IoTConnect FAQs

/IOTCONNECT™ is a secure, cloud-based enterprise IoT and AI platform. It brings together device connectivity, device management, rules, data storage, dashboards, and integrations in one portal. The platform uses a microservices architecture and runs on AWS and Azure cloud infrastructure.

Learn more: Overview · Architecture

Register your company through subscription.iotconnect.io, through the AWS or Azure Marketplace, or by contacting the /IOTCONNECT™ team. After registration you receive the username and password for your environment.

Learn more: REST API prerequisites · Quick Start

The CPID (Company ID) is the unique identifier for your company across /IOTCONNECT™. Devices and SDKs need it to connect.

Find your CPID, Environment, and Discovery URL in the portal under Settings › Key Vault.

Learn more: Quick Start · SDK Overview

1. Sign in and note your CPID.
2. Create an entity if you do not have one yet.
3. Create a device template with attributes (and, optionally, commands).
4. Create a device with a unique ID, and select the template and entity.
5. Send data with the built-in simulator or an SDK.
6. Open the device and check the Live Data tab.

Learn more: Quick Start · Smart Device Onboarding

Yes. Each device has a Simulator tab. Set the Interval (seconds between messages), Duration (minutes), Min and Max values, and Precision for each attribute, then click Start Simulation.

The simulator is available only after the device is registered and its template has attributes.

Learn more: Smart Device Onboarding, Step 4

• Smart Device: a single device that connects directly to the cloud.
• Gateway: connects child devices that cannot reach the cloud themselves.
• Edge Device: evaluates rules locally on the device.
• Edge Gateway: child devices plus local rules.
• Greengrass, LoRaWAN, or Sidewalk: for those specific technologies.

Learn more: Devices · Device type comparison

You need an active account, at least one entity, and a device template. Every device belongs to exactly one entity and uses one template.

Learn more: Smart Device Onboarding · Entity

The Unique ID is required, must be unique across your account, and is what the SDK uses to connect. For X.509 templates it can be at most 31 characters, for both parent and child devices, because it is part of the certificate registration identifier.

When you import devices in bulk, a Unique ID can contain only letters, digits, and hyphens.

Learn more: Smart Device Onboarding, Step 3 · Device Import

• Created: registered but has not connected yet.
• Active: has connected and is operational.
• Inactive: manually deactivated.
• Acquired: claimed by another entity.
• Released: released from an entity.

Learn more: Smart Device Onboarding

Use Device Import. Download the sample JSON file from your account, fill it in, and upload it. The platform validates the file first; you can start the import only when the batch status is Validated. Devices are then created by a background job (In Queue, then In Progress).

You can import standalone devices, gateways, and child devices nested under their gateway.

Learn more: Device Import

Yes. By default an account can hold up to 10,000 devices, including imported devices. An import that would exceed the quota is blocked. To raise the limit, create a support ticket.

Learn more: Device Import, Device Quota

A JITP (Just-In-Time Provisioning) rule registers a device automatically the first time it connects with a trusted certificate. Rules match by Certificate Authority or by regex on certificate details, are evaluated top to bottom, and the first match wins.

A device that matches no rule appears in the unassociated devices list, where you attach it to a template and entity, or delete it.

Learn more: Unassociated Devices and JITP Rules

Yes, with a Cloud Template Device. You connect the device and start sending data; the platform detects the attributes automatically. You then review the attributes, rename them, set their data types, and convert the result into a standard template to unlock rules, dashboards, commands, and storage.

It is meant for prototyping, testing, and migrating devices from other platforms.

Learn more: Cloud Template Device

The gateway sends one message that contains its own data and an entry for each child device. Each child entry is identified by the child’s unique ID. Child devices never connect to the cloud directly.

A plain gateway only forwards data. For local rule processing, use an Edge Device or Edge Gateway.

Learn more: Gateway Device · D2C Messages

• X.509 certificates (self-signed or CA-signed), recommended for production.
• TPM, hardware-based keys in a tamper-resistant chip.
• Symmetric key, for development, testing, and constrained devices.
• Individual enrollment, per-device credentials.

On the standard device template form, the Authentication Type is preset to X.509; you choose how the certificate is provided when you create each device.

Learn more: Security Overview · Smart Device Onboarding

Auto-generated (recommended for getting started): the platform creates the certificate and private key. You download a zip with the device certificate (.pem.crt), private key (.pem.key), and root CA (root-CA.pem) and copy them to the device.

