions": true,
  • "forgetSubscriber": true
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": true,
  • "statusCode": 0,
  • "Calling-Station-Id": "string"
}

/networkoperatorconsole/subscribers/listSubscriberKeys

List a subscriber's Wi-Fi keys, grouped by keypool, with their connected devices.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport) may target any subscriber of that operator; any other authenticated caller is treated as a subscriber asking about themselves and gets their own record regardless of what was sent — this includes venue-level staff, who have no elevated access here.

Selecting the subscriber: one of SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber.E164 (a bare PhoneNumber doesn't count). An admin may instead run a UnitID_internal- or VenueID-scoped query to list keys without resolving a single subscriber.

Other request fields filter the subscription list (ServicePlanID, Status, currentpsk, etc.); ended subscriptions are always excluded.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. May instead be sent as Authorization: Bearer <JWT>, which overwrites this value. Absent from both is refused 401 AccessToken Missing. .

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 OperatorID Missing. otherwise) and deleted from the body once accepted. Ignored for every other caller. Built as {Country.ISO3166A3}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

SubscriberToken
string

Subscriber selector, checked FIRST - if present the other selectors are not consulted. Also reused afterwards as a filter over the subscription list.

externalSubscriberID
string

Subscriber selector, checked second - the operator's own id for the subscriber. Also reused afterwards as a filter.

EmailAddress
string <email>

Subscriber selector, checked third. Lower-cased by the shared request sanitiser and lower-cased again for the lookup. Also reused afterwards as a filter, and that comparison IS case-sensitive.

PhoneNumber.E164
string

Subscriber selector, checked last. This dotted form is the ONLY phone selector this operation recognises; it is copied onto PhoneNumber internally for the lookup.

PhoneNumber
string

NOT a selector on this operation. Sending it alone makes the request look selector-free, which switches the call to a self-lookup - see the operation summary. Use 'PhoneNumber.E164' instead.

UnitID_internal
string

Admin-only scoped query: resolves the unit to its venue and returns that venue's subscriptions filtered to this unit. No single subscriber is resolved, so no subscriber record and no device map are returned.

VenueID
string

Admin-only scoped query over the venue's subscription list, and also a filter over the result. Format {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriptionID
string

Narrows the result to one subscription.

StartDateTimeUTC.ISO8601
string

Keeps only subscriptions starting strictly AFTER this instant.

EndDateTimeUTC.ISO8601
string

ACCEPTED AND IGNORED - the endpoint overwrites it with the current time before filtering, which is how already-ended subscriptions are dropped. There is no way to ask this operation for expired keys.

ServicePlanID
string

Filter.

Status
string

Filter, compared against the subscriber's status on each subscription.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "+15551234567",
  • "PhoneNumber": "string",
  • "UnitID_internal": "string",
  • "VenueID": "string",
  • "SubscriptionID": "string",
  • "StartDateTimeUTC.ISO8601": "string",
  • "EndDateTimeUTC.ISO8601": "string",
  • "ServicePlanID": "string",
  • "Status": "string"
}

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "PhoneNumber.E164": "string",
  • "locale": "en-us",
  • "OperatorID": "string",
  • "Status": "string",
  • "CognitoStatus": "string",
  • "email_verified": true,
  • "phone_number_verified": true,
  • "externalSubscriberID": "string",
  • "SubscriberManagedviaSSO": true,
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "AdministrativeAccess": { },
  • "Devices": [
    ],
  • "KeysInKeyPools": {
    },
  • "KeyCount": 2,
  • "KeyCountActive": 2,
  • "AllDevices": {
    },
  • "DeviceCountOnline": 1,
  • "DeviceCountOffline": 0,
  • "RegisteredDevices": [
    ],
  • "messages_from_venues": {
    },
  • "StripeCustomerID": "string",
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/listSubscriberKeys (GET)

List a subscriber's WiFi keys, grouped by keypool, together with their connected devices.

The body returned IS the resolved subscriber's stored record with the key and device collections added to it - see the 200 description for exactly which fields are stripped and when.

Who may call it, and what each caller sees. A NetworkSoftwareProvider (the origin operator carries a NetworkSoftwareProviderID, the token carries a Username and no SubscriberToken) must supply OperatorID. A NetworkOperator administrator holding DomainAdministrator, AccountManager or CustomerSupport on the operator may target any subscriber of that operator. Any other authenticated caller whose token resolves to a SubscriberToken is treated as a subscriber asking about themselves: every selector in the request is discarded and their own record is returned. That includes venue-level staff - a VenueAdministrator or LeasingAgent has no privileged access on this operation and cannot look another subscriber up through it. Only a token that resolves to neither an operator role nor a SubscriberToken is refused Access Denied. .

Selecting the subscriber. An admin caller identifies the target with exactly one of SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber.E164 - and those are checked in that order, so the first one present wins. Alternatively an admin may run a UnitID_internal- or VenueID-scoped query, which returns the keys for that unit or venue without resolving a single subscriber.

A bare PhoneNumber is NOT a selector on this operation. Only the dotted PhoneNumber.E164 counts. A request carrying PhoneNumber and nothing else is treated as having supplied no selector at all, which silently switches the call to 'return my own record' - so an administrator gets their own keys back with a 200, and a NetworkSoftwareProvider (who has no subscriber record) gets Subscriber not found..

Other request fields narrow the result. After the ended subscriptions are removed, the remaining request fields are applied as filters over the subscription list. Recognised filter names include SubscriptionID, ServicePlanID, externalServicePlanID, VenueID, externalVenueID, UnitID_internal, UnitID, UnitBuilding, UnitFloor, vlan, VenueUnitSSID, RealPageUnitID, externalVenueUnitID, Status, locale, RoamingSSID, GlobalSSID, currentpsk, paymentFailed, gatewayConfigured, StripeCustomerID, StripePaymentMethod, StripeSetupIntentId, CustomerID, AccountStatusAtCreation, AccountAddedByAdministrator, excludeRealPage and StartDateTimeUTC.ISO8601 (which keeps only subscriptions starting AFTER the value given). Any EndDateTimeUTC.ISO8601 you send is overwritten by the current time, which is how ended subscriptions are dropped; you cannot use it to ask for expired keys. For a self-lookup none of these apply - the request body is discarded first.

Reads only. Everything is served from cache - the subscriber record, the subscription list, the keypool list, the per-venue unit lists and the device map. A brand-new subscriber missing from the cache is rebuilt from the database and written back on the fly. The only direct database read is the venue-message query, which runs solely for a subscriber asking about themselves. Nothing is written and no cache is invalidated.

Version gating. api-version: 20260417 or higher adds editable per pool, StrictPSK per key, NetworkData.VenueUnitSSID and per-policy StripeCustomerID, and removes the deprecated top-level StripeCustomerID. Below that version a notice describing this appears in message on EVERY response from this operation, successful or not (the one exception is the fail-closed 500, whose body is exactly {"message":"Internal server error. ","errorProcessing":true} with no notice appended). After the 2026-11-17 sunset the newer shape applies unconditionally.

The access token may be sent in the body or as an Authorization: Bearer <JWT> header; the header wins.

Two consequences are specific to GET: responses carry Cache-Control: private, max-age=5, and a query-string EmailAddress skips the body sanitiser's lower-casing, so send it already lower-cased - it will still resolve the subscriber, but it is reused afterwards as a case-sensitive filter and a mixed-case value can filter every subscription away and return a 200 with no keys.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT. Not marked required at the parameter level because it may instead arrive in the Authorization header, but with neither present the call is refused 401 AccessToken Missing. .

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 OperatorID Missing. otherwise). Ignored for every other caller.

SubscriberToken
string

Subscriber selector, checked FIRST - if present the other selectors are not consulted. Also reused afterwards as a filter.

externalSubscriberID
string

Subscriber selector, checked second. Also reused afterwards as a filter.

EmailAddress
string <email>

Subscriber selector, checked third. Send it lower-cased: the query-string form skips the body sanitiser, and while the lookup lower-cases it anyway, the same value is reused as a case-sensitive filter.

PhoneNumber.E164
string

Subscriber selector, checked last. This dotted form is the ONLY phone selector this operation recognises.

PhoneNumber
string

NOT a selector on this operation. Sending it alone makes the request look selector-free and switches the call to a self-lookup. Use PhoneNumber.E164.

UnitID_internal
string

Admin-only scoped query: resolves the unit to its venue and returns that venue's subscriptions filtered to this unit. No single subscriber is resolved, so no subscriber record and no device map are returned.

VenueID
string

Admin-only scoped query over the venue's subscription list, and also a filter. Format {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriptionID
string

Narrows the result to one subscription.

StartDateTimeUTC.ISO8601
string

Keeps only subscriptions starting strictly AFTER this instant.

EndDateTimeUTC.ISO8601
string

ACCEPTED AND IGNORED - overwritten with the current time before filtering, which is how ended subscriptions are dropped.

ServicePlanID
string

Filter.

Status
string

Filter, compared against the subscriber's status on each subscription.

header Parameters
Authorization
string

Bearer <JWT>. The endpoint takes the substring after the first space and writes it over the AccessToken value, so it overrides an AccessToken query parameter. A header with no space yields an undefined token and the call is refused 401 AccessToken Missing. .

api-version
string

Send 20260417 or higher to receive editable per pool, StrictPSK per key, NetworkData.VenueUnitSSID and per-policy StripeCustomerID, and to drop the deprecated top-level StripeCustomerID. Below that a migration notice is added to message on every response. Parsed as a base-10 integer; anything unparseable is treated as 0. Unconditional after 2026-11-17.

Accept-Language
string

A value whose first tag begins with es selects the Spanish renderings of the messages that come from the translation catalogue; everything else falls back to en-us. Only catalogue-sourced messages localise.

Responses

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "PhoneNumber.E164": "string",
  • "locale": "en-us",
  • "OperatorID": "string",
  • "Status": "string",
  • "CognitoStatus": "string",
  • "email_verified": true,
  • "phone_number_verified": true,
  • "externalSubscriberID": "string",
  • "SubscriberManagedviaSSO": true,
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "AdministrativeAccess": { },
  • "Devices": [
    ],
  • "KeysInKeyPools": {
    },
  • "KeyCount": 2,
  • "KeyCountActive": 2,
  • "AllDevices": {
    },
  • "DeviceCountOnline": 1,
  • "DeviceCountOffline": 0,
  • "RegisteredDevices": [
    ],
  • "messages_from_venues": {
    },
  • "StripeCustomerID": "string",
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/listSubscriberLog

Returns one subscriber's audit and event log, newest first. The subscriber is identified by SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber, tried in that order. A NetworkSoftwareProvider caller can identify the subscriber only by a direct SubscriberToken — the other three lookup fields resolve against the provider's own operator, not the one named in OperatorID.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (any subscriber of the operator), a Venue admin/leasing agent (only a subscriber with a subscription, current or past, at a venue they administer — otherwise reported as not found), or the Subscriber themself (always their own log).

Filtering: searchText runs a fuzzy match; a whitelist of exact-match fields is available, or raw OpenSearch customQuery (which replaces the whitelist). The date window defaults to now for the upper bound and is unbounded below unless you send a lower bound — sending one also switches totalCount from a capped estimate to an exact count. Results are newest-first, paged via searchBefore.

Authorizations:
CognitoAuthorizer
header Parameters
Authorization
string

'Bearer '. When the header is present and non-empty the endpoint takes the substring after the first space and uses it as the AccessToken, OVERWRITING any AccessToken supplied in the request itself. A header with no space produces an empty token and is then treated as a missing one (401 'AccessToken Missing. ').

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else the English one. It affects rejection text only.

Request Body schema: application/json
optional
AccessToken
string

Cognito access token. Absent/empty in both the request and the Authorization header is 401 'AccessToken Missing. '. It is verified only when the operator record resolved from the request Origin carries a Cognito pool; when it does not the token is never verified at all, the caller therefore matches no access category, and the request is refused 401 'Access Denied. '.

IdToken
string

Optional Cognito ID token. Used by the shared token validator only when the access token's username is not already cached: the ID token is then verified instead, and its preferred_username (or its email, resolved through the operator's email index) becomes the caller identity.

OperatorID
string

Target operator. REQUIRED only for a NetworkSoftwareProvider caller (missing is 401 'OperatorID Missing. '); it becomes the OperatorID every log query is filtered on and is then removed from the request. Ignored for every other caller, whose operator comes from the request Origin.

MinViewWindowDateUTC.ISO8601
string

Window start, parsed with the JavaScript Date constructor. DEFAULT: none - when it is omitted NO lower bound is applied at all and the query spans every monthly log index. Supplying it also switches the hit counter to exact mode; without it totalCount is capped (see the 200 response). An unparseable value is 400.

MaxViewWindowDateUTC.ISO8601
string

Window end, parsed with the JavaScript Date constructor. DEFAULT: now + 60 seconds - the extra minute compensates for OpenSearch Serverless near-real-time indexing lag. An unparseable value is 400.

pageSize
integer

Page size. DEFAULT 250 when omitted or when the value is falsy (the JSON number 0 and an empty string are falsy and therefore fall back to 250). Any other value is parsed as an integer and clamped to a maximum of 500 by the shared OpenSearch service. Note that the string "0" IS truthy: it yields a zero-size query, an empty log array and hasMore true. A non-numeric value yields NaN and the query fails as a 500.

searchText
string

Full-text search added as a multi_match (best_fields, operator 'and', fuzziness 'AUTO') across event, function_name, Administrator, SourceIP, SubscriberToken and LogType. It is ANDed with every other filter, INCLUDING a customQuery.

searchBefore
Array of any

Pagination cursor: pass back the searchBefore array from the previous response verbatim. It is the sort tuple of that page's last hit (the document's @timestamp and its _id) and is sent as OpenSearch search_after.

customQuery
object

Raw OpenSearch Query DSL. Accepted only when it is an object containing at least one of bool, match, term, terms, range, wildcard, regexp, exists or multi_match - otherwise 400 'Invalid customQuery format. Must be valid OpenSearch Query DSL.'. When present it SUPPRESSES all of the individual filter fields below; only the OperatorID scope, the date window, the route's own required filter and searchText are still applied.

A bool query is decomposed: its must and filter clauses are merged into the query's must, its must_not into must_not, and its should is wrapped with minimum_should_match (default 1). A non-bool query is added as a single must clause.

string or Array of strings

Name of the emitting function/route recorded on the log document. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

Log severity/type recorded on the document (e.g. the value the emitter wrote). Filterable, but NOT among the fields projected back by this route. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

The raw stored administrator identifier (username or email) as written by the emitter - match on the STORED value, not on the display string this route returns after enrichment. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

Operating system parsed from the emitting request's User-Agent. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

Browser parsed from the emitting request's User-Agent. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

Source IP recorded on the log document. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

Locale recorded on the log document ('en-us' or 'es-xl'). Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

SubscriberToken
string

Highest-precedence subscriber lookup key. IGNORED for a caller resolved to the Subscriber access category - the token's own SubscriberToken overwrites this one, so such a caller can only read its own log. Because SubscriberToken is also a whitelisted filter field, a value sent here is ALSO applied as a term filter before the overwrite happens, which means a subscriber that sends someone else's token gets an empty result rather than its own log. An operator-role caller that sends it gets exactly that subscriber, still scoped to the operator.

VenueID
string

Required for a Venue-role caller: it is the value matched against the caller's VenueAdministrator/LeasingAgent arrays to grant that role, and its query is then also filtered on it, so a venue-delegated caller sees only documents that carry that VenueID. For other callers it is an ordinary filter field. Composite Vault VenueID, {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

string or Array of strings

UnitID_internal recorded on the log document. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

EquipmentID recorded on the log document. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

KeyPoolID recorded on the log document. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

string or Array of strings

ServicePlanID recorded on the log document. Exact-match term filter: a string produces a term query, an array of strings a terms query. Ignored entirely when customQuery is supplied.

externalSubscriberID
string

Subscriber lookup key, used when SubscriberToken is absent; resolved through the operator's external-ID index. For a NetworkSoftwareProvider caller this lookup runs against the operator resolved from the request Origin, NOT the OperatorID sent, so that caller normally fails to resolve the subscriber (401) and must identify the subscriber by SubscriberToken instead.

EmailAddress
string <email>

Subscriber lookup key, used when SubscriberToken and externalSubscriberID are absent; resolved through the operator's email index (the address is lower-cased before the lookup). For a NetworkSoftwareProvider caller this lookup runs against the operator resolved from the request Origin, NOT the OperatorID sent, so that caller normally fails to resolve the subscriber (401) and must identify the subscriber by SubscriberToken instead.

