# Deployment Manager

The Deployment Manager API lets you monitor and manage your Roboflow Device Manager (RFDM) devices programmatically.

All endpoints are mounted under `/:workspace/devices/v2` on the public API host (`https://api.roboflow.com`). Read endpoints require a [scoped API key](/developer/authentication/scoped-api-keys.md) with the `device:read` scope; the create endpoint requires `device:update`. Workspace API keys with no explicit scopes list are implicitly granted all scopes (legacy behavior); keys that carry an explicit `scopes` array must include the relevant scope.

With the Deployment Manager API, you can:

* [List and Get Devices](/developer/rest-api/deployment-manager/list-and-get-devices.md)
* [Create a Device](/developer/rest-api/deployment-manager/create-a-device.md)
* [Device Config](/developer/rest-api/deployment-manager/device-config.md)
* [Device Streams](/developer/rest-api/deployment-manager/device-streams.md)
* [Device Logs and Telemetry](/developer/rest-api/deployment-manager/device-logs-and-telemetry.md)
* [Device Events](/developer/rest-api/deployment-manager/device-events.md)

## Authentication

All endpoints accept a workspace API key via either:

* Query string: `?api_key=YOUR_API_KEY`
* Header: `Authorization: Bearer YOUR_API_KEY`

### Device-scoped API keys

API keys minted for a specific device (for example, by RFDM during install) are narrowed to that device. They may only call routes whose `:deviceId` path parameter equals the key's bound device. They will receive **403** on the workspace-wide list and create endpoints, and on any `:deviceId` path that doesn't match.

## Cross-workspace isolation

A workspace API key can only read or modify devices that belong to its workspace. Requests for a device id owned by a different workspace return **404**, even if the id is otherwise valid.

## Errors

| Status | Meaning                                                                                                                                                                                                                                                                |
| ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 400    | Invalid query parameter (unknown `time_period`, malformed cursor or date, invalid `direction`, etc.) or invalid request body.                                                                                                                                          |
| 401    | Missing or invalid API key.                                                                                                                                                                                                                                            |
| 403    | Device-scoped API key targeting a different device, the workspace-wide list/create routes, a source device from another workspace during duplication, or a feature-gated request rejected (for example, AI1 creation or `offline_mode` not enabled for the workspace). |
| 404    | Device, stream, config, or source device not found. Read requests for device ids owned by another workspace also return 404.                                                                                                                                           |
| 429    | Rate limit exceeded. Logs are limited to 5 requests per minute per IP and 50 per minute globally; telemetry reads are limited to 60 requests per minute per device with a 10-request burst over 10 seconds.                                                            |

Error responses use one of two shapes:

* Handler-level errors (typically 400, 403, 404, and 429 from the handlers themselves) return `{ "error": "<message>" }`.
* Authentication and workspace-validation failures (typically 401) return a structured `error` object: `{ "error": { "message": "...", "status": 401, "type": "OAuthException", "hint": "..." } }`.

The logs rate limiter additionally returns a plain string body (not JSON) when it triggers a **429**.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.roboflow.com/developer/rest-api/deployment-manager.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.