Use my certificate: for your own PKI or CA-signed certificates. Upload a .pfx file or paste PEM text (not both), and optionally select a registered Certificate Authority.

Learn more: Certificate Creation Guide

No. /IOTCONNECT™ does not keep the private key after generating it, so it is available only in the first download. Delete the device, create it again, and download a new certificate package.

Learn more: Certificate Creation Guide

1. Go to Security › Certificates and click Create Certificate.
2. Enter a name and upload the CA certificate in PEM format. The status is Pending Verification.
3. Click Verify to get a verification code.
4. Create a verification certificate with the code as its Common Name, signed by your CA private key, and upload it.

The verification code expires after 24 hours. An account can hold up to 25 CA certificates.

Learn more: Certificates Management · X.509 Certificates

No. Each device needs its own certificate and private key. If devices share a certificate, only one can be connected at a time because the duplicate client ID disconnects the other.

The certificate’s Common Name (CN) must also match the device’s Unique ID, or authentication fails.

Learn more: Certificate Creation Guide, Common Mistakes · X.509 Certificates

Register and verify the new CA certificate while the old one is still active, move devices to certificates signed by the new CA in batches, and delete the old CA only when no device uses it. Start at least 30 days before expiry.

Device templates also include Enable Certificate Rotation and Rotation Renewal (In Days) settings.

Learn more: Certificate Rotation

With an SDK, call the SDK’s telemetry method (for example send_telemetry()). With a custom implementation, publish a JSON message to the rpt topic returned by the Identity API. The attribute names in the message must match the template.

The outer dt (publish time) is optional; an inner dt is shown as the time of that data point, which lets you send historical data.

Learn more: D2C Messages · SDK Overview

Open the device and select the Live Data tab. It has three views: Telemetry (latest values), Graph (time-series chart), and Tabular (timestamped table).

Learn more: Telemetry

INTEGER, LONG, DECIMAL, STRING, BIT (0 or 1), BOOLEAN, DATE, DATETIME, LATLONG, OBJECT (nested child attributes), and ARRAY.

Learn more: Smart Device Onboarding, Supported Data Types · Reference Table

Every message is validated against the device template. A message with an unknown attribute name or a value of the wrong type is recorded as a faulty message. It is kept for troubleshooting, but it does not appear as telemetry and is never evaluated by rules.

Learn more: Data Journey · Telemetry

By default /IOTCONNECT™ keeps device telemetry for 3 months, after which it is deleted automatically. Hot storage retention ranges from 7 to 90 days depending on your plan. To keep data longer, route it to your own storage with a connector.

Learn more: Data Journey, Storage · Connectors

MQTT over TLS on port 8883 is the primary protocol, with QoS 1 for reliable delivery. HTTPS is used for discovery and sync calls and as a fallback where MQTT is blocked. All communication uses TLS 1.2 or later.

Learn more: SDK Architecture

Use Device Message 2.1 for all new projects. Version 1.0 is only for existing devices that still use it.

Learn more: Device Message 2.1

Yes. Enable streaming on the device template and choose a mode: Kinesis Video Stream (buffered, firewall friendly) or WebRTC (lowest latency). Then choose the stream type (IP, USB, or Module based) and whether streaming starts automatically.

Video streaming works with Device, Edge, Gateway, and Edge Gateway types. For Kinesis Video, the device side runs on Raspberry Pi OS (Debian) or Ubuntu 22 with GStreamer and the AWS KVS Producer SDK.

Learn more: Video Streaming

1. Add the command on the template’s Commands tab (name, command text, and optional Parameter Required and Receipt Required settings).
2. Make sure the device is connected and subscribed to its C2D topic.
3. Open the device’s Commands tab, select the command, enter a parameter if needed, and click Execute.

Commands can also be sent through the REST API or automatically by a rule.

Learn more: Commands

When a command requires a receipt, the message includes an ack ID. The device replies on the ack topic with that ID, type 0, and a status: 4 (failed), 5 (executed), or 6 (success). You can follow the result in the command history.

Learn more: Commands · D2C Messages

The command message includes the child’s unique ID in the id field. The gateway receives the message and forwards it to the correct child device.