PhoneNumber
string

Lowest-precedence subscriber lookup key, resolved through the operator's phone index by EXACT string match - the stored value is not normalised here. For a NetworkSoftwareProvider caller this lookup runs against the operator resolved from the request Origin, NOT the OperatorID sent, so that caller normally fails to resolve the subscriber (401) and must identify the subscriber by SubscriberToken instead. Note this route reads the plain PhoneNumber key; it does NOT recognise 'PhoneNumber.E164'.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "{Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}",
  • "MinViewWindowDateUTC.ISO8601": "2026-08-01T00:00:00.000Z",
  • "MaxViewWindowDateUTC.ISO8601": "2026-08-19T23:59:59.000Z",
  • "pageSize": 250,
  • "searchText": "authentication failed",
  • "searchBefore": [
    ],
  • "customQuery": { },
  • "function_name": "string",
  • "LogType": "string",
  • "Administrator": "string",
  • "AdministratorOS": "string",
  • "AdministratorBrowser": "string",
  • "SourceIP": "string",
  • "SourceLocale": "string",
  • "SubscriberToken": "string",
  • "VenueID": "string",
  • "UnitID_internal": "string",
  • "EquipmentID": "string",
  • "KeyPoolID": "string",
  • "ServicePlanID": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber": "string"
}

Response samples

Content type
application/json
{
  • "log": [
    ],
  • "currentCount": 250,
  • "totalCount": 10000,
  • "pageSize": 250,
  • "hasMore": true,
  • "searchBefore": [
    ],
  • "MinViewWindowDateUTC.ISO8601": "string",
  • "MaxViewWindowDateUTC.ISO8601": "string",
  • "allowedFilterFields": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/listSubscriberLog (GET)

Returns one subscriber's audit and event log, newest first. The subscriber is identified by SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber, tried in that order. A NetworkSoftwareProvider caller can identify the subscriber only by a direct SubscriberToken — the other three lookup fields resolve against the provider's own operator, not the one named in OperatorID.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (any subscriber of the operator), a Venue admin/leasing agent (only a subscriber with a subscription, current or past, at a venue they administer — otherwise reported as not found), or the Subscriber themself (always their own log).

Filtering: searchText runs a fuzzy match; a whitelist of exact-match fields is available, or raw OpenSearch customQuery (which replaces the whitelist). The date window defaults to now for the upper bound and is unbounded below unless you send a lower bound — sending one also switches totalCount from a capped estimate to an exact count. Results are newest-first, paged via searchBefore.

GET reads parameters from the query string: only single-valued filters are supported — array filters, customQuery and paging past the first page require the POST form. Responses carry Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string
Example: AccessToken=<Cognito JWT access token>

Cognito access token, as an alternative to the Authorization header. Absent from both gives 401 'AccessToken Missing. '.

IdToken
string

Optional Cognito ID token. Used by the shared token validator only when the access token's username is not already cached: the ID token is then verified instead, and its preferred_username (or its email, resolved through the operator's email index) becomes the caller identity.

SubscriberToken
string
Example: SubscriberToken=<SubscriberToken>

The subscriber whose log is wanted, given directly. Highest priority of the four identifier parameters. For a Subscriber caller the log read is always the caller's own, whatever is sent here. It is also on the exact-match filter whitelist, so the value AS SENT is applied as a filter before that substitution happens: for an operator-role caller that is a second, identical clause and harmless, but a Subscriber caller who sends another subscriber's token gets an empty log rather than their own.

externalSubscriberID
string
Example: externalSubscriberID=EXT-SUB-1

The operator's own subscriber identifier. Used only when SubscriberToken is absent. Resolved through the operator's external-id index and must match exactly one record.

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

The subscriber's email address. Used only when SubscriberToken and externalSubscriberID are both absent. Lower-cased before the index lookup and must match exactly one record.

PhoneNumber
string
Example: PhoneNumber=+15555550123

The subscriber's phone number. Lowest priority - used only when none of the three above is present. Matched verbatim (no normalisation is applied at this point), so it must be in the same form the operator's phone index was written with.

VenueID
string
Example: VenueID={pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}

Doubles as the venue-scope selector and as an exact-match filter. A caller whose only role is VenueAdministrator or LeasingAgent is classified as a Venue caller ONLY if this matches a venue they hold; the same value is then forced onto the query as a VenueID term, so their view of the subscriber's log is limited to that venue.

OperatorID
string

The operator whose log is wanted. REQUIRED for a NetworkSoftwareProvider caller, which otherwise gets 401 'OperatorID Missing. '. For every other caller the operator is taken from the request Origin and this parameter has no effect.

MinViewWindowDateUTC.ISO8601
string <date-time>
Example: MinViewWindowDateUTC.ISO8601=2026-08-01T00:00:00.000Z

Lower bound of the @timestamp range. DEFAULTS TO NONE - omit it and the query has no lower bound. Supplying it also switches total counting to exact mode; without it totalCount is capped at 10000. An unparseable value is a 400.

MaxViewWindowDateUTC.ISO8601
string <date-time>
Example: MaxViewWindowDateUTC.ISO8601=2026-08-19T23:59:59.999Z

Upper bound of the @timestamp range. Defaults to the request time plus a 60-second OpenSearch indexing-lag buffer. An unparseable value is a 400.

pageSize
integer
Default: 250
Example: pageSize=250

Entries per page, capped at 500. Omit it for the default of 250. Because the value arrives as a string, '0' is truthy here and produces an empty page rather than the default.

searchText
string
Example: searchText=password reset

Fuzzy full-text search across event, function_name, Administrator, SourceIP, SubscriberToken and LogType (best_fields, operator 'and', fuzziness AUTO).

function_name
string

Exact-match filter on the function_name field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query. The Vault function or route that emitted the entry.

LogType
string

Exact-match filter on the LogType field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query. For example 'INFO' or 'ERROR' - the emitter's own label, not a validated enum. Note that LogType is filterable but is NOT among the fields this resource returns.

Administrator
string

Exact-match filter on the Administrator field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

AdministratorOS
string

Exact-match filter on the AdministratorOS field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

AdministratorBrowser
string

Exact-match filter on the AdministratorBrowser field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

SourceIP
string

Exact-match filter on the SourceIP field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

SourceLocale
string

Exact-match filter on the SourceLocale field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

UnitID_internal
string

Exact-match filter on the UnitID_internal field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query. Format: {VenueID}.{UNITID}.{UNITBUILDING}.{UNITFLOOR}.

EquipmentID
string

Exact-match filter on the EquipmentID field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

KeyPoolID
string

Exact-match filter on the KeyPoolID field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

ServicePlanID
string

Exact-match filter on the ServicePlanID field. Applied only when present and only when customQuery is absent. On this form only a single value can be given, so it always becomes a term query, never a terms query.

header Parameters
Authorization
string
Example: Bearer <Cognito JWT access token>

Bearer token for authentication, and the preferred way to authenticate this form. When present, the second whitespace-separated word of the header REPLACES any AccessToken supplied as a query parameter.

Accept-Language
string
Example: en-US

Selects the language of the error messages. A first tag beginning with 'es' selects Spanish (Latin America); anything else selects English (US). It has no effect on the log entries themselves.

Responses

Response samples

Content type
application/json
Example
{
  • "log": [
    ],
  • "currentCount": 2,
  • "totalCount": 2,
  • "pageSize": 250,
  • "hasMore": false,
  • "MinViewWindowDateUTC.ISO8601": "2026-08-01T00:00:00.000Z",
  • "MaxViewWindowDateUTC.ISO8601": "2026-08-19T12:01:00.000Z",
  • "allowedFilterFields": [
    ],
  • "message": "",
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/listSubscriberKeySessions

Hourly bandwidth usage for one subscriber over the trailing 7 days — one entry per hour including idle hours (all counters 0).

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent for the supplied VenueID, or the subscriber themself. Operator/venue callers identify the subscriber via SubscriberToken/externalSubscriberID/EmailAddress/PhoneNumber.E164 (in that precedence). A Subscriber caller always resolves to their own token.

⚠ A Venue caller is confined to its own venues — naming a subscriber with no subscription (current or past) at one of the caller's venues returns 401 'Subscriber not found.' rather than usage data.

Authorizations:
CognitoAuthorizer
Request Body schema: application/json
required
AccessToken
string

Cognito JWT access token for the calling console user. Required in the body only when no Authorization header is sent: splits the request headers.Authorization on ' ' and copies segment [1] into the request's AccessToken BEFORE the presence check, so a header-only caller passes. Missing from both returns 401 with the translated 'AccessToken Missing. '.

OperatorID
string

Required ONLY when the caller is a NetworkSoftwareProvider (an operator-less console user). Omitting it then returns 401 'OperatorID Missing. '. For every other caller the operator is derived from the request Origin and this field is ignored. Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

SubscriberToken
string

Subscriber identifier. Highest-precedence lookup key. Vault-generated tokens are 8 characters; an operator-supplied token is trimmed to 16 characters.

externalSubscriberID
string

Operator-side subscriber identifier, free-form. Used when SubscriberToken is absent; resolved through the operator's external-subscriber-id index.

EmailAddress
string <email>

Subscriber e-mail. Lower-cased before the cache lookup. Used when SubscriberToken and externalSubscriberID are absent.

PhoneNumber.E164
string

Subscriber phone in E.164. Copied to 'PhoneNumber' for the lookup, and only for NetworkSoftwareProvider / NetworkOperator / Venue callers. Lowest-precedence lookup key.

VenueID
string

Optional. Grants access to a VenueAdministrator / LeasingAgent whose role list contains this venue, and is compared against each session's V field while aggregating. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}. NOTE: both branches of that comparison add the same octets, so passing VenueID does not currently narrow the totals.

Calling-Station-Id
string

Optional device MAC. Normalised by replacing '-' with ':' and upper-casing, then stripping ':' and lower-casing, and echoed as the only entry of each hour's Calling-Station-Id array. NOTE: it is not used to filter the octet totals (sums every device in the bucket).

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "eyJraWQiOiJleGFtcGxlIiwiYWxnIjoiUlMyNTYifQ.<redacted>.<redacted>",
  • "SubscriberToken": "<SubscriberToken>"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "UsageData": [
    ],
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/listSubscriberKeySessions (GET)

Returns an hour-by-hour bandwidth roll-up for one subscriber, covering the trailing 7 days (168 hourly entries, oldest first). Read-only. Hours with no traffic are still returned as zero-filled entries.

Also available as POST, with identical fields sent as a JSON body instead of the query string.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), a Venue admin/leasing agent for the requested VenueID, or the Subscriber themself. The subscriber is selected by PhoneNumber.E164, EmailAddress, SubscriberToken or externalSubscriberID; if none are sent (or the caller is a subscriber), the caller's own usage is returned. A Venue-role caller is limited to subscribers with a subscription, current or past, at a venue they administer.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token for the calling console user. Not marked required because it may instead arrive in the Authorization header, which overrides it - but one of the two must be present or the call is refused with 'AccessToken Missing. '. It is only cryptographically verified when the Origin-resolved operator has a Cognito pool configured.

IdToken
string

Optional Cognito ID token. It is read only by the shared token validation, and only when the presented access token's username was not already cached; in that case the ID token is the one verified, the username is taken from its preferred_username claim, and failing that from an e-mail-to-username lookup. It is also checked against the global sign-out marker, so an ID token issued before the user signed out is refused.

OperatorID
string
Example: OperatorID=<Country>.<State>.<PostalCode_ID>.<OperatorName_ID>.<City_ID>

Target operator. Read ONLY on the NetworkSoftwareProvider branch, where it is mandatory - omitting it there is refused with 'OperatorID Missing. '. Once accepted it replaces the operator context and is removed from the request; it is not itself one of the subscriber-identifying fields, but it selects the operator whose subscribers those fields resolve against. Every other caller's operator comes from the request Origin and this parameter is ignored.

Format: {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

VenueID
string
Example: VenueID=<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>

Authorisation field. It grants the Venue role when it appears in the caller's VenueAdministrator or LeasingAgent list. A venue-scoped caller that omits it matches neither list, is classified a Subscriber caller instead, and receives its OWN usage rather than the target subscriber's.

It does NOT scope the figures: the aggregation compares it against each session's stored venue but adds the same values on both sides of that comparison.

Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Target subscriber, used verbatim when present - it short-circuits the other three lookup keys and performs no lookup of its own. No operator-ownership check is applied to it on this operation; a venue-role caller is still confined by the venue-scope check that follows. Vault-generated tokens are 8 characters; an operator-supplied token is stored trimmed to 16 characters.

externalSubscriberID
string

The operator's own identifier for the subscriber, free-form, resolved through an operator-namespaced key. Used only when SubscriberToken was not supplied.

EmailAddress
string <email>
Example: EmailAddress=subscriber@example.com

Subscriber e-mail, lower-cased before the operator-namespaced lookup. Used only when neither SubscriberToken nor externalSubscriberID was supplied.

PhoneNumber.E164
string

LITERAL dotted parameter name. For a provider-, operator- or venue-role caller it is copied onto PhoneNumber, which is the field the lookup reads. Lowest-precedence lookup key. E.164 form; no example is shown because any realistic value is a real subscriber's number.

PhoneNumber
string

The field the phone lookup actually reads. Sending only this is NOT equivalent to sending 'PhoneNumber.E164': a request carrying none of 'PhoneNumber.E164', EmailAddress, SubscriberToken or externalSubscriberID is first re-labelled a subscriber request, so a caller whose token carries a subscriber token receives its OWN usage and this value is never looked up.

Calling-Station-Id
string
Example: Calling-Station-Id=aabbccddeeff

Device MAC. Hyphens are turned into colons and the value upper-cased, then the colons are stripped and the whole value lower-cased, so hyphen-separated, colon-separated and separator-free spellings in any case all normalise to the same thing. It does NOT filter the octet figures - it only replaces the per-hour device list in the response with this one value.

header Parameters
Authorization
string

'Bearer '. When this header is present and non-empty the part after the first space is taken as the token and written over any AccessToken supplied in the query string, so the header WINS. A header with no space yields no token at all and the call is then refused with 'AccessToken Missing. '.

Accept-Language
string

Only the first two characters of the first language tag are inspected: 'es' selects the Spanish message catalogue for the four messages this operation raises itself; anything else, and an absent header, selects English. It does not affect the shared envelope and token messages, which are English literals in every locale.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "UsageData": [
    ],
  • "errorProcessing": false
}

/networkoperatorconsole/subscribers/listPayments

Returns invoice/payment history as a Payments array plus record counts. Read-only, aside from a best-effort receipt-URL lookup for rows missing one.

Who may call it: an access token is mandatory (no anonymous access). Classified in order: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent (for the VenueID sent), or Subscriber — whichever the token matches first.

Scope: a Subscriber caller (including a staff token that doesn't match its intended role) always sees only their own history; a Venue caller is confined to the VenueID it sent, even if a subscriber token from another venue is supplied.

Date window: defaults to the last 2 years when no lower bound is sent.

Size guard: beyond 2000 matching rows, Payments is emptied and message explains why; PaymentCount becomes 0.

Authorizations:
CognitoAuthorizer
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first) and supplies the OperatorID that scopes every result, the Cognito pool used to verify the token, and any source-IP whitelist. Missing origin is 401 'origin missing. '; an origin resolving to no operator is 401 'Operator not found. '.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) message catalogue, anything else US English. Affects rejection text only - no field in the success body is localized.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT access token. Mandatory unless supplied through the Authorization header, which overrides it. Verified only when the operator record carries a Cognito pool.

IdToken
string

Optional Cognito ID token. When present it is verified instead of the access token and its preferred_username (or its email resolved through the operator's email cache) identifies the caller.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller, which is rejected 401 'OperatorID Missing. ' without it. It then becomes the operator every result is scoped to, and is deleted from the request before filtering. Ignored for every other caller.

VenueID
string

Two jobs at once: it is the value the Venue role check matches against, AND a result filter (rows whose VenueID differs are dropped). A caller whose only role is venue-level must send it. When it is the only identifier given, it also selects the VenueID index as the query source. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

SubscriberToken
string

Selects the SubscriberToken index and filters the result. Overwritten with the caller's own token when the caller is classified Subscriber.

EmailAddress
string

Lower-cased and resolved to a SubscriberToken; on success the raw email is dropped from the in-memory filters (invoice rows may not carry it). If it resolves to nothing, the result is empty. Resolution is attempted only when no SubscriberToken was supplied; when one was, the email stays on as an additional exact-match filter against each invoice row's EmailAddress attribute, which many rows do not carry - so that combination can return an empty result.

