OptionalbrokerThe gateway the platform assigned for the device's zone at claim or certificate enrollment. Used when no broker host is configured.
OptionalcaPEM-encoded issuing CA chain, so the device can assemble its chain.
OptionalcertificatePEM-encoded device certificate for the certificate path.
The device's stable ID, used as the MQTT client id. Treat it as an opaque string.
OptionalexpiresISO-8601 expiry, when the credential is time-bounded.
ISO-8601 time the credential was issued/stored.
Which authentication mechanism this credential uses.
OptionalprivatePEM-encoded private key for the certificate path.
The space the device belongs to.
The owning team (tenant boundary).
OptionaltokenBearer secret for the token path; presented as the MQTT password.
A device credential persisted across restarts.
The credential is written to the CredentialStore after a successful claim so that a power cycle reconnects without re-claiming (claim codes are single-use). For the token path only DeviceCredential.token is set; for the certificate path the key/cert/chain fields are set instead.