Learn more: C2D Messages

The template’s C2D (Command & OTAs) Delivery setting controls how commands and OTA updates are delivered; the default is Normal. With on-demand delivery, commands and OTA messages are queued until the device asks for them with identity messages: mt 205 (pending OTAs), 206 (pending commands), or 209 (both).

Learn more: Smart Device Onboarding, Template fields · Device Identity Messages · Release V1.5.1

Besides commands (ct 0), OTA (ct 1), and module commands (ct 2), the platform sends system messages. Examples: refresh attributes, settings, edge rules, or child devices; change the data frequency; start or stop the heartbeat; start or stop a video stream.

When the device is deleted, disabled, released, or told to stop, it must disconnect immediately and not try to reconnect.

Learn more: C2D Messages

A template is the blueprint for a group of devices. It defines the attributes (data the device sends), shadow properties (desired settings), and commands. After you save a template it has Properties, Attributes, Shadow, and Commands tabs. You can also create a standard template from JSON for faster setup.

Learn more: Smart Device Onboarding, Step 1 · Quick Start

The Template Code is required, can be at most 10 characters, must be alphanumeric, and must start with a letter (for example THERM01). It cannot be changed after creation. The Template Name can be up to 100 characters.

Learn more: Smart Device Onboarding

The Local Name is the key your device uses in telemetry. It must use letters, digits, and underscores and start with a letter (for example temperature). Names are case sensitive. The optional Display Name is what the portal shows.

Learn more: Smart Device Onboarding, Step 2

Use the OBJECT data type with child attributes (for example a location with lat and lng), or the ARRAY type for a list of values.

Learn more: Supported Data Types

Shadow properties are desired settings that the platform pushes to devices, such as a target temperature or report interval. Each has a Property, Key, Data Type, and Default Value. A device reads them with the mt 202 identity message and reports changed values back with a shadow update.

Learn more: Smart Device Onboarding, Shadow tab · Device Identity Messages

Entities represent your organization’s structure, such as Company › Region › Building › Floor. Nesting depth is unlimited. Every device belongs to exactly one entity, and users see the devices in their assigned entity and all of its children.

Learn more: Entity

Yes. Go to Entity › Entity Import and upload a CSV file to create multiple entities, including multi-level hierarchies, in one operation.

Learn more: Entity, Entity Import

1. Go to Users › User and click +.
2. Enter the first name, last name, and email.
3. Select a role and an entity (the entity controls which data the user sees).
4. Set the contact number and time zone, then click Save.

The user receives an invitation email to activate the account.

Learn more: User and Role

A role defines what a user can do. It includes the solutions it can access and module-level permissions (for example Devices, Templates, Rules, Firmware, Users, and Settings). You can create as many custom roles as you need under Users › Role & Permissions. What a user can see is still limited by their entity.

Learn more: User and Role

A rule can send an email, send a push notification to the mobile app, call a webhook (HTTP POST), send a command to the device, or show a UI alert in the portal. You can choose more than one action.

Learn more: Rule Engine

1. Go to Devices › Rules and click Create Rule.
2. Select the template and the attribute to monitor.
3. Set the operator and threshold.
4. Choose a severity: Information, Warning, Critical, or Major.
5. Choose the actions and their details.
6. Save the rule and make sure it is Active.

Learn more: Rule Engine

Operators: Greater Than, Less Than, Equals, Not Equals, Between, and Not Between. You can combine conditions with AND (all must be true) or OR (any can be true). Only numeric and boolean attributes support conditions.

Keep rules simple for devices that send data every second, because complex conditions take longer to evaluate.

Learn more: Rule Engine, Rule conditions

Yes, on Edge Devices and Edge Gateways. Rules defined in the portal are synced to the device, which evaluates them locally and acts within milliseconds, even when offline. Rules are re-synced when they change in the portal.

Learn more: Edge Device · Edge Gateway Device

Rules react to telemetry values. Events notify you about platform actions, such as a device being created, deleted, imported, acquired, or released, firmware changes, and template or entity changes.

To subscribe, go to Events › Subscription, switch the event on, and add email recipients. Events › Notifications shows the history.

Learn more: Events

An over-the-air (OTA) update pushes new firmware to devices remotely, so you can fix bugs, patch security issues, and add features without physical access. You can update one device or thousands at once.

Learn more: OTA Updates

1. In the Firmware section, create a firmware entry for the target template.
2. Upload the firmware binary.
3. Set the hardware and software versions.
4. Select target devices: individually, by device group, or all devices on a template.
5. Push now or schedule the deployment.
6. Monitor the rollout status.