PhoneNumber.E164
string

Subscriber phone number. For an operator-level or venue-level caller it is also copied to the un-dotted PhoneNumber field the cache resolver reads, and matched against the phone cache verbatim (no normalisation). Resolution is attempted only when no SubscriberToken was supplied; if it resolves to nothing the result is empty, and when a SubscriberToken was supplied this value stays on as an additional exact-match filter instead.

externalSubscriberID
string

The operator's own subscriber identifier, resolved to a SubscriberToken. Resolution is attempted only when no SubscriberToken was supplied; if it resolves to nothing the result is empty, and when a SubscriberToken was supplied this value stays on as an additional exact-match filter instead.

StripeCustomerID
string

Filters the result and, when no subscriber identifier resolved, selects the Stripe-customer index as the query source.

externalSubscriptionID
string

In-memory filter only; matched exactly against the invoice record's attribute of the same name.

externalVenueID
string

In-memory filter only; matched exactly.

UnitID_internal
string

In-memory filter only; matched exactly.

externalVenueUnitID
string

In-memory filter only; matched exactly.

ServicePlanID
string

In-memory filter only; matched exactly.

externalServicePlanID
string

In-memory filter only; matched exactly.

MinInvoiceDateTimeUTC.ISO8601
string <date-time>

Lower bound on the invoice date, inclusive of equal values (rows strictly earlier are dropped). Takes precedence over MinStartDateTimeUTC.ISO8601. When neither is sent the bound defaults to two years before the request. A value that does not parse to a real date disables the lower bound entirely rather than erroring.

MaxInvoiceDateTimeUTC.ISO8601
string <date-time>

Upper bound on the invoice date, inclusive of equal values. Takes precedence over MaxStartDateTimeUTC.ISO8601. Absent means no upper bound.

MinStartDateTimeUTC.ISO8601
string <date-time>

Fallback lower bound, used only when MinInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is applied to the invoice date, not to any subscription start date.

MaxStartDateTimeUTC.ISO8601
string <date-time>

Fallback upper bound, used only when MaxInvoiceDateTimeUTC.ISO8601 is absent. Despite the name it is applied to the invoice date.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "subscriber@example.com",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "StripeCustomerID": "string",
  • "externalSubscriptionID": "string",
  • "externalVenueID": "string",
  • "UnitID_internal": "string",
  • "externalVenueUnitID": "string",
  • "ServicePlanID": "string",
  • "externalServicePlanID": "string",
  • "MinInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxInvoiceDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MinStartDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z",
  • "MaxStartDateTimeUTC.ISO8601": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "PaymentCount": 1,
  • "NonZeroPaymentCount": 1,
  • "Payments": [
    ],
  • "BillingCycleHours": 720,
  • "DownloadKbps": 100000,
  • "UploadKbps": 100000,
  • "PricePerDownloadGbps.USD": 4,
  • "VenuePriceAdjustment": 0,
  • "VenueUnitPriceAdjustment": 0,
  • "ListBillingCyclePrice.USD": 4999,
  • "NetBillingCyclePrice.USD": 4999,
  • "MinInvoiceDateTimeUTC.ISO8601": "2024-08-20T00:00:00.000Z",
  • "errorProcessing": false
}

/operatorconsole/subscribers/configure

Updates one subscriber's account. No GET route. The whole request body is forwarded to the subscriber-configure service, whose response replaces the body wholesale (hence the statusCode field inside the body).

Which subscriber is targeted: resolved from PhoneNumber.E164/EmailAddress/SubscriberToken/externalSubscriberID, in that order. If the caller is a Subscriber, or sends none of those, the target defaults to the caller's OWN subscriber.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator, a Venue admin/leasing agent, or the Subscriber themself.

Per-field permissions are enforced inside the service, not uniformly. A field that fails its guard is silently dropped, not rejected.

The subscriber record is unlocked at the end of every run, including failures.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

AccessToken is the only universally required field. Everything else is optional; a lookup key (SubscriberToken, externalSubscriberID, EmailAddress or PhoneNumber/PhoneNumber.E164) identifies WHICH subscriber to configure, and omitting all four targets the caller's own account.

AccessToken
required
string

Cognito JWT. May also be sent as Authorization: Bearer <token>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. The token is verified only when the resolved operator has a Cognito pool.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It is moved onto the caller's operator context and DELETED from the forwarded body.

SubscriberToken
string

Primary lookup key - used verbatim when present. Whatever the caller sends is overwritten with the resolved token before delegation, and for a Subscriber-role caller the service overrides it again with the caller's own token.

EmailAddress
string

Doubles as a lookup key and as a writable field. Validated as an email address; a failure gives 401 'Invalid characters in EmailAddress.'. An address already held by a different subscriber gives 401 'Email Address is associated with another account.'.

PhoneNumber.E164
string

Copied onto PhoneNumber by the endpoint before anything else, so it behaves exactly like PhoneNumber below.

PhoneNumber
string

Lookup key and writable field. Writable by an operator admin, an NSP, a Venue caller holding a VenueAdministrator/LeasingAgent role, or the subscriber themselves; otherwise silently deleted. Normalised to E.164 by request validation against the OPERATOR's country; a value that will not normalise gives 401 'Invalid PhoneNumber. Invalid PhoneNumber. ' - the literal is emitted TWICE (when the normaliser throws, the thrown error's own text appears between the two copies). A number already held by a different subscriber gives 401 'PhoneNumber is associated with another account.'.

externalSubscriberID
string

Lookup key ('externalsubscriberid.V3EXTERNALSUBSCRIBERID.') and writable field. Writable only by an operator admin or an NSP. Sanitised with nameAndAddress; a change from the input gives 401 'Invalid characters in externalSubscriberID.'.

VenueID
string

Not a subscriber field - it is what gates Venue-role access: the caller's AdministrativeAccess.Venue.VenueAdministrator or AdministrativeAccess.LeasingAgent array must include this exact value. Format is the venue-id form built by - {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

GivenName
string

Writable by an operator admin, an NSP, a Venue caller with a VenueAdministrator/LeasingAgent role, or the subscriber themselves. Sanitised, which permits letters, digits, '.', '_', '-', '&', spaces, parentheses, commas, '?', '*' and both apostrophe forms; a change from the input gives 401 'Invalid characters in GivenName.'.

FamilyName
string

Same guard and same sanitiser as GivenName; a change gives 401 'Invalid characters in FamilyName.'. Silently deleted when the guard fails.

Status
string

Only two values are recognised, compared case-insensitively after trim: 'aup not accepted' and 'in service'. They are stored in canonical form as 'AUP not accepted' and 'In Service'. Writable by an operator admin, an NSP, or the subscriber themselves. Any OTHER value fails the guard and is ignored entirely - the 'Invalid characters in Status.' branch is unreachable, because it sits in an else of a check the enclosing condition already restricted to those same two values.

locale
string

Accepted only as the literal 'en-us' or 'es-xl'; anything else is ignored and the field is deleted. Writable by an operator admin, an NSP, a Venue caller with a VenueAdministrator/LeasingAgent role, or the subscriber themselves.

contactpref_sms
boolean

Must be a literal true or false (uses [true,false].includes, so the string 'true' is ignored). Same four-role guard as locale. The email counterpart contactpref_email was REMOVED on 2026-08-13 and is no longer read.

phone_number_verified
boolean

Must be a literal true or false. Same four-role guard; otherwise deleted. Propagated to the Cognito user attributes.

SubscriberManagedviaSSO
boolean

Truthy value sets the stored flag to true and then REPLACES the entire request body with just { SubscriberToken, SubscriberManagedviaSSO: true }, so every other field sent in the same call is discarded. There is no role guard on this branch and no way to set it back to false through this endpoint.

Array of objects

DECLARATIVE full replacement of the subscriber's push-notification device list - send the complete current list, not a delta. Ignored unless it is an Array, and a non-array value is deleted. Same four-role guard as locale. At most 20 devices are kept (DEVICE_CAP); entries are deduped by DeviceToken, first wins.

object

Grants or revokes staff roles. The RESULTING role set is validated, not the operation, so a remove-and-reassign in one call is legitimate. A staff member may hold at most ONE role: if the resulting set has more than one entry the call is rejected with statusCode 409 and the message 'A staff member may hold only one role — this request would leave them as ' + the roles joined by ', ' + '. Remove the existing role first. ' - the role list is composed at runtime, so treat that middle part as variable. An ABSENT key leaves that role unchanged; only an Array value is considered. SIEMAdministrators is deliberately not part of the exclusivity set - it is a notification list, not a role.

forgetSubscriberDevices
boolean

Strict === true. Permitted for an operator admin, an NSP, or the subscriber themselves. Without Calling-Station-Id it deletes the whole sd<SubscriberToken> device map; the venue-side vd<VenueID> maps are NOT touched.

Calling-Station-Id
string

Read ONLY alongside forgetSubscriberDevices. Supplying a non-empty value narrows the forget to that one device: the MAC is normalised (separators stripped, lowercased) and only that field is removed from the sd hash. A supplied value that is not a MAC after normalisation gives 401 'Invalid Calling-Station-Id. ' rather than falling through to the delete-everything path; a MAC not present in the map gives 401 'Device not found. '.

forgetSubscriptions
boolean

Strict === true. Operator-admin or NSP only. Ends every active subscription the subscriber holds with this operator, immediately.

forgetSubscriber
boolean

Strict === true. Operator-admin or NSP only. Deletes the subscriber, including the Cognito user. Refused with 401 'Subscriber has active subscriptions.' while any active subscription remains - run forgetSubscriptions first.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "string",
  • "PhoneNumber.E164": "string",
  • "PhoneNumber": "string",
  • "externalSubscriberID": "string",
  • "VenueID": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "Status": "string",
  • "locale": "string",
  • "contactpref_sms": true,
  • "phone_number_verified": true,
  • "SubscriberManagedviaSSO": true,
  • "Devices": [
    ],
  • "AdministrativeAccess": {
    },
  • "forgetSubscriberDevices": true,
  • "Calling-Station-Id": "string",
  • "forgetSubscriptions": true,
  • "forgetSubscriber": true
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": true,
  • "statusCode": 0,
  • "Calling-Station-Id": "string"
}

/operatorconsole/subscribers/configureSubscription

Updates one existing subscription — the caller's whole request body is forwarded once the target subscription is found.

Lookup varies by caller: a console caller (NSP/NetworkOperator/Venue) selects by SubscriptionID (must belong to the caller's operator, not ended) or StripeClientSecret; a Subscriber caller may instead send UserFriendlySubscriptionID (⚠ the value itself is never actually matched — it just routes into a separate, still-psk-filtered lookup).

⚠ Both zero matches and multiple matches are silent no-ops — the call returns HTTP 200 having done nothing, with no way to distinguish the two.

Each supported property is applied by its own guarded block; a service-plan or bandwidth change tears down provisioning markers, re-seeds PendingGatewayEnable, and decommissions the unit's VLAN.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
string

Caller's Cognito JWT in the body. May instead be sent as Authorization: Bearer <jwt>, which the endpoint splits on a space and copies into the body before validating. Neither present -> 401 'AccessToken Missing. '. Verified by request validation only when the operator has a CognitoPool.

OperatorID
string

Required ONLY for a NetworkSoftwareProvider caller (operator record has a NetworkSoftwareProviderID, token has a Username and no SubscriberToken). Missing then -> 401 'OperatorID Missing. '; present, it becomes the target operator and is deleted from the forwarded body. Ignored for every other caller. See the note about NSP callers being unable to complete this operation.

VenueID
string

Used ONLY to authorise a venue-scoped caller: the token's AdministrativeAccess.Venue.VenueAdministrator or AdministrativeAccess.LeasingAgent must include this exact value. It does not select the subscription. Format is built by as '{pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}'.

SubscriptionID
string

Primary selector for an operator/venue caller. The row is accepted only when its OperatorID equals the caller's and it has no EndDateTimeUTC.ISO8601 in the past.

StripeClientSecret
string

Alternative selector, resolved through the OperatorID-StripeClientSecret GSI. Only consulted when SubscriptionID was not supplied.

UserFriendlySubscriptionID
string

Dual purpose. Its PRESENCE (non-empty) routes a Subscriber caller into a dedicated lookup branch, but its VALUE is never compared to anything: that branch selects by the caller's own SubscriberToken, or by psk when one is sent, and filters only on the end date. It therefore does NOT identify which subscription is edited - a caller holding more than one live subscription trips the subscription?.length == 1 gate and gets a silent HTTP 200 with message ''. HTML-stripped and truncated to 40 characters; if the value changes under sanitisation the call is rejected 401 'Invalid characters in UserFriendlySubscriptionID.'.

psk
string

Subscriber-caller only, and read only inside the branch a non-empty UserFriendlySubscriptionID selects: the lookup becomes the record store, kept only for rows whose SubscriberToken equals the caller's. Omit it and the branch instead returns every unexpired subscription the caller holds.

SubscriberToken
string

One of the lookup keys the endpoint passes to request validation A Subscriber caller never needs it - their own token from the JWT is used.

EmailAddress
string <email>

Subscriber lookup key for an operator/venue caller. Lowercased by request validation.

PhoneNumber.E164
string

Subscriber lookup key. For a NetworkSoftwareProvider / NetworkOperator / Venue caller the endpoint copies it onto PhoneNumber before the lookup.

externalSubscriberID
string

Subscriber lookup key.

StartDateTimeUTC.ISO8601
string

New subscription start. Renamed internally to StartDateTimeUTC. Only processed while the subscription has NOT yet started. Rejected 401 'Invalid StartDateTimeUTC. ' when unparseable or later than 3000-12-31, 401 'StartDateTimeUTC cannot be after EndDateTimeUTC ' (a runtime-composed string), or 401 'Unable to pre-pone StartDateTimeUTC - overlapping subscription in unit. '. For a wiredunit the time is snapped to local start-of-day unless doNotResetDatetoMidnight is exactly true. Applying it requires an operator admin, an NSP, a VenueAdministrator/LeasingAgent for the subscription's OWN VenueID, or the subscription's own subscriber.

EndDateTimeUTC.ISO8601
string

New subscription end; renamed internally to EndDateTimeUTC. A single SPACE (' ') REMOVES the end date entirely. Rejected 401 'Invalid EndDateTimeUTC. ' or 401 'EndDateTimeUTC cannot be before SartDateTimeUTC. ' (misspelling verbatim in the code). The role gate is wider than the start-date one: it also admits the RealpageConnector, VenueUnitCleaner and LengthySubscriptionCleaner categories. Applying it also seeds PendingDeactivation and, for an immediate end, evicts the policy: cache key.

endImmediately
boolean

Exactly true overwrites EndDateTimeUTC with the current instant and suppresses the end-before-start rejection.

doNotResetDatetoMidnight
boolean

Exactly true (=== true) suppresses the wiredunit start-of-day snapping.

externalSubscriptionID
string

Operator-admin / NSP only. A single SPACE (' ') REMOVES the stored value; any other value is sanitised and stored, and a value that changes under sanitisation is rejected 401 'Invalid characters in externalSubscriptionID.'.

object

Service-plan change. Accepted from an operator admin, an NSP, or the subscription's own subscriber. The plan must already be listed on the subscription's venue, else 401 'ServicePlanID not available. '. A successful change rewrites BillingCyclePrice to the new plan's LIST price, computes a pro-rated BillingCyclePriceAdjustment, may set or clear paymentFailed, and forces a full gateway re-provision.

object

Operator-admin / NSP only.

object

Operator-admin / NSP only.

object

Container for the remaining editable properties. Each nested field has its own role gate.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "SubscriptionID": "<subscription id>",
  • "EndDateTimeUTC.ISO8601": "2026-12-31T00:00:00.000Z"
}

Response samples

Content type
application/json
Example
{
  • "message": "EndDateTimeUTC updated to 2026-12-31T00:00:00.000Z. Cancellation source = Cancelled by administrator.",
  • "errorProcessing": false
}

/operatorconsole/subscribers/listDevices

Lists a subscriber's or venue's devices, paginated, sorted most-recently-used first — devices idle more than 7 days are dropped; online/offline counts are computed over the WHOLE filtered set, not just the returned page.

Roles, in order: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent for the REQUESTED VenueID, or Subscriber. ⚠ A venue admin who omits VenueID falls through to the Subscriber branch and gets their OWN devices.

Which map is read: the venue map for NetworkOperator/Venue with a VenueID; otherwise the subscriber map for NetworkOperator/Subscriber with a resolved SubscriberToken.

GET adds Cache-Control: private, max-age=5 to its response.

