Configuration settings

Use the top-level settings object when generating a configuration. For a saved Client API configuration, change these settings in the panel; the resource sync endpoint does not edit them.

Start with defaults

Omit settings to use an enabled configuration with no password, hardware lock, or expiration. Editing permissions, shared/custom resources, and banner hiding default to false. Access defaults to restricted, which allows you to add locks and restrictions later.

A small example that permits credential editing:

{
  "settings": {
    "permissions": {
      "edit": {"credentials": true}
    }
  }
}

This is a fragment to add to your generation request. Enabling credential editing also sets the server permission flag, but the apps interpret this combination as credential-only editing; it does not unlock the endpoint or full profile.

Access and updates

Paths below are relative to settings.

For Business generation, access.password.verifier accepts a plaintext password up to 100 characters; the server transforms it into the app's verifier. A lowercase 64-character hexadecimal value is treated as an already prepared verifier. Do not assume an arbitrary SHA-256 digest will match the app's password hashing contract.

{
  "settings": {
    "access": {
      "password": {"mode": "local", "verifier": "ReplaceThisPassword"}
    }
  }
}

Every supplied updates, password, or HWID object needs an explicit mode. Do not include a mode-specific value when that mode is disabled.

Restrictions

{
  "settings": {
    "restrictions": {
      "expires_at": "2027-01-01T00:00:00Z",
      "block_root": true,
      "allowed_carrier_codes": ["51502", "51503"]
    }
  }
}

Use actual JSON booleans (true / false), not quoted strings. List fields are JSON arrays. Carrier codes are strings so leading zeroes survive.

Editing and display

All these fields are booleans and default to false:

Shared resources retain their source configuration. Its access checks still apply when a recipient uses one of those resources. These flags do not publish resources to the panel's public server catalog. Local custom resources and permitted local edits do not write changes back through the Client API.

For access.mode: "open", the generator clears individual edit permissions and add_custom along with locks and restrictions. Open access corresponds to the panel's Unlock All behavior: the apps can transfer the imported copy to the recipient as owner. Use restricted access with explicit permissions when you want recipients to make only selected edits; restricted access can still have no password or device lock.

Android and iOS restrictions

Test access as an ordinary recipient. Verified configuration owners can bypass recipient restrictions, so importing as the owner is not a sufficient lock test. The app's displayed device ID is the value to use for device locks; it is different from an API key and from a raw device-registration identifier.

Sharing and owner metadata

These fields belong beside settings at the top level of a Business request:

{
  "sharing": {"allow_reshare": false},
  "owner": {"device_hwid": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
}

sharing.allow_reshare defaults to false. The optional owner device identifier is at most 32 characters. Owner username is derived from the authenticated Business account and cannot be supplied.