Learn more: OTA Updates

The device receives an OTA message (ct 1) with the software and hardware versions and one or more download URLs. It downloads the file, installs it, and reports progress and the result on the ack topic with type 1.

Learn more: OTA Updates · C2D Messages

Python, C, Node.js, C# / .NET, Java, Android, iOS, and a Python SDK for AWS IoT Greengrass. The SDK Language Table helps you pick one for your hardware and links to the GitHub repositories.

Learn more: SDK Language Table · SDK Repository

1. Install the SDK for your language.
2. Get your CPID and Environment from Settings › Key Vault.
3. Initialize the SDK with the CPID, Environment, and device Unique ID.
4. Connect, then send telemetry.
5. Register a callback to handle commands, and send acknowledgments.

Learn more: SDK Overview · Common SDK interface

Yes, using Device Message 2.1. The flow is: call the Discovery API to get the base URL, call the Identity API to get the MQTT host, topics, and settings, connect over MQTT, send the Hello message (mt 200), and then request what the response says is available (attributes, settings, rules, or child devices).

Learn more: Device Message 2.1 · Discovery API · Identity API

1. Get a solution key from the support team.
2. Call GET /api/v2.1/auth/basic-token.
3. Call POST /api/v2.1/auth/login with the basic token, your solution-key header, and your username and password. You receive an access token and a refresh token.
4. Send Authorization: Bearer {access_token} on every call, and use POST /api/v2.1/auth/refresh-token when it expires.

Learn more: REST API

The REST API page lists each service (Master, Authenticate, User, Device, Firmware, Event, Telemetry, and File) for AWS and Azure, with links to interactive Swagger documentation for each environment.

Learn more: REST API

AWS: DynamoDB, S3, SNS, SageMaker, DocumentDB, SQS, SignalR, WebSocket, and MQTT.

Azure: Cosmos DB, Blob Storage, Service Bus, Event Hub, Data Lake Gen 2, and Reporting Database.

Learn more: Connectors

1. Go to Settings › Configuration › Live Data Streaming.
2. Switch the connector on.
3. Select the data to route: Telemetry, Faulty, Diagnostics, or Command History.
4. Click the setup link to provision resources (CloudFormation for AWS, an ARM template for Azure).
5. Click Save. Data starts flowing right away, with no device changes.

Learn more: Connectors

Add a Webhook action to a rule. When the rule triggers, the platform sends an HTTP POST with the event to your URL. For streaming data to other systems, use a connector such as SNS, SQS, MQTT, or WebSocket.

Learn more: Rule Engine · Connectors

1. Open Dashboards and click Create Dashboard.
2. Choose New Dashboard, Device Dashboard, or Import Dashboard (from exported JSON).
3. Name it and set its visibility.
4. Drag widgets from the bottom panel and configure each one.
5. Click Save.

Learn more: Dashboard Quick Start

Widgets are grouped as Module (counters), Live (real-time charts, gauges, and tiles), Other (labels, embedded pages, links, Grafana), DMMI (camera feeds and device interaction), Device Audit (status, OTA, notifications, location), and KPIs. Live widgets update automatically through SignalR, with no page refresh.

Learn more: Dashboard Quick Start · Live Widgets · Audit Widgets

Yes. Select Only Visible to Me when you create it. Otherwise the dashboard can be shared with your team.

Learn more: Dashboard Quick Start

Yes. The Embedded widget loads a URL in an iframe. Add &kiosk to a Grafana URL for a borderless view. The target site must allow iframe embedding.

Learn more: Other Widgets

AI@Edge runs machine-learning models directly on your devices, so they can detect anomalies or make predictions in real time, even with little or no connectivity. It is built on the Model Hub, model conversion with Amazon SageMaker, and retraining with ST.

Learn more: AI@Edge

Model Library holds global models published by platform administrators; every account can use them, read-only. My Models holds models your company creates and manages privately. Each model has a name, code, type, versions, and optional variants.

Learn more: Model Hub

Create the model (supported files include .bin, .tflite, and .onnx), then open Push Model, select the template, the device, and the model, and click Execute. The device receives a module command (ct 2) with a download URL, the same delivery mechanism as OTA.