Authorizations:
CognitoAuth
header Parameters
Authorization
string

When present and non-empty the endpoint OVERWRITES the request's AccessToken with authHeader.split(' ')[1]. Because index 1 is taken unconditionally, a bare token with no 'Bearer ' prefix sets AccessToken to undefined and discards a token supplied in the body/query, producing 401 'AccessToken Missing. '. Format: 'Bearer '.

Request Body schema: application/json
optional
AccessToken
string

Cognito access token. Required: absent or empty is 401 'AccessToken Missing. '. Overwritten by the Authorization header when present. The BODY itself is optional: a request that carries the token in the Authorization header and needs no other field may send no body at all (the request body null yields the request body {}).

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. '), ignored for every other category. See the notes: an NSP caller still receives an empty device list.

VenueID
string

Selects the VENUE device map instead of a subscriber's. Honoured only when access_category is NetworkOperator or Venue. For the Venue category it is also the value matched against the caller's VenueAdministrator / LeasingAgent arrays. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (example).

SubscriberToken
string

Identifies the subscriber whose map to read.

externalSubscriberID
string

Alternative subscriber lookup, used only when SubscriberToken is absent: resolved through the operator's external-subscriber-id index.

EmailAddress
string

Alternative subscriber lookup, third in the chain: resolved through email{OperatorID}.V3EMAIL.{lower-cased value}. Request validation lower-cases it first.

PhoneNumber
string

Alternative subscriber lookup, last in the chain: resolved through phone{OperatorID}.V3PHONE.{value} with NO normalisation, so it must already be in the stored E.164 form.

PhoneNumber.E164
string

Copied over PhoneNumber before the lookup when truthy, so the two are interchangeable and this one wins.

Page
integer

1-based page number. parseInt(value,10); anything not > 0 (absent, non-numeric, 0, negative) becomes 1. An out-of-range page yields an empty Devices map with the whole-set counts still populated.

PageSize
integer

Devices per page. parseInt(value,10); anything not > 0 becomes the default (5000 unless LISTDEVICES_PAGE_SIZE overrides it) and anything above 5000 is clamped to 5000.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO",
  • "SubscriberToken": "string",
  • "externalSubscriberID": "string",
  • "EmailAddress": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "Page": 1,
  • "PageSize": 5000
}

Response samples

Content type
application/json
Example
{
  • "Now": "2026-08-19T14:03:11.482Z",
  • "DeviceCountOnline": 1,
  • "DeviceCountOffline": 0,
  • "Devices": {
    },
  • "SubscriberToken": "<SubscriberToken>",
  • "Expiry": "2026-08-27T14:03:11.482Z",
  • "TotalCount": 1,
  • "Page": 1,
  • "PageSize": 5000,
  • "TotalPages": 1,
  • "HasMore": false,
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/subscribers/listDevices (GET)

Lists a subscriber's or venue's devices, paginated, sorted most-recently-used first — devices idle more than 7 days are dropped; online/offline counts are computed over the WHOLE filtered set, not just the returned page.

Roles, in order: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent for the REQUESTED VenueID, or Subscriber. ⚠ A venue admin who omits VenueID falls through to the Subscriber branch and gets their OWN devices.

Which map is read: the venue map for NetworkOperator/Venue with a VenueID; otherwise the subscriber map for NetworkOperator/Subscriber with a resolved SubscriberToken.

GET adds Cache-Control: private, max-age=5 to its response.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access token. Supply it EITHER here as a query parameter (merged into the request body) OR as an 'Authorization: Bearer ' header, which is written over the request's AccessToken BEFORE the presence check - which is why this parameter is not marked required. If neither supplies a non-empty value the request is 401 'AccessToken Missing. '.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. '), ignored for every other category. See the notes: an NSP caller still receives an empty device list. Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

VenueID
string
Example: VenueID=pmg123._V3VENUE_.USA.IL.60601.DOWNTOWN.CHICAGO

Selects the VENUE device map instead of a subscriber's. Honoured only when access_category is NetworkOperator or Venue. For the Venue category it is also the value matched against the caller's VenueAdministrator / LeasingAgent arrays.

Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (example). Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

SubscriberToken
string

Identifies the subscriber whose map to read. FIRST in the resolution chain of request validation - when present it is used verbatim with no further lookup; the operator. A venue-scope check does still apply, but ONLY to callers whose access_category is 'Venue': the token is discarded when the subscriber holds no venue the caller administers. Supplied as a query-string parameter and merged into the request body.

externalSubscriberID
string

Alternative subscriber lookup, used only when SubscriberToken is absent: resolved through the operator's external-subscriber-id index. Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

EmailAddress
string

Alternative subscriber lookup, third in the chain: resolved through email{OperatorID}.V3EMAIL.{lower-cased value}. Behaviour is the same either way. Supplied as a query-string parameter, so it reaches the endpoint as a string.

PhoneNumber
string

Alternative subscriber lookup, last in the chain: resolved through phone{OperatorID}.V3PHONE.{value} with NO normalisation, so it must already be in the stored E.164 form. Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

PhoneNumber.E164
string

Copied over PhoneNumber before the lookup when truthy, so the two are interchangeable and this one wins. Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

Page
integer
Example: Page=1

1-based page number. parseInt(value,10); anything not > 0 (absent, non-numeric, 0, negative) becomes 1. An out-of-range page yields an empty Devices map with the whole-set counts still populated. Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

PageSize
integer
Example: PageSize=5000

Devices per page. parseInt(value,10); anything not > 0 becomes the default (5000 unless LISTDEVICES_PAGE_SIZE overrides it) and anything above 5000 is clamped to 5000. Supplied as a query-string parameter and merged into the request body, so it reaches the endpoint as a string (Page/PageSize are parseInt'ed, so a numeric string is fine).

header Parameters
Authorization
string

When present and non-empty the endpoint OVERWRITES the request's AccessToken with authHeader.split(' ')[1]. Because index 1 is taken unconditionally, a bare token with no 'Bearer ' prefix sets AccessToken to undefined and discards a token supplied in the body/query, producing 401 'AccessToken Missing. '. Format: 'Bearer '.

Responses

Response samples

Content type
application/json
Example
{
  • "Now": "2026-08-19T14:03:11.482Z",
  • "DeviceCountOnline": 1,
  • "DeviceCountOffline": 0,
  • "Devices": {
    },
  • "SubscriberToken": "<SubscriberToken>",
  • "Expiry": "2026-08-27T14:03:11.482Z",
  • "TotalCount": 1,
  • "Page": 1,
  • "PageSize": 5000,
  • "TotalPages": 1,
  • "HasMore": false,
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/subscribers/listNotifications

Lists in-portal messages sent to a subscriber, keyed by MessageID.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent for the supplied VenueID, or Subscriber. A caller supplying none of PhoneNumber.E164/EmailAddress/SubscriberToken/externalSubscriberID is re-labelled Subscriber and reads its own messages.

Query path: with VenueID, a venue-scoped index is used; without it, the operator-agnostic index is used, but an operator/venue caller naming a SubscriberToken directly must first pass an ownership check against the cache — a mismatch is 401.

GET merges the query string into the request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoAuth
header Parameters
Authorization
string

'Bearer '. When present and non-empty the endpoint splits on a space and uses element [1] as the AccessToken, OVERWRITING any AccessToken supplied in the request. A header with no space yields undefined and is then treated as a missing token (401).

Accept-Language
string

Only the first tag's leading two characters are inspected; 'es' selects the Spanish message catalogue ('es-xl'), anything else 'en-us'.

Request Body schema: application/json
optional
AccessToken
string

Cognito JWT. Ignored when an Authorization header is present, which overwrites it. Absent/empty in both places -> 401.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it becomes the operator context and is then deleted from the request. Ignored for every other role.

VenueID
string

Format is the composite Vault VenueID ({pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}); no example is given because any realistic value names a real venue.

SubscriberToken
string

Target subscriber, highest-precedence lookup key. When an operator/venue caller uses it WITHOUT VenueID, ownership is verified against the cache subscriberinfo record and a mismatch is 401. Ignored for a Subscriber caller.

EmailAddress
string

Subscriber lookup key, lower-cased before use. Used only when SubscriberToken and externalSubscriberID are absent.

externalSubscriberID
string

Subscriber lookup key; takes precedence over EmailAddress and PhoneNumber.

PhoneNumber.E164
string

Subscriber lookup key. Copied to the internal PhoneNumber field ONLY for a NetworkSoftwareProvider/NetworkOperator/Venue caller; lowest precedence in request validation Note the key contains a literal dot.

IdToken
string

Optional Cognito ID token, read straight off the request body by request validation. A non-empty AccessToken is still required by the endpoint's own presence check.

PhoneNumber
string

Lowest precedence — used only when SubscriberToken, externalSubscriberID and EmailAddress are all absent. Because supplying none of PhoneNumber.E164 / EmailAddress / SubscriberToken / externalSubscriberID also re-labels the caller access_category 'Subscriber' and pins it to its OWN token's SubscriberToken, a raw PhoneNumber actually resolves a subscriber only when the calling token carries no SubscriberToken — e.g. a NetworkSoftwareProvider caller, which test requires to have none. For an operator/venue caller that sends PhoneNumber.E164, overwrites this field with that value.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "SubscriberToken": "string",
  • "EmailAddress": "string",
  • "externalSubscriberID": "string",
  • "PhoneNumber.E164": "string",
  • "IdToken": "string",
  • "PhoneNumber": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "messages": {
    },
  • "errorProcessing": false
}

/operatorconsole/subscribers/listNotifications (GET)

Lists in-portal messages sent to a subscriber, keyed by MessageID.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, Venue admin/leasing agent for the supplied VenueID, or Subscriber. A caller supplying none of PhoneNumber.E164/EmailAddress/SubscriberToken/externalSubscriberID is re-labelled Subscriber and reads its own messages.

Query path: with VenueID, a venue-scoped index is used; without it, the operator-agnostic index is used, but an operator/venue caller naming a SubscriberToken directly must first pass an ownership check against the cache — a mismatch is 401.

GET merges the query string into the request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito JWT. Merged into the request body. Ignored when an Authorization header is present, which overwrites it. Absent/empty in both places -> 401.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it becomes the operator context and is then deleted from the request. Ignored for every other role.

VenueID
string

Format is the composite Vault VenueID ({pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}); no example is given because any realistic value names a real venue.

SubscriberToken
string

Target subscriber, highest-precedence lookup key. When an operator/venue caller uses it WITHOUT VenueID, ownership is verified against the cache subscriberinfo record and a mismatch is 401. Ignored for a Subscriber caller.

EmailAddress
string

Subscriber lookup key. Used only when SubscriberToken and externalSubscriberID are absent.

externalSubscriberID
string

Subscriber lookup key; takes precedence over EmailAddress and PhoneNumber.

PhoneNumber.E164
string

Subscriber lookup key. Copied to the internal PhoneNumber field ONLY for a NetworkSoftwareProvider/NetworkOperator/Venue caller; lowest precedence in request validation Note the key contains a literal dot.

IdToken
string

Optional Cognito ID token, merged into the request body from the query string before the token is validated. A non-empty AccessToken is still required by the endpoint's own presence check.

PhoneNumber
string

Lowest precedence — used only when SubscriberToken, externalSubscriberID and EmailAddress are all absent. Because supplying none of PhoneNumber.E164 / EmailAddress / SubscriberToken / externalSubscriberID also re-labels the caller access_category 'Subscriber' and pins it to its OWN token's SubscriberToken, a raw PhoneNumber actually resolves a subscriber only when the calling token carries no SubscriberToken — e.g. a NetworkSoftwareProvider caller, which test requires to have none. For an operator/venue caller that sends PhoneNumber.E164, overwrites this field with that value.

header Parameters
Authorization
string

'Bearer '. When present and non-empty the endpoint splits on a space and uses element [1] as the AccessToken, OVERWRITING any AccessToken supplied in the request. A header with no space yields undefined and is then treated as a missing token (401).

Accept-Language
string

Only the first tag's leading two characters are inspected; 'es' selects the Spanish message catalogue ('es-xl'), anything else 'en-us'.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "messages": {
    },
  • "errorProcessing": false
}

/operatorconsole/subscribers/login

Authenticates a subscriber against the operator's Cognito pool and returns Cognito JWTs. Two mutually exclusive flows: (1) credential login — Password plus an identifier (EmailAddress, PhoneNumber, or SubscriberToken used directly as the Cognito username); (2) SSO.

The operator must have a fully configured Cognito pool (id, app client id AND secret) or every request is rejected before either flow runs.

⚠ PII is deliberately stripped before responding — SubscriberToken, EmailAddress, PhoneNumber, GivenName, FamilyName, CognitoID, Status and wpa2ekey are removed even though they're present in the cached subscriber record merged into the response.

Authorizations:
CognitoAuthNone
Request Body schema: application/json
required
Password
string <password>

Subscriber password. Selects the credential flow (tested as Password?.length > 0). Must be accompanied by exactly one identifier below. Redacted to the literal '*' before any logging.

EmailAddress
string <email>

Subscriber email. Lowercased by request validation before use. Only consulted when its length is >= 5; a shorter value silently falls through to the PhoneNumber branch.

PhoneNumber
string

Only reached when EmailAddress is absent or shorter than 5 characters.

SubscriberToken
string

Subscriber token used directly as the Cognito username, lowercased. Only reached when neither EmailAddress (>= 5 chars) nor PhoneNumber was supplied, and only honoured when longer than 4 characters.

authorizationToken
string

OAuth2 authorization CODE from the operator's Cognito hosted UI - NOT a bearer JWT. Its presence (length > 0) selects the SSO flow and takes precedence over Password. The code is exchanged at <CognitoPool_Domain>/oauth2/token with redirect_uri set to the request's Origin.

Domain
string

Read by the shared validator, not by this endpoint: when the calling Origin resolves to a NetworkSoftwareProvider operator, Domain selects a second operator record into StagedOperator. It does not change which pool the login authenticates against.

property name*
additional property
any

Responses

Request samples

Content type
application/json
Example
{
  • "EmailAddress": "subscriber@example.com",
  • "Password": "<password>"
}

Response samples

Content type
application/json
{
  • "AuthenticationResult": {
    },
  • "message": "",
  • "errorProcessing": false
}

/operatorconsole/subscribers/resetSubscriptionInvoiceDate

Restarts one subscription's billing period without charging anything or rewriting history — appends a fresh timestamp to the subscription's InvoiceDateTimeUTC.ISO8601 list and recomputes NextInvoiceDue; the payment scheduler always reads the LATEST entry.

Identified by: EmailAddress + UnitID_internal, resolved against the operator's ACTIVE subscriptions at that unit — exactly one match is required.

Access: an NSP (must send OperatorID) or a NetworkOperator DomainAdministrator/AccountManager/CustomerSupport.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
string

Cognito JWT. May be sent in the body or as Authorization: Bearer <token>; the header wins.

OperatorID
string

Target operator. REQUIRED for a NetworkSoftwareProvider caller and deleted from the body once accepted. Ignored for a NetworkOperator caller.

EmailAddress
required
string <email>

REQUIRED. Identifies the subscriber. Lower-cased, checked as an email address, then trimmed and lower-cased again and once more inside the service.

UnitID_internal
required
string

REQUIRED. The internal unit identifier the subscription is attached to.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "user@example.com",
  • "UnitID_internal": "string"
}

Response samples

Content type
application/json
{
  • "message": "Operation complete. ",
  • "InvoiceDateTimeUTC": "2019-08-24T14:15:22Z",
  • "NextInvoiceDue": "2019-08-24T14:15:22Z",
  • "errorProcessing": false,
  • "statusCode": 200
}

/operatorconsole/subscribers/validateEmailAddress

Looks up a subscriber by EMAIL ADDRESS and returns their cached profile. Despite the name, performs no email-format validation and reports no availability flag — it either returns the profile (200) or rejects (401).

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, or Venue admin/leasing agent for the supplied VenueID. ⚠ No subscriber path — a plain subscriber token is refused.

Lookup: only runs when EmailAddress is at least 5 characters — SubscriberToken/externalSubscriberID/PhoneNumber are deleted from the request first, so email is the only usable key. Any other outcome (too short, no cache entry, operator mismatch) is 401 'Subscriber not found.' A Venue caller is additionally confined to subscribers at its own venues.

Read-only. GET merges the query string into the request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoAuthNone
header Parameters
Authorization
string

'Bearer '. When present and non-empty the endpoint takes split(' ')[1] as the AccessToken, OVERWRITING any AccessToken in the request.

Accept-Language
string

Only the first tag's leading two characters are inspected; 'es' selects the Spanish message catalogue, anything else English.

Request Body schema: application/json
optional
EmailAddress
required
string >= 5 characters

The subscriber's email. Ignored unless its length is >= 5; lower-cased before the cache read. Absent or shorter than 5 characters produces 401 'Subscriber not found.', not a validation error.

AccessToken
string

Cognito JWT. Overwritten by the Authorization header when that is present. Missing in both places -> 401.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it becomes the operator context and is deleted from the request. Ignored for every other role — an operator or venue caller's operator comes from the request Origin.

VenueID
string

Only used to grant the Venue role: it must appear in the token's AdministrativeAccess.Venue.VenueAdministrator or AdministrativeAccess.LeasingAgent array. It does NOT filter the lookup. Format is the composite Vault VenueID ({pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}); no example is given because any realistic value names a real venue.

IdToken
string

Optional Cognito ID token, read straight off the request body by request validation. A non-empty AccessToken is still required by the endpoint's own presence check.

Responses

Request samples

Content type
application/json
{
  • "EmailAddress": "string",
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "IdToken": "string"
}

Response samples

Content type
application/json
{
  • "message": "",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "locale": "string",
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "errorProcessing": false
}

/operatorconsole/subscribers/validateEmailAddress (GET)

Looks up a subscriber by EMAIL ADDRESS and returns their cached profile. Despite the name, performs no email-format validation and reports no availability flag — it either returns the profile (200) or rejects (401).

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator, or Venue admin/leasing agent for the supplied VenueID. ⚠ No subscriber path — a plain subscriber token is refused.

Lookup: only runs when EmailAddress is at least 5 characters — SubscriberToken/externalSubscriberID/PhoneNumber are deleted from the request first, so email is the only usable key. Any other outcome (too short, no cache entry, operator mismatch) is 401 'Subscriber not found.' A Venue caller is additionally confined to subscribers at its own venues.

Read-only. GET merges the query string into the request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
EmailAddress
required
string >= 5 characters

The subscriber's email. Ignored unless its length is >= 5. Absent or shorter than 5 characters produces 401 'Subscriber not found.', not a validation error.

AccessToken
string

Cognito JWT, merged in from the query string. Overwritten by the Authorization header when that is present. Missing in both places -> 401.

OperatorID
string

REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it becomes the operator context and is deleted from the request. Ignored for every other role — an operator or venue caller's operator comes from the request Origin.

VenueID
string

Only used to grant the Venue role: it must appear in the token's AdministrativeAccess.Venue.VenueAdministrator or AdministrativeAccess.LeasingAgent array. It does NOT filter the lookup. Format is the composite Vault VenueID ({pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}); no example is given because any realistic value names a real venue.

IdToken
string

Optional Cognito ID token, merged into the request body from the query string before the token is validated. A non-empty AccessToken is still required by the endpoint's own presence check.

header Parameters
Authorization
string

'Bearer '. When present and non-empty the endpoint takes split(' ')[1] as the AccessToken, OVERWRITING any AccessToken in the request.

Accept-Language
string

Only the first tag's leading two characters are inspected; 'es' selects the Spanish message catalogue, anything else English.

Responses

Response samples

Content type
application/json
{
  • "message": "",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "locale": "string",
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "errorProcessing": false
}

Keypools

🔑 Key Pool Management

Management of authentication key pools for subscriber access control and venue-specific authentication services.

Key Pool Operations

  • 🔑 Pool Creation: Create and configure new authentication key pools
  • 📊 Pool Management: Monitor key usage, availability, and performance metrics
  • 🔄 Key Rotation: Automated and manual key rotation policies and procedures
  • 📋 Assignment Rules: Venue-specific key pool assignment and distribution
  • 🛡️ Security Policies: Key expiration, access control, and security configurations
  • 📈 Analytics: Usage tracking, performance monitoring, and capacity planning

Integration Features

  • 🏢 Venue Binding: Associate key pools with specific venues and operators
  • ⚙️ Policy Engine: Advanced rules for key distribution and management
  • 📊 Reporting: Comprehensive key usage and security analytics
  • 🔧 Maintenance: Pool cleanup, optimization, and health monitoring

/networkoperatorconsole/keypools/listKeypools

Lists the keypools (SSIDs) visible to the caller — served entirely from cache, no database read.

Response shape depends on VenueID: without it, myKeyPoolList is an OBJECT keyed by KeyPoolID (operator-wide); with it, an ARRAY combining the operator's global-scope keypools, the venue's own KeyPoolID set, and one synthesized entry per venue-unit SSID. The two shapes don't even spell the id key the same way (KeyPoolID vs KeypoolID) — treat them as distinct contracts, not interchangeable.

Roles: an access token is mandatory. NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent — which requires VenueID to be reachable at all. No anonymous fallthrough.

GET and POST share one implementation; on POST, query-string parameters are ignored — every field must be in the JSON body.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

AccessToken is the only universally required field; it may instead be sent as an Authorization: Bearer header. OperatorID is required for a NetworkSoftwareProvider caller only.

AccessToken
string

Cognito access-token JWT. May also be sent as Authorization: Bearer <jwt>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. The token is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token. When present it is verified instead of the access token and the caller's username is taken from it.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It becomes the target operator and is then DELETED from the request. Ignored for every other caller. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

VenueID
string

When present, the venue-scoped cache entry is read instead of the operator-wide one and myKeyPoolList comes back as an ARRAY. It is also the value matched by the venue-role check, so a VenueAdministrator or LeasingAgent must supply it. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string"
}

Response samples

Content type
application/json
{
  • "myKeyPoolCount": 0,
  • "myKeyPoolList": {
    },
  • "message": "",
  • "errorProcessing": false
}

/networkoperatorconsole/keypools/listKeypools (GET)

Lists the keypools (SSIDs) visible to the caller. The answer is served entirely from the cache - this operation performs no database read of its own and writes nothing.

Which cache entry is read depends on whether VenueID is supplied.

  • Without VenueID the operator-wide entry is read. When not cached it is rebuilt from the operator's keypool rows, and the value is an OBJECT keyed by KeyPoolID - an EMPTY object, not an empty array, when the operator has no keypools.
  • With VenueID the venue-scoped entry is read. When not cached it is rebuilt as an ARRAY holding the operator's global-scope keypools, the keypools listed in that venue's KeyPoolID set, and one synthesised entry per venue-unit SSID. That rebuild enforces its own ownership guard: if the venue does not belong to the operator it yields an empty list rather than another operator's data. A venue-scoped rebuild that yields nothing is not cached, and the response keeps the initial empty array.

So myKeyPoolList changes TYPE with the request - object without VenueID, array with it - and the two shapes do not even spell the identifier the same way (the service's key is the KeyPoolID; each array element carries a KeypoolID property, lower-case p). Clients cannot treat them interchangeably.

Authorisation is evaluated in this order.

  1. An access token is mandatory. With none present the call is rejected 401 'AccessToken Missing. '.
  2. NetworkSoftwareProvider - the operator resolved from the request Origin carries a NetworkSoftwareProviderID, the token resolved to a Username, and the token carries no SubscriberToken. Such a caller MUST send OperatorID (401 'OperatorID Missing. ' otherwise); it becomes the target operator and is then removed from the request.
  3. NetworkOperator - the token lists the Origin-resolved operator under DomainAdministrator, AccountManager or CustomerSupport. All three are accepted here.
  4. Venue - the token lists the requested VenueID under VenueAdministrator or LeasingAgent. This branch is only reachable when VenueID is supplied: with no VenueID the membership test is made against an undefined value and can never match, so a venue-scoped caller must always send VenueID.
  5. Anything else is rejected 401 'Access Denied. '. There is no anonymous fallthrough.

The access token may instead be supplied as an Authorization: Bearer <jwt> header. The header is applied last and overwrites a token supplied any other way; a header with no space after 'Bearer' yields nothing and the call is rejected as if no token had been sent.

GET and POST are served by the same function and the same code. The only difference is that on a GET the query-string parameters are merged over the request body, so the query string carries exactly the field names a POST body would; a GET response additionally carries a Cache-Control: private, max-age=5 header.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
string

Cognito access-token JWT, merged into the request body from the query string. Not marked required at the parameter level because it may instead arrive in the Authorization header - but one of the two must be present or the call is rejected 401.

IdToken
string

Cognito id token. When present it is verified instead of the access token and the caller's username is taken from it.

OperatorID
string

Target operator. Read ONLY on the NetworkSoftwareProvider branch, where it is mandatory and is removed from the request once adopted. Ignored for NetworkOperator and Venue callers, whose operator comes from the request Origin. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

VenueID
string

When present, the venue-scoped cache entry is read instead of the operator-wide one and myKeyPoolList comes back as an ARRAY. It is also the value matched by the venue-role check, so a VenueAdministrator or LeasingAgent must supply it. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Responses

Response samples

Content type
application/json
{
  • "myKeyPoolCount": 0,
  • "myKeyPoolList": {
    },
  • "message": "",
  • "errorProcessing": false
}

/networkoperatorconsole/keypools/addKeypool

Creates a keypool (the SSID container a venue's PSKs are issued from) under one operator, then immediately runs the keypool-configure step against it so any keypool-configuration field sent in the same body is applied.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator. AccountManager/CustomerSupport/venue roles are not accepted.

Scope is always local — Scope: 'global' is accepted but has no effect; global keypools can't be created here. RuckusR1ControllerID/RuckusR1DPSKPoolName are also accepted but ignored on this route.

KeyPoolID is derived, never supplied.

On success: the keypool is created, linked to VenueID if supplied, and immediately configured with the same body — its message is appended to the response, but its own errors are NOT propagated (so a rejected configure field arrives as extra text on an otherwise-successful 200). Note deleteKeyPoolPermanently: true is honored there — sending it creates the keypool and immediately deletes it again.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
string

Cognito access-token JWT. May instead be supplied as Authorization: Bearer <JWT>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '.

OperatorID
string

REQUIRED only when the caller is a Network Software Provider; it names the operator to create the keypool under and is then deleted from the forwarded body. Absent for that caller gives 401 'OperatorID Missing. '. Ignored for a DomainAdministrator caller, whose operator comes from the request Origin. The value is the operator identifier built as Country, State, PostalCode_ID, OperatorName_ID and City_ID joined with dots.

SSID
required
string

The wireless network name for the new keypool.

Required: absent or empty gives 401, first from the endpoint's own literal 'SSID Missing. ' - the service's localised 'SSID missing from request.' is therefore not reachable through this route. The value is trimmed and truncated to 32 characters before validation; shorter than 2 gives 401 'SSID cannot be less than 2 characters.' and a value that does not satisfy the WiFi naming rules gives 401 'SSID does not conform to standards.'. The rules reject a leading !, #, ;, +, ], /, " or tab, any +, ], /, " or tab anywhere, and a trailing space, +, ], /, " or tab.

VenueID
string

Optional. When present the venue must exist and belong to the caller's operator, otherwise 401 'Venue not found.'; and no keypool already attached to that venue may carry the same SSID, otherwise 401 'SSID is already available at venue ' followed by the VenueID and '. '. On success the new keypool is attached to this venue. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

AuthenticationMechanism
string

Only the exact string 'PEAP MSCHAPv2' is honoured; it stores 'PEAP MSCHAPv2' as the mechanism. Any other value, including 'WPA3', leaves the stored mechanism at 'WPA2 PSK'.

Scope
string

Accepted and effectively ignored on this route: the created keypool always gets a randomly generated 8-character lowercase scope. In particular 'global' does not produce a global keypool.

RuckusR1ControllerID
string

Accepted and ignored on this route. The branch that consumes it also requires the call to have arrived on one of the Ruckus R1 controller endpoints, so on this path the keypool is stored with a null controller id.

RuckusR1DPSKPoolName
string

Accepted and ignored on this route, for the same reason as RuckusR1ControllerID; the keypool is stored with a null DPSK pool name.

DisplayOrder
integer

Forwarded to the keypool-configure step, which applies it to the new keypool. It is applied only when it parses to an integer that differs from the DisplayOrder of 50 the keypool was just created with, and only when it is at least 1 and strictly less than 100 - otherwise the text 'DisplayOrder should be between 1-100.' is appended to the message (note that 100 itself is refused despite that wording). A value that is present but does not parse as an integer is replaced by 50, i.e. no change.

connectVenueID
string

Forwarded to the keypool-configure step: attaches the newly created keypool to this additional venue. A venue already carrying the keypool yields the appended text 'Venue is already connected to keypool. '; a venue that cannot be resolved for this operator yields 'Venue to connect not found. '.

disconnectVenueID
string

Forwarded to the keypool-configure step: detaches the newly created keypool from this venue. Appended text is 'Venue is already disconnected from keypool. ' or 'Venue to disconnect not found. ' when it does not apply.

deleteKeyPoolPermanently
boolean

Forwarded to the keypool-configure step, which honours the strict boolean true by DELETING the keypool that this call has just created. There is no route guard preventing that combination.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "SSID": "GuestWiFi",
  • "VenueID": "string",
  • "AuthenticationMechanism": "PEAP MSCHAPv2",
  • "Scope": "string",
  • "RuckusR1ControllerID": "string",
  • "RuckusR1DPSKPoolName": "string",
  • "DisplayOrder": 10,
  • "connectVenueID": "string",
  • "disconnectVenueID": "string",
  • "deleteKeyPoolPermanently": false
}

Response samples

Content type
application/json
{
  • "message": "Keypool added: <OperatorID>._V3SSID.GuestWiFi.a8f3d2e1. Updating DisplayOrder to 10. ",
  • "KeyPoolID": "string",
  • "SSID": "GuestWiFi",
  • "errorProcessing": false
}

/networkoperatorconsole/keypools/configureKeypool

Configures one keypool (SSID): connect a venue, disconnect a venue, change its display order, or delete it permanently. The whole response is the service's return value.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator. AccountManager/CustomerSupport/venue roles are not accepted.

deleteKeyPoolPermanently: true (strictly boolean) deletes the keypool and its cache entry — but does NOT remove it from any venue's KeyPoolID set, and does not touch existing PSKs/subscriptions.

One call can do multiple things, in fixed order: venue connect/disconnect, then DisplayOrder, then permanent delete. If connectVenueID is set, disconnectVenueID is silently ignored. Connecting requires the venue to exist and belong to the same operator; for a WPA3 keypool bound to a Ruckus R1 controller, connecting is refused if the venue is already attached to a DIFFERENT controller. Disconnecting queues a DPSK sweep before unlinking (existing subscribers keep working until the sweep drains).

Rejections don't all use an error status: venue-level refusals (not found, already connected/disconnected, R1 controller conflict) return 200 with errorProcessing: true. Conversely, an out-of-range DisplayOrder returns 401 while errorProcessing stays false — and does NOT stop the rest of the call (the venue operation and delete in the same request still run). Always check errorProcessing, not the HTTP status.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

AccessToken and KeyPoolID are required. OperatorID is required for a NetworkSoftwareProvider caller only. Every other field selects one of the operations; a request that carries none of them is accepted and does nothing, returning 200 with an empty message.

AccessToken
required
string

Cognito access-token JWT. May also be sent as Authorization: Bearer <jwt>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. The token is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token. When present it is verified instead of the access token and the caller's username is taken from it.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It becomes the target operator and is then DELETED from the forwarded request. Ignored for a DomainAdministrator caller, whose operator comes from the request Origin. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

KeyPoolID
required
string

The keypool to configure. Mandatory: absent, empty, unknown, or owned by another operator is rejected 401 with 'Invalid keypool' plus a space plus the value as sent. Format is {OperatorID}._V3SSID.{SSID}.{scope}, where scope is 'global' or a generated local-scope token.

connectVenueID
string

Connect this venue to the keypool. The venue must exist and belong to the same operator ('Venue to connect not found. ' otherwise) and must not already be connected ('Venue is already connected to keypool. '). Both of those come back as HTTP 200 with errorProcessing true. Takes precedence over disconnectVenueID, which is then ignored entirely. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

disconnectVenueID
string

Disconnect this venue from the keypool. The venue must exist and belong to the same operator ('Venue to disconnect not found. ') and must currently be connected ('Venue is already disconnected from keypool. '); both come back as HTTP 200 with errorProcessing true. Examined ONLY when connectVenueID is empty or absent. Same format as connectVenueID.

integer or string

Sort position for the operator console. The value is run through an integer parse: a value that parses to an integer is used as that integer (so '7' and '7abc' both mean 7), and any OTHER truthy value - a non-numeric string, true, an object - is silently REWRITTEN TO 50 and stored as 50. An empty string, null, false and 0-as-a-string-that-parses are handled by the parse rule instead. The accepted range is 1 to 99 inclusive: 0 and anything from 100 up are refused with 'DisplayOrder should be between 1-100.' at HTTP 401 while errorProcessing stays false and the rest of the call proceeds. The write happens only when the effective value differs from the stored one, or the keypool has none.

deleteKeyPoolPermanently
boolean

Strictly the boolean true; any other value, including the string "true", is ignored. Deletes the keypool record and invalidates its cached key pool. It is evaluated only if nothing earlier in the same call failed.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "KeyPoolID": "OPERATORID._V3SSID.GuestWiFi.global",
  • "connectVenueID": "string",
  • "disconnectVenueID": "string",
  • "DisplayOrder": 50,
  • "deleteKeyPoolPermanently": true
}

Response samples

Content type
application/json
{
  • "message": "Connected keypool to venue <VenueID>. ",
  • "errorProcessing": false
}

/networkoperatorconsole/admin/deleteKeypoolPermanently

Permanently deletes one keypool (SSID). Served by the same function as configureKeypool, with the delete flag forced on — anything that operation supports is still reachable here.