Learn more: AI Model

When a model is flagged for SageMaker, Amazon SageMaker converts and prepares the model in the background, so you do not upload a finished file. The flag is set when the model is created and cannot be changed. Processing requires your company’s SageMaker settings, which link your AWS account through a cross-account IAM role.

Learn more: Conversation with SageMaker

A SensorTile.box PRO (firmware v3.1.0) collects data through the mobile app and uploads it to the platform. The platform’s backend sends it to the ST AIoT Craft service to train a new model, then makes the retrained model available for the device.

Learn more: Retrain with ST

Yes, through AWS IoT Managed Integrations. Open Managed Integration, choose the connector, and click Create Association once to link your account. Your devices then appear in the dashboard: Hue lights support on/off, brightness, and color, and Tapo cameras support live view over WebRTC. Both also respond to Amazon Echo voice commands.

Learn more: Philips Hue · TP-Link Tapo Camera

Use Greengrass when you need local processing, low-latency responses, offline operation, edge ML, protocol translation, or remotely managed software components. If a device only reads a sensor and sends the value, a standard device with the regular SDK is simpler.

Learn more: Greengrass Introduction

Choose Nucleus Classic (Java, about 200 MB) for devices with 512 MB or more of RAM and Java support, such as Raspberry Pi or x86 PCs. Choose Nucleus Lite (C, about 15 MB) for memory-constrained or embedded Linux devices such as STM32MP or NXP i.MX. The nucleus type cannot be changed after the device is created.

Learn more: Greengrass Introduction · Greengrass Troubleshooting, FAQ

No. /IOTCONNECT™ manages the AWS resources (IoT Core, certificates, and deployments) for you. No AWS credentials or console login are needed.

Learn more: Greengrass Troubleshooting, FAQ

Not necessarily. A public network (Everynet) needs no gateway but requires coverage and supports OTAA only. A private network uses your own gateway, supports OTAA or ABP, and works wherever you place the gateway.

Learn more: LoRaWAN · LoRaWAN Troubleshooting and FAQ

No gateway: compatible smart-home devices in the neighborhood act as Sidewalk Bridges. Sidewalk suits low-power devices that send small, infrequent messages, and it is currently available only in the United States.

Learn more: Sidewalk

• The device has its own certificate, private key, and the root CA file from its download.
• The device clock is correct (enable NTP); a wrong clock makes certificates look expired or not yet valid.
• Outbound TCP port 8883 is open on the network.
• For your own CA, the CA certificate is Verified and the certificate CN matches the device Unique ID.
• The device was not deleted and re-created; that makes old certificates invalid.

Learn more: Certificate Creation Guide, Common Mistakes · Greengrass Troubleshooting

A common cause is two devices using the same certificate: the duplicate client ID disconnects the other device. Also check whether the device received a Device Deleted, Device Disabled, Device Released, or Stop Operation message; after those, the device must stay disconnected.

Learn more: Certificate Creation Guide · C2D Messages

• Attribute names in the message must exactly match the template’s Local Names (case sensitive).
• Values must match the attribute data types; otherwise the message becomes faulty data.
• Custom SDKs must request attributes (mt 201) before sending telemetry.
• Check the device’s Last Activity time, and try the simulator to confirm the template works.

Learn more: Telemetry · Device Identity Messages

• 0 Success
• 1 Invalid CPID/SID
• 2 Company not found
• 3 Subscription expired
• 4 Device not found
• 5 Device not active
• 6 Device blocked
• 7 Template not found

For codes 1 to 3, check your CPID and Environment in Settings › Key Vault and your subscription status.

Learn more: Reference Table · Discovery API

C2D messages must be acknowledged at MQTT QoS 1. If they are not, the device can receive duplicates after it reconnects.

Learn more: C2D Messages

The verification code expires after 24 hours; generate a new one and retry. The verification certificate must use the code as its Common Name and be signed by the same CA’s private key. CA certificates must include the CA:TRUE basic constraint and must not be expired.

Learn more: Certificates Management · Certificate Import

The top causes are a reversed DevEUI byte order (the portal expects MSB first), an AppKey that does not match the device, and a device and gateway on different frequency bands.

Learn more: LoRaWAN Troubleshooting and FAQ

An import can start only when the batch status is Validated, and it is blocked if it would exceed your device quota. Fix the entries that failed validation (for example duplicate or invalid Unique IDs) and check your quota.

Learn more: Device Import