Who may call it: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator. AccountManager/CustomerSupport/venue roles are not accepted.

What the delete does NOT do: it does not remove the keypool id from any venue's KeyPoolID set, and does not re-home or delete the PSKs/subscriptions that referenced it — nothing blocks deleting a keypool that's still attached to a venue.

connectVenueID/disconnectVenueID/DisplayOrder are still processed first, in that order, exactly as on configureKeypool. Sending only AccessToken and KeyPoolID performs a clean delete.

Rejections don't all use an error status: a venue-level refusal returns 200 with errorProcessing: true and skips the delete. An out-of-range DisplayOrder returns 401 while errorProcessing stays false — and does NOT stop the delete from happening.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required

AccessToken and KeyPoolID are required. OperatorID is required for a NetworkSoftwareProvider caller only. The remaining fields are inherited from the shared configure path and are still processed, before the delete.

AccessToken
required
string

Cognito access-token JWT. May also be sent as Authorization: Bearer <jwt>, which OVERWRITES this property. Absent from both gives 401 'AccessToken Missing. '. The token is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token. When present it is verified instead of the access token and the caller's username is taken from it.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It becomes the target operator and is then DELETED from the forwarded request. Ignored for a DomainAdministrator caller, whose operator comes from the request Origin. Format is {Country}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

KeyPoolID
required
string

The keypool to delete. Mandatory: absent, empty, unknown, or owned by another operator is rejected 401 with 'Invalid keypool' plus a space plus the value as sent. Format is {OperatorID}._V3SSID.{SSID}.{scope}, where scope is 'global' or a generated local-scope token.

connectVenueID
string

Connect this venue to the keypool. The venue must exist and belong to the same operator ('Venue to connect not found. ' otherwise) and must not already be connected ('Venue is already connected to keypool. '). Both of those come back as HTTP 200 with errorProcessing true. Takes precedence over disconnectVenueID, which is then ignored entirely. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

disconnectVenueID
string

Disconnect this venue from the keypool. The venue must exist and belong to the same operator ('Venue to disconnect not found. ') and must currently be connected ('Venue is already disconnected from keypool. '); both come back as HTTP 200 with errorProcessing true. Examined ONLY when connectVenueID is empty or absent. Same format as connectVenueID.

integer or string

Sort position for the operator console. The value is run through an integer parse: a value that parses to an integer is used as that integer (so '7' and '7abc' both mean 7), and any OTHER truthy value - a non-numeric string, true, an object - is silently REWRITTEN TO 50 and stored as 50. An empty string, null, false and 0-as-a-string-that-parses are handled by the parse rule instead. The accepted range is 1 to 99 inclusive: 0 and anything from 100 up are refused with 'DisplayOrder should be between 1-100.' at HTTP 401 while errorProcessing stays false and the rest of the call proceeds. The write happens only when the effective value differs from the stored one, or the keypool has none.

deleteKeyPoolPermanently
boolean

Not required on this path and not read from the request: reaching this resource sets it to true regardless of what the body contains. Sending false does NOT prevent the delete.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "KeyPoolID": "OPERATORID._V3SSID.GuestWiFi.global",
  • "connectVenueID": "string",
  • "disconnectVenueID": "string",
  • "DisplayOrder": 50,
  • "deleteKeyPoolPermanently": true
}

Response samples

Content type
application/json
{
  • "message": "Connected keypool to venue <VenueID>. ",
  • "errorProcessing": false
}

Support & Ticketing

🎫 Integrated Support & Customer Service

Comprehensive support ticket system with ConnectWise PSA integration for venue management and subscriber assistance.

Support Workflow

  • 📋 Ticket Management: Create, assign, track, and resolve support requests
  • 🔄 Multi-Channel Integration: Email, SMS, and console-based communication
  • 📊 Performance Analytics: Response times, resolution rates, satisfaction tracking
  • 🎯 Priority Management: Critical, High, Medium, Low priority classification
  • 🏢 Venue-Specific Routing: Automatic assignment based on venue and category

ConnectWise PSA Integration

  • 🔗 Real-time Sync: Direct integration with ConnectWise Professional Services Automation
  • 🏢 Company Mapping: VAULT property ID to ConnectWise company ID resolution
  • 📋 Advanced Filtering: Multi-property queries with date ranges and status filters
  • 👤 Contact Management: Automatic contact resolution and communication tracking
  • 📈 Reporting: Comprehensive support metrics and performance analytics

/networkoperatorconsole/support/getTickets

Reads support tickets from the operator's ConnectWise PSA instance. ConnectWise credentials are held per venue; each mode requires exactly one qualifying venue, but computed over a different candidate set.

Two modes: TicketID fetches a single ConnectWise ticket (falls through to VAULTID mode if the caller's venues don't resolve to exactly one). VAULTID (an array of Vault VenueIDs) resolves the named venues to ConnectWise companies and searches tickets across them.

⚠ Response shape defect: a successful response is a two-element JSON ARRAY, not an object — element 0 is the endpoint's internal request-context object (which carries the operator's Stripe/Cognito secrets), element 1 is the tickets. message/errorProcessing never appear on success because JSON.stringify drops non-index array properties.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
AccessToken
required
string

Cognito JWT access token of the calling console user. Required in the body - this endpoint does not read an Authorization header.

TicketID
string

ConnectWise ticket identifier, concatenated straight into the path 'service/tickets/'. Any truthy value enters this mode. If the operator does not have exactly one ConnectWise-configured venue the mode is abandoned and the request falls through to the VAULTID branch. Format is whatever ConnectWise issues - it is not validated or normalised here.

VAULTID
Array of strings

VAULT VenueIDs to search tickets for.

Must be a JSON array: it is iterated by integer index. Each id is fetched individually and kept only if it belongs to the caller's operator, carries all four ConnectWise attributes and has a falsy GlobalPool; exactly one venue must qualify or nothing is queried. The ids are turned into a ConnectWise company/configurations filter type/name='VAULT-UI' and name=''.

VenueID format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID} (example).

showClosed
boolean
Default: false

Controls the closed-ticket exclusion. The clause " and closedflag=false and status/name not contains 'Resolved'" is appended UNLESS showClosed is truthy AND loosely equal to true (loose ==). Absent, false, 0, '' and null all keep the exclusion; note that a truthy-but-not-==true value such as 'yes' also keeps it.

emailAddress
Array of strings

Contact e-mail addresses to restrict the ticket search to; appended as "contactEmailAddress=''" clauses OR-ed together. Iterated by integer index, so it must be a JSON array. Applied only in VAULTID mode and only when the company/configurations lookup returned at least one row.

StartDateTimeUTC.ISO8601
string
Deprecated

IGNORED. unconditionally OVERWRITES this property with '[' + (request time minus 90 days).toISOString + ']' before it is read, so a caller-supplied value has no effect. The 90-day lookback is fixed.

EndDateTimeUTC.ISO8601
string
Deprecated

IGNORED. unconditionally OVERWRITES this property with '[' + (request time plus 1 day).toISOString + ']' before it is read. The window end is fixed at tomorrow.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito JWT access token>",
  • "VAULTID": [
    ],
  • "showClosed": false
}

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

/subscriberconsole/getTickets

Returns ConnectWise PSA support tickets for the venues where the calling subscriber currently has an active subscription. Scope is always the caller's own active subscriptions — no role, VenueID or subscriber identifier from the request is used for scoping.

Exactly one qualifying venue is required — a venue with a complete ConnectWise configuration, belonging to the same operator, not a global-pool venue. Zero or multiple qualifying venues return an empty result with 200, no ConnectWise call made.

The search window and contact address are NOT caller-controlled — always "now-90d to now+1d" and the caller's own account email.

⚠ This operation returns a JSON ARRAY, not an object. Index 0 is internal (not part of the contract), index 1 is the ticket payload — a two-element array on success, one element (with no message/errorProcessing at all) on a ticket-logic rejection. Pre-ticket-logic rejections (bad token, malformed body) return a normal object instead.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
AccessToken
required
string

Cognito access token of the calling subscriber, in the request BODY (this operation does not read an Authorization header). The user pool is resolved from the request Origin, so the token must have been issued by that operator's pool. A missing token is refused with 401 whenever the operator has a Cognito pool configured.

TicketID
string

Optional ConnectWise ticket id.

Switches to single-ticket mode: the ticket is fetched directly and no search is run. It is appended to the ConnectWise request path verbatim and is NOT checked against the caller's own tickets - the ticket record is returned whoever raised it, as long as it lives in the one qualifying venue's ConnectWise instance. Only the ticket's notes are gated, and only on the ticket's contact email matching the caller's account email.

showClosed
boolean

Optional, search mode only. Compared with a loose equality against true, so the boolean true qualifies (as would the number 1 or the string "1"); the string "true" does NOT. When it does not qualify - including when it is omitted, false, or 0 - the search is narrowed to tickets that are not closed and whose status does not contain 'Resolved'.

property name*
additional property
any

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<cognito access token>",
  • "showClosed": false
}

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

/subscriberconsole/addTicket

Raises a support ticket on the ConnectWise PSA instance configured for the caller's venue, and attaches the issue text as a note.

Always scoped to the caller's own subscription — matched by the authenticated account's email against active, set-up, non-ended subscriptions at the given VenueID. contactEmailAddress/EmailAddress only set the ticket's contact info, never used to find the subscription. Exactly one matching subscription must exist.

VenueID is required — VAULTID is accepted as an alias but only VenueID is actually used for the lookup, so sending VAULTID alone will not find a subscription.

Silent no-op: if the venue lacks a complete ConnectWise configuration, or any ConnectWise call fails, no ticket is created and the call still succeeds with an empty result.

⚠ This operation returns a JSON ARRAY, not an object. On success: index 0 is an internal object not part of the contract, index 1 is the created ticket (or {} if none was created). A validation rejection returns a ONE-element array with no message/errorProcessing at all — branch on the HTTP status code, not the body, for those. Earlier rejections (bad token, malformed body) return a normal object instead.

Authorizations:
CognitoUserPool
header Parameters
Origin
required
string

Must be the console origin of the operator the subscriber belongs to. Absent, or not resolvable to exactly one known operator domain, is refused with 401 'Forbidden. '.

Partner-Integration-Channel
string

Marks the call as machine-to-machine API access. It does not change any check this operation performs.

Request Body schema: application/json
required
AccessToken
required
string

Cognito access token for the signed-in subscriber. Required; the request is refused without it whenever the operator has console sign-on configured.

contactName
required
string

Required. Recorded as the ticket contact and as the author of the note. Refused if absent or empty, and refused if it contains anything that looks like an HTML tag or an HTML entity. Otherwise trimmed and truncated to 40 characters.

contactEmailAddress
string <email>

Contact e-mail recorded on the ticket. Either this or EmailAddress must be present; when both are, this one wins and replaces EmailAddress. Must be a valid e-mail address. Not used to select the subscription.

EmailAddress
string <email>

Alternative to contactEmailAddress, used only when that field is absent. Must be a valid e-mail address. Lower-cased before use. Not used to select the subscription - the subscription is always found through the authenticated account.

summary
required
string

Required. One-line ticket subject. HTML-escaped, then trimmed and truncated to 100 characters. Also used as the note text when Description is absent.

VenueID
string

The venue the subscription is. Required in practice: it is the only field the subscription lookup reads. Format: {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

VAULTID
string

The venue key used to read the venue's ConnectWise configuration and to select its VAULT-UI company configurations. Defaults to VenueID when omitted. Supplying VAULTID without VenueID satisfies the presence check but leaves the subscription lookup with nothing to query, so the request is then always refused.

unitID
string

Optional. When present the subscription must be the one for exactly this unit, and the same value is used as the ConnectWise UNIT configuration id whose name is recorded on the ticket. When absent, the subscriber must have exactly one qualifying unit at the venue.

VAULTUnitID
string

Optional, used only when unitID is absent. Matched case-insensitively against the answers of the ConnectWise UNIT configurations' questions whose text contains 'VAULT'; a match records that configuration's name and site on the ticket. No effect on which subscription is selected.

CustomUnit
string

Optional free-text unit label. Used only on the unitID branch, and only when ConnectWise returns no UNIT configuration for that id.

Description
string

Optional. The body of the note attached to the ticket. Falls back to summary when absent. Not escaped or truncated.

PrefContactMethod
string

Optional. When present it is placed on its own line above the note text.

TicketType
string

Optional ConnectWise ticket type name.

TicketSubType
string

Optional ConnectWise ticket sub-type name. Only applied when TicketType is also supplied.

contactPhoneNumber
string

Optional. Recorded on the ticket as the contact phone number, verbatim.

serviceboardid
string

Optional ConnectWise service board id. Consulted only when the venue's own configured board id is present but is not a positive number. The string 'undefined' is ignored.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "<Cognito access token>",
  • "contactName": "<contact name>",
  • "contactEmailAddress": "subscriber@example.com",
  • "summary": "<short description of the issue>",
  • "VenueID": "<pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>",
  • "Description": "<full description of the issue>"
}

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

Staff

👷 Staff Management & Access Control

Staff member management system for venue administrators, support personnel, and operational staff with role-based access control.

Staff Administration

  • 👤 User Management: Create, modify, and deactivate staff accounts
  • 🔒 Role Assignment: Granular permissions and access control management
  • 🏢 Venue Assignment: Multi-venue staff access and responsibility management
  • 📋 Activity Tracking: Staff actions, login history, and audit trails
  • 🎯 Performance Monitoring: Staff productivity and service quality metrics
  • 📚 Training Management: Certification tracking and training requirements

Access Control

  • 🔐 Permission Matrix: Fine-grained access control for different staff roles
  • 📊 Security Monitoring: Access pattern analysis and security event tracking
  • 🔄 Session Management: Staff session control and security policies
  • 📋 Compliance Tracking: Staff certification and regulatory compliance

/networkoperatorconsole/venues/enableStaffAccess

Grant one staff member one administrative role, either operator-wide or at a single venue. The /venues/ and /staff/ paths behave identically — the Role value decides scope, not the path.

A staff member may hold exactly ONE role (across venues too) — a conflicting existing role is 409. SIEMAdministrators is exempt (a notification list, not a role).

Who may grant what:

  • NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator: any role.
  • AccountManager/CustomerSupport: venue roles only (an AccountManager may also grant CustomerSupport).
  • VenueAdministrator of the named venue: LeasingAgent only.
  • Everyone else is refused.

The access token must be in the body — no Authorization header support. If the staff member has no account yet, one is created and a temporary password emailed.

Authorizations:
CognitoAuth
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first) and supplies the operator the grant is written against, the Cognito pool used to verify the token, and any source-IP whitelist. An origin resolving to no operator gives 401 'Operator not found. '. Omitting the header does NOT give the usual 'origin missing. ' text on this endpoint - see the 401 description.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. On this endpoint it affects only the 'AccessToken Missing. ' rejection; every other message here is a hardcoded English literal.

Request Body schema: application/json
required

JSON body.

Any of
AccessToken
required
string

Cognito access-token JWT. MUST be in the body - this endpoint never reads the Authorization header. Absent gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it is deleted from the body once consumed. Ignored for every other caller.

EmailAddress
required
string <email>

Identifies the staff member. ANY ONE of EmailAddress / SubscriberToken / PhoneNumber / 'PhoneNumber.E164' satisfies the presence check; when EmailAddress IS supplied it must pass e-mail validation and is then trimmed and lower-cased. A grant ultimately REQUIRES an email: a person resolved without one is refused.

SubscriberToken
string

Identifies an existing staff member.

PhoneNumber
string

Identifies the staff member; copied to the 'PhoneNumber.E164' key the resolver actually reads when that key is absent.

PhoneNumber.E164
string

E.164 form, read directly by the subscriber resolver.

Role
required
string

Role to grant. Matching is CASE-INSENSITIVE - every comparison lower-cases the trimmed value.

Operator-level values: domainadministrator, siemadministrator, accountmanager, customersupport.

Venue-level values (these require VenueID): venueadministrator, leasingagent. No enum is declared because the accepted set is not a fixed list of literals - any casing of the names above is valid. Missing gives 401 'Role Missing. '; unrecognised gives 401 'Invalid Role. ' from a NetworkSoftwareProvider or DomainAdministrator caller, and 401 'Access Denied. ' from an AccountManager, CustomerSupport or VenueAdministrator caller, whose branch accepts venue-level roles only.

VenueID
string

Required when Role is venueadministrator or leasingagent (401 'VenueID missing from request. ' otherwise). Deleted and ignored when an operator-level role is granted. The venue must belong to the caller's operator and must not be a GlobalPool (roaming) venue, else 403. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

GivenName
string

Used when the staff member has no account yet. Disallowed characters are stripped and the stripped value is what is stored - an altered name is NOT refused. Only a value that the stripping empties completely is refused.

FamilyName
string

Used when the staff member has no account yet; same rule.

locale
string

Notification locale for a newly created account. 'en-us' and 'es-xl' are the recognised values; any other value is silently coerced to 'en-us' rather than refused, and 'en-us' is also used when the field is omitted.

Domain
string

Legacy field; it is NOT used to select the operator. Sending a non-empty Domain adds three requirements to an operator-level grant: EmailAddress, GivenName and FamilyName all become mandatory, and their absence is refused 401 'Invalid EmailAddress. ', 'GivenName Missing. ' or 'FamilyName Missing. ' respectively. Omit it unless you intend those extra requirements.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "SubscriberToken": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "Role": "leasingagent",
  • "VenueID": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "string",
  • "Domain": "string"
}

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "Username": "string",
  • "EmailAddress": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "string",
  • "PhoneNumber.E164": "string",
  • "phone_number_verified": true,
  • "email_verified": true,
  • "Status": "string",
  • "Enabled": true,
  • "externalSubscriberID": "string",
  • "SubscriberManagedviaSSO": true,
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/venues/disableStaffAccess

Revoke a staff member's administrative role(s). Nothing is deleted from Cognito — only the identifier is removed from the operator's or venue's role list(s); the staff member keeps their sign-in.

Which store runs depends on VenueID/Role: venue-scoped roles go through the venue store, operator-scoped through the operator store. Omitting both Role and VenueID sweeps every venue and every operator-level group.

Who may revoke what: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator may revoke any role. An AccountManager or CustomerSupport member is confined to venue roles (an AccountManager may also revoke CustomerSupport). A VenueAdministrator may revoke only LeasingAgent at their own venue. Everyone else is refused.

Despite the /venues/ path segment, VenueID is NOT required — omitting it revokes across every venue of the operator.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

JSON body. Four request-envelope failures - a missing Host header, a missing Origin header, a body that is not valid JSON, and an unexpected Host - do not report their own message on this route: each comes back 401 'Internal server error' - see the 401 description.

Any of
AccessToken
string

Cognito access-token JWT. May be sent in the body or as Authorization: Bearer <JWT>; the header value overwrites the body value. Absent from both gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool configured.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

OperatorID
string

Target operator. REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise) and deleted from the body once accepted. Ignored for every other caller - the operator is resolved from the request Origin. Built as {Country.ISO3166A3}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

EmailAddress
required
string <email>

Identifies the staff member. Lower-cased by the shared request sanitiser before use.

SubscriberToken
string

Identifies the staff member. This is the value actually stored in the role arrays.

PhoneNumber
string

Identifies the staff member. Copied to 'PhoneNumber.E164' when that key is absent, because the subscriber resolver reads the dotted key.

PhoneNumber.E164
string

Identifies the staff member, in E.164 form.

externalSubscriberID
string

Read by the subscriber resolver, but NOT accepted on its own: the identifier gate in both stores does not list it, so a request carrying only this is rejected 400.

Role
string

OPTIONAL.

Operator-scoped values: DomainAdministrator, SIEMAdministrator, AccountManager, CustomerSupport (the stored plurals DomainAdministrators, SIEMAdministrators and AccountManagers are accepted too, but ONLY in exactly that spelling - they are matched case-sensitively and with no trimming, so 'accountmanagers' or ' AccountManagers ' is rejected 400 'Invalid Role. ').

Venue-scoped values: VenueAdministrator, LeasingAgent (or VenueAdministrators, LeasingAgents). Matching of the singular values, and of the two venue plurals, is case-insensitive and surrounding whitespace is trimmed. Omit it to revoke EVERY group in scope - but a caller who is only a VenueAdministrator may not do that: for that caller both an omitted Role and Role='VenueAdministrator' are refused 401 'Access Denied. ', since LeasingAgent is the only role they may revoke. A value that is not one of the target store's groups is rejected 400 'Invalid Role. ' - the venue store rejects an operator-level Role and vice versa.

VenueID
string

OPTIONAL. Scopes a venue-role revoke to one venue; omit it to revoke that role at EVERY venue of the operator. It is NOT required on this path even though the path is namespaced under /venues - the endpoint does not look at which of the two mounted paths was called. The endpoint drops it when the Role is operator-level. A VenueAdministrator caller MUST supply it - it is what authorises them. Ownership is asserted by the venue store, which answers 403 'Invalid VenueID. ' when the venue does not exist or belongs to another operator. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "SubscriberToken": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "Role": "string",
  • "VenueID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Operation complete. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/staff/disableStaffAccess

Revoke a staff member's administrative role(s). Nothing is deleted from Cognito — only the identifier is removed from the operator's or venue's role list(s); the staff member keeps their sign-in.

Which store runs depends on VenueID/Role: venue-scoped roles go through the venue store, operator-scoped through the operator store. Omitting both Role and VenueID sweeps every venue and every operator-level group.

Who may revoke what: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator may revoke any role. An AccountManager or CustomerSupport member is confined to venue roles (an AccountManager may also revoke CustomerSupport). A VenueAdministrator may revoke only LeasingAgent at their own venue. Everyone else is refused.

The same operation is also exposed at /venues/disableStaffAccess.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

JSON body. Four request-envelope failures - a missing Host header, a missing Origin header, a body that is not valid JSON, and an unexpected Host - do not report their own message on this route: each comes back 401 'Internal server error' - see the 401 description.

Any of
AccessToken
string

Cognito access-token JWT. May be sent in the body or as Authorization: Bearer <JWT>; the header value overwrites the body value. Absent from both gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool configured.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token, and checked against the global sign-out marker.

OperatorID
string

Target operator. REQUIRED for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise) and deleted from the body once accepted. Ignored for every other caller - the operator is resolved from the request Origin. Built as {Country.ISO3166A3}.{State}.{PostalCode_ID}.{OperatorName_ID}.{City_ID}.

EmailAddress
required
string <email>

Identifies the staff member. Lower-cased by the shared request sanitiser before use.

SubscriberToken
string

Identifies the staff member. This is the value actually stored in the role arrays.

PhoneNumber
string

Identifies the staff member. Copied to 'PhoneNumber.E164' when that key is absent, because the subscriber resolver reads the dotted key.

PhoneNumber.E164
string

Identifies the staff member, in E.164 form.

externalSubscriberID
string

Read by the subscriber resolver, but NOT accepted on its own: the identifier gate in both stores does not list it, so a request carrying only this is rejected 400.

Role
string

OPTIONAL.

Operator-scoped values: DomainAdministrator, SIEMAdministrator, AccountManager, CustomerSupport (the stored plurals DomainAdministrators, SIEMAdministrators and AccountManagers are accepted too, but ONLY in exactly that spelling - they are matched case-sensitively and with no trimming, so 'accountmanagers' or ' AccountManagers ' is rejected 400 'Invalid Role. ').

Venue-scoped values: VenueAdministrator, LeasingAgent (or VenueAdministrators, LeasingAgents). Matching of the singular values, and of the two venue plurals, is case-insensitive and surrounding whitespace is trimmed. Omit it to revoke EVERY group in scope - but a caller who is only a VenueAdministrator may not do that: for that caller both an omitted Role and Role='VenueAdministrator' are refused 401 'Access Denied. ', since LeasingAgent is the only role they may revoke. A value that is not one of the target store's groups is rejected 400 'Invalid Role. ' - the venue store rejects an operator-level Role and vice versa.

VenueID
string

OPTIONAL. Scopes a venue-role revoke to one venue; omit it to revoke that role at EVERY venue of the operator. The endpoint drops it when the Role is operator-level. A VenueAdministrator caller MUST supply it - it is what authorises them. Ownership is asserted by the venue store, which answers 403 'Invalid VenueID. ' when the venue does not exist or belongs to another operator. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "SubscriberToken": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "Role": "string",
  • "VenueID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Operation complete. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/networkoperatorconsole/staff/enableStaffAccess

Grant one staff member one administrative role, either operator-wide or at a single venue. The /venues/ and /staff/ paths behave identically — the Role value decides scope, not the path.

A staff member may hold exactly ONE role (across venues too) — a conflicting existing role is 409. SIEMAdministrators is exempt (a notification list, not a role).

Who may grant what:

  • NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator: any role.
  • AccountManager/CustomerSupport: venue roles only (an AccountManager may also grant CustomerSupport).
  • VenueAdministrator of the named venue: LeasingAgent only.
  • Everyone else is refused.

The access token must be in the body — no Authorization header support. If the staff member has no account yet, one is created and a temporary password emailed.

Authorizations:
CognitoAuth
header Parameters
Origin
required
string

Required. The console origin, e.g. https://. The operator record is looked up from it (a '-preview' infix is stripped first) and supplies the operator the grant is written against, the Cognito pool used to verify the token, and any source-IP whitelist. An origin resolving to no operator gives 401 'Operator not found. '. Omitting the header does NOT give the usual 'origin missing. ' text on this endpoint - see the 401 description.

Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish (Latin America) catalogue, anything else US English. On this endpoint it affects only the 'AccessToken Missing. ' rejection; every other message here is a hardcoded English literal.

Request Body schema: application/json
required

JSON body.

Any of
AccessToken
required
string

Cognito access-token JWT. MUST be in the body - this endpoint never reads the Authorization header. Absent gives 401 'AccessToken Missing. '. It is only verified when the resolved operator has a Cognito pool.

IdToken
string

Cognito id token; read by the shared token verifier alongside the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it is deleted from the body once consumed. Ignored for every other caller.

EmailAddress
required
string <email>

Identifies the staff member. ANY ONE of EmailAddress / SubscriberToken / PhoneNumber / 'PhoneNumber.E164' satisfies the presence check; when EmailAddress IS supplied it must pass e-mail validation and is then trimmed and lower-cased. A grant ultimately REQUIRES an email: a person resolved without one is refused.

SubscriberToken
string

Identifies an existing staff member.

PhoneNumber
string

Identifies the staff member; copied to the 'PhoneNumber.E164' key the resolver actually reads when that key is absent.

PhoneNumber.E164
string

E.164 form, read directly by the subscriber resolver.

Role
required
string

Role to grant. Matching is CASE-INSENSITIVE - every comparison lower-cases the trimmed value.

Operator-level values: domainadministrator, siemadministrator, accountmanager, customersupport.

Venue-level values (these require VenueID): venueadministrator, leasingagent. No enum is declared because the accepted set is not a fixed list of literals - any casing of the names above is valid. Missing gives 401 'Role Missing. '; unrecognised gives 401 'Invalid Role. ' from a NetworkSoftwareProvider or DomainAdministrator caller, and 401 'Access Denied. ' from an AccountManager, CustomerSupport or VenueAdministrator caller, whose branch accepts venue-level roles only.

VenueID
string

Required when Role is venueadministrator or leasingagent (401 'VenueID missing from request. ' otherwise). Deleted and ignored when an operator-level role is granted. The venue must belong to the caller's operator and must not be a GlobalPool (roaming) venue, else 403. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

GivenName
string

Used when the staff member has no account yet. Disallowed characters are stripped and the stripped value is what is stored - an altered name is NOT refused. Only a value that the stripping empties completely is refused.

FamilyName
string

Used when the staff member has no account yet; same rule.

locale
string

Notification locale for a newly created account. 'en-us' and 'es-xl' are the recognised values; any other value is silently coerced to 'en-us' rather than refused, and 'en-us' is also used when the field is omitted.

Domain
string

Legacy field; it is NOT used to select the operator. Sending a non-empty Domain adds three requirements to an operator-level grant: EmailAddress, GivenName and FamilyName all become mandatory, and their absence is refused 401 'Invalid EmailAddress. ', 'GivenName Missing. ' or 'FamilyName Missing. ' respectively. Omit it unless you intend those extra requirements.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "subscriber@example.com",
  • "SubscriberToken": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "Role": "leasingagent",
  • "VenueID": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "string",
  • "Domain": "string"
}

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "Username": "string",
  • "EmailAddress": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "string",
  • "PhoneNumber.E164": "string",
  • "phone_number_verified": true,
  • "email_verified": true,
  • "Status": "string",
  • "Enabled": true,
  • "externalSubscriberID": "string",
  • "SubscriberManagedviaSSO": true,
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "errorProcessing": false
}

/operatorconsole/staff/disableStaffAccess

Revoke a staff member's administrative role(s). Nothing is deleted from Cognito — only the identifier is removed from the operator's or venue's role list(s); the staff member keeps their sign-in.

Which store runs depends on VenueID/Role: venue-scoped roles go through the venue store, operator-scoped through the operator store. Omitting both Role and VenueID sweeps every venue and every operator-level group.

Who may revoke what: a NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator may revoke any role. An AccountManager or CustomerSupport member is confined to venue roles (an AccountManager may also revoke CustomerSupport). A VenueAdministrator may revoke only LeasingAgent at their own venue. Everyone else is refused.

Authorizations:
CognitoAuth
Request Body schema: application/json
required
Any of
AccessToken
string

Cognito JWT. May be sent in the body or as Authorization: Bearer <token>; the header wins.

OperatorID
string

Target operator. REQUIRED for a NetworkSoftwareProvider caller and deleted from the body once accepted. Ignored otherwise - the operator comes from the request Origin.

EmailAddress
required
string <email>

Identifies the staff member. Lower-cased by request validation before use.

SubscriberToken
string

Identifies the staff member.

PhoneNumber
string

Identifies the staff member. Copied to PhoneNumber.E164 when that key is absent, because the resolver reads the dotted key.

PhoneNumber.E164
string

Identifies the staff member, in E.164 form.

externalSubscriberID
string

Read by token validation when resolving the staff member, but NOT accepted on its own - the objects' identifier gate does not list it, so a request carrying only this is rejected 400.

Role
string

OPTIONAL.

Operator-scoped: DomainAdministrator, SIEMAdministrator, AccountManager, CustomerSupport (or the stored plurals DomainAdministrators, SIEMAdministrators, AccountManagers, CustomerSupport).

Venue-scoped: VenueAdministrator, LeasingAgent (or VenueAdministrators, LeasingAgents). Case-insensitive. Omit to revoke EVERY group in scope. An unrecognised value is rejected 400 Invalid Role. .

VenueID
string

OPTIONAL. Scopes a venue-role revoke to one venue; omit it to revoke at EVERY venue of the operator. Format is the venue id <pmgId>._V3VENUE_.<Country>.<State>.<PostalCode_ID>.<VenueName_ID>.<City_ID>. Dropped by the endpoint when the Role is operator-level. A VenueAdministrator caller MUST supply it - it is what authorises them.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "user@example.com",
  • "SubscriberToken": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "externalSubscriberID": "string",
  • "Role": "string",
  • "VenueID": "string"
}

Response samples

Content type
application/json
{
  • "message": "Operation complete. ",
  • "errorProcessing": false,
  • "statusCode": 200
}

/operatorconsole/staff/enableStaffAccess

Grant one staff member one administrative role, either operator-wide or at a single venue. The /venues/ and /staff/ paths behave identically — the Role value decides scope, not the path.

A staff member may hold exactly ONE role (across venues too) — a conflicting existing role is 409. SIEMAdministrators is exempt (a notification list, not a role).

Who may grant what:

  • NetworkSoftwareProvider (must send OperatorID) or a DomainAdministrator: any role.
  • AccountManager/CustomerSupport: venue roles only (an AccountManager may also grant CustomerSupport).
  • VenueAdministrator of the named venue: LeasingAgent only.
  • Everyone else is refused.

The access token must be in the body — no Authorization header support. If the staff member has no account yet, one is created and a temporary password emailed.

Authorizations:
CognitoAuth
Request Body schema: application/json
required

JSON body. Note the endpoint's initial context object has no response member, so a request that fails request validation's Host/Origin/JSON gates throws inside that helper and is caught by the endpoint - see the 401 description.

Any of
AccessToken
required
string

Cognito access-token JWT. MUST be in the body - this endpoint never reads the Authorization header. Absent -> 401 'AccessToken Missing. '.

IdToken
string

Cognito id token; honoured by validateAccessToken when supplied alongside AccessToken.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 'OperatorID Missing. ' otherwise); it is deleted from the body once consumed. Ignored for every other caller.

EmailAddress
required
string <email>

Identifies the staff member. ANY ONE of EmailAddress / SubscriberToken / PhoneNumber / 'PhoneNumber.E164' satisfies the presence check; when EmailAddress IS supplied it must be an email address and is trimmed and lower-cased. A grant ultimately REQUIRES an email: if the resolved subscriber has none the request is refused.

SubscriberToken
string

Identifies an existing staff member. See the note about the operator-level path below - a SubscriberToken-identified grant of an OPERATOR role currently fails.

PhoneNumber
string

Identifies the staff member; copied to the 'PhoneNumber.E164' key the resolver actually reads when that key is absent.

PhoneNumber.E164
string

E.164 form read directly by the subscriber resolver.

Role
required
string

Role to grant.

Matching is CASE-INSENSITIVE: every comparison in the chain lower-cases the trimmed value.

Operator-level values: domainadministrator, siemadministrator, accountmanager, customersupport.

Venue-level values (these require VenueID): venueadministrator, leasingagent. No enum is declared because the accepted set is not a fixed list of literals - any casing of the names above is valid. Missing -> 401 'Role Missing. '; unrecognised -> 401 'Invalid Role. '.

VenueID
string

Required when Role is venueadministrator or leasingagent (401 'VenueID missing from request. ' otherwise). Deleted and ignored when an operator-level role is granted. The venue must belong to the caller's operator and must not be the GlobalPool venue, else 403. Format is {PropertyManagementGroupID}.V3VENUE.{Country.ISO3166A3}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

GivenName
string

Used when the staff member has no account yet; sanitised by sanitizeUtils.name, and a value the API empties is a 401 'GivenName validation failed'.

FamilyName
string

Used when the staff member has no account yet; same rule, 401 'FamilyName validation failed'.

locale
string
Enum: "en-us" "es-xl"

Notification locale for the new account; defaults to 'en-us'.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "EmailAddress": "user@example.com",
  • "SubscriberToken": "string",
  • "PhoneNumber": "string",
  • "PhoneNumber.E164": "string",
  • "Role": "leasingagent",
  • "VenueID": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "en-us"
}

Response samples

Content type
application/json
{
  • "SubscriberToken": "string",
  • "Username": "string",
  • "EmailAddress": "string",
  • "GivenName": "string",
  • "FamilyName": "string",
  • "locale": "string",
  • "Status": "string",
  • "externalSubscriberID": "string",
  • "contactpref_sms": true,
  • "contactpref_email": true,
  • "dateAddedUTC.ISO8601": "string",
  • "dateClosedUTC.ISO8601": "string",
  • "StripeCustomerID": "string",
  • "errorProcessing": false
}

Operator/Equipment

🔧 Network Equipment & Infrastructure

Network equipment management and monitoring for network operators to oversee infrastructure, performance, and maintenance operations.

Equipment Management

  • 🔧 Device Inventory: Complete equipment registry with specifications and status
  • 📊 Performance Monitoring: Real-time equipment health, utilization, and alerts
  • 🔄 Maintenance Scheduling: Preventive maintenance, updates, and lifecycle management
  • 📈 Capacity Planning: Usage analysis, growth projections, and upgrade planning
  • 🛡️ Security Management: Equipment security, firmware updates, and threat monitoring
  • 📋 Configuration Management: Device configurations, backup, and change tracking
  • ⚙️ System Settings: Display options, UI customization, and operator configurations

Operations & Monitoring

  • 📡 Network Topology: Infrastructure mapping and connectivity visualization
  • 🚨 Alert Management: Equipment failures, performance issues, and notification systems
  • 📊 Analytics Dashboard: Equipment performance metrics and trend analysis
  • 🔧 Remote Management: Remote configuration, troubleshooting, and maintenance
  • 🎨 Display Options: User interface appearance, branding, and visual settings

/venuemgmtconsole/venues/listVenueCPEStatus (GET)

Live up/down status for a venue's customer-premises equipment, assembled at request time from ConnectWise (site/unit structure) and PRTG (sensor status) — Vault stores none of this. A venue with no ConnectWise integration cannot be served.

The access token must be sent as the AccessToken parameter — no Authorization header support.

Who may call it: a NetworkSoftwareProvider (must send OperatorID), a NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or a Venue admin/leasing agent for the requested VenueID.

Only four equipment classes are reported as controllers, each with specific children: Wireless Controller → Access Point, CMTS → Cable Modem, OLT → ONT, G.hn Headend → G.hn Modem. Equipment behind a firewall, switch or router is never reported.

A ConnectWise or PRTG call that fails is silently swallowed — a partial outage shows up as missing equipment, not an error.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
required
string

Cognito JWT. Marked required because this operation, unlike its siblings, has NO Authorization-header path - the token is read from the merged request only, and its absence is 401 'AccessToken Missing. '. It is only cryptographically verified when the Origin-resolved operator has a Cognito pool configured.

IdToken
string

Optional Cognito ID token, read only by the shared token validation and only when the access token's username was not already cached; in that case the ID token is the one verified and the username comes from its preferred_username claim, falling back to an email-to-username cache lookup. A non-empty AccessToken is still required by the endpoint's own presence check.

OperatorID
string

Target operator. Read ONLY on the NetworkSoftwareProvider branch, where it is mandatory (401 'OperatorID Missing. ' otherwise) and is deleted from the request once copied into the operator context. Ignored for every other role, whose operator comes from the request Origin.

VenueID
required
string

The venue to report on, and the value matched by the Venue-role check. Its absence is reported with errorProcessing: true and the message 'VenueID missing from request. ' but the HTTP status stays 200 - see the 200 description. It is compared with loose equality against the VenueID of each venue in the caller's operator's cached venue list, and exactly one match must remain. Format is the composite Vault venue identifier {pmgId}.V3VENUE.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}; no example is shown because any realistic value names a real venue.

SummaryOnly
string

Suppresses the per-device list, leaving only the UP/DOWN counts.

TRUTHINESS TRAP: the endpoint only tests whether the value is truthy, and every query-string value is a STRING - so SummaryOnly=false and SummaryOnly=0 both suppress the device list just as SummaryOnly=true does. To get the devices, OMIT the parameter (or send it empty). It is typed as a string here for that reason. With no filter sent it does reduce the work done: the second ConnectWise query (the site/unit lookup over every company id) is skipped, while the PRTG calls run either way. Combining it with any of the three filters below re-enables the site lookup anyway.

UnitID
string

Restricts the report to the CPE mapped to ONE ConnectWise unit, compared with loose equality against the id of the site's UNIT-type configuration. Presence alone activates the filter (any non-empty value counts), and activating it also restricts the UP/DOWN counts to the matched equipment.

SiteID
string

Restricts the report to one ConnectWise site, compared with loose equality against the site id. The three filter tests are per-site else-ifs evaluated for every candidate site, not a request-level precedence: when UnitID is also supplied, a site whose UNIT id does not match falls through to this test, so a matching SiteID can still select that site. Activating it also restricts the UP/DOWN counts.

VAULTUnitID
string

Restricts the report to the site whose UNIT configuration answers a question whose text contains 'VAULT' with this value, compared case-insensitively (both sides upper-cased). It is evaluated for every candidate site that matched neither the UnitID nor the SiteID test, so supplying it alongside either of those filters can still select further sites. Activating it also restricts the UP/DOWN counts.

header Parameters
Accept-Language
string

Only the first tag's leading two characters are inspected: 'es' selects the Spanish message catalogue, anything else (and an absent header) selects English.

Responses

Response samples

Content type
application/json
{
  • "Summary": {
    },
  • "Devices": [
    ],
  • "EquipmentCount": 0,
  • "message": "",
  • "errorProcessing": false
}

/venuemgmtconsole/venues/listRSSI

One venue's RSSI (signal strength) histogram for a single report day — how many RADIUS-accounted connections were recorded at each RSSI value. Read from a cache written by RADIUS session accounting (8-day TTL); a report date older than about a week returns an all-zero distribution rather than an error.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent for the requested VenueID. No anonymous fallthrough.

A VenueID that doesn't match one of the operator's cached venues returns HTTP 200 with errorProcessing: true — not a 4xx.

AccessToken is body-only — this endpoint never reads an Authorization: Bearer header.

On success, RSSIDistribution is back-filled with a zero-connection entry for every RSSI value 1–127 the cache didn't supply, so a response always carries at least 127 entries even on a day with no data.

GET merges query-string parameters into the same request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
Request Body schema: application/json
required
AccessToken
required
string

Cognito access-token JWT. Verified only when non-empty; if omitted no role can resolve and the request is rejected with 401 Access Denied. . There is no Authorization-header alternative on this route.

IdToken
string

Cognito id token. Read only by the shared token validator, which runs only when an access token is also supplied; when present the id token is verified instead of the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
required
string

Venue whose RSSI histogram is returned; must appear in the operator's cached venue list. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UsageReportStartDateUTC.ISO8601
string

Report day, parsed with new Date. Optional - defaults to the current time. Whatever is supplied is forced to 23:59:59.999 before the cache key is built, so only the calendar day matters. The property name contains a literal dot.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "IdToken": "string",
  • "OperatorID": "string",
  • "VenueID": "string",
  • "UsageReportStartDateUTC.ISO8601": "string"
}

Response samples

Content type
application/json
{
  • "UsageReportStartDateUTC": "2019-08-24T14:15:22Z",
  • "RSSIDistribution": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/venuemgmtconsole/venues/listRSSI (GET)

One venue's RSSI (signal strength) histogram for a single report day — how many RADIUS-accounted connections were recorded at each RSSI value. Read from a cache written by RADIUS session accounting (8-day TTL); a report date older than about a week returns an all-zero distribution rather than an error.

Roles: NetworkSoftwareProvider (must send OperatorID), NetworkOperator (DomainAdministrator, AccountManager or CustomerSupport), or Venue admin/leasing agent for the requested VenueID. No anonymous fallthrough.

A VenueID that doesn't match one of the operator's cached venues returns HTTP 200 with errorProcessing: true — not a 4xx.

AccessToken is body-only — this endpoint never reads an Authorization: Bearer header.

On success, RSSIDistribution is back-filled with a zero-connection entry for every RSSI value 1–127 the cache didn't supply, so a response always carries at least 127 entries even on a day with no data.

GET merges query-string parameters into the same request; its response also carries Cache-Control: private, max-age=5.

Authorizations:
CognitoUserPool
query Parameters
AccessToken
required
string

Cognito access-token JWT. Verified only when non-empty; if omitted no role can resolve and the request is rejected with 401 Access Denied. . There is no Authorization-header alternative on this route.

IdToken
string

Cognito id token. Read only by the shared token validator, which runs only when an access token is also supplied; when present the id token is verified instead of the access token.

OperatorID
string

Target operator. Required ONLY for a NetworkSoftwareProvider caller (401 when absent); for every other caller the operator comes from the request Origin and this field is ignored.

VenueID
required
string

Venue whose RSSI histogram is returned; must appear in the operator's cached venue list. Format is {pmgId}._V3VENUE_.{Country}.{State}.{PostalCode_ID}.{VenueName_ID}.{City_ID}.

UsageReportStartDateUTC.ISO8601
string

Report day, parsed with new Date. Optional - defaults to the current time. Whatever is supplied is forced to 23:59:59.999 before the cache key is built, so only the calendar day matters. The parameter name contains a literal dot.

Responses

Response samples

Content type
application/json
{
  • "UsageReportStartDateUTC": "2019-08-24T14:15:22Z",
  • "RSSIDistribution": [
    ],
  • "message": "string",
  • "errorProcessing": false
}

/networkoperatorconsole/equipment/listOperatorDetails

Returns the operator record for the origin domain, shaped by the caller's role. Same implementation as /operatorconsole/config/listOperatorDetails.

Authentication is optional — an absent token falls through to the Public role and gets the public allowlist; a present-but-invalid token IS rejected (does not fall back to Public).

Roles: NetworkSoftwareProvider (must send OperatorID — re-reads the TARGET operator, not the provider's own), NetworkOperator (DomainAdministrator/AccountManager/CustomerSupport), or Public (everyone else — including venue roles and subscribers, who get no special access here).

Response shape by role: admins get the operator record with a few fields added/removed; everyone else gets a REBUILT allowlist-only shape.

Credential visibility: raw secrets (Cognito app-client secret, RADIUS secret, Stripe keys) are visible ONLY to NetworkSoftwareProvider and DomainAdministrator — an AccountManager/CustomerSupport caller has them stripped.

Read-only.

Authorizations:
CognitoAuth
header Parameters
api-version
string

Integer version selector; a missing or non-numeric value is treated as 0. Drives feature gating: 20260417 or higher adds NetworkConfiguration.StrictPSK for non-admin callers and suppresses the placeholder Notifications.Pinpoint for admins; 20261117 or higher removes the four legacy top-level role arrays. Below 20260417 (and before the 2026-11-17 sunset) the whole StrictPSK deprecation sentence is APPENDED to message on EVERY response, success or failure (the one exception is the fail-closed 500, whose body is exactly {"message":"Internal server error. ","errorProcessing":true} with no notice appended).

origin
required
string

Selects the operator whose configuration is read. The value is normalised (a '-preview' suffix is stripped and a small set of localhost origins is remapped to fixed development domains) and then resolved to an operator by domain. Absent - and with no Stripe-Signature header - the request is rejected 401 'origin missing. '; an origin that resolves to no operator is NOT rejected here - it yields a record with no identity, which downgrades the caller to the public role and the request is served the public allowlist with 200.

Request Body schema: application/json
optional

Optional. An absent body is tolerated - the request is then treated as empty - and a body that is present but not valid JSON is rejected 401, not 400.

AccessToken
string

Cognito JWT. OPTIONAL - omitting it is not an error, it resolves the caller to the Public role. An Authorization: Bearer <token> header overrides whatever is sent here.

OperatorID
string

REQUIRED only when the caller is a NetworkSoftwareProvider; absent in that case gives 401 'OperatorID Missing. '. It selects the target operator, whose record is then read and returned in place of the origin-resolved operator's. Ignored for every other role.

Domain
string

Read by the shared request pipeline only when the origin-resolved entity is a network software provider, and only to stage another operator record that this operation never reads. Accepted and ignored.

Responses

Request samples

Content type
application/json
{
  • "AccessToken": "string",
  • "OperatorID": "string",
  • "Domain": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "errorProcessing": true,
  • "OperatorID": "string",
  • "OperatorName": "string",
  • "NetworkOperatorName": "string",
  • "Domain": "string",
  • "EmailDomain": "string",
  • "DomainAlias": "string",
  • "Country": "string",
  • "Country.ISO3166A3": "string",
  • "AddressLine1": "string",
  • "AddressLine2": "string",
  • "City": "string",
  • "State": "string",
  • "PostalCode": "string",
  • "PhoneNumber": "string",
  • "EmailAddress": "string",
  • "LogoPNG": "string",
  • "LogoPNG.URL": "string",
  • "TandC": {
    },
  • "DisplayOptionID": "string",
  • "DisplayConfiguration": { },
  • "SupportedLocales": {
    },
  • "Origin": "string",
  • "RequestHeaderOrigin": "string",
  • "APIEndPoint": "string",
  • "APIDoc": "string",
  • "SignOn": {
    },
  • "NetworkConfiguration": {
    },
  • "PMS": {
    },
  • "Roles": {
    },
  • "DomainAdministrators": [
    ],
  • "SIEMAdministrators": [
    ],
  • "AccountManagers": [
    ],
  • "CustomerSupport": [
    ],
  • "Notifications": {
    },
  • "ShoppingCart": {
    },
  • "ServicePlans": [
    ],
  • "ServicePlanConfiguration": {
    },
  • "Reporting": {
    },
  • "WebhookURL": "string",
  • "PropertyManagementGroups": {