Authentication

Mechanism	How it is sent	Intended use
HTTPBearer	Authorization: Bearer …	Scoped service integration.
CookieSession	eoi_session cookie	Signed-in user operations.
EdgeDevice	Bearer appliance credential	Protocol requests bound to a device, organization, and camera.
EdgeEnrollment	Bearer enrollment credential	Appliance claim using the permitted enrollment flow.

Cookie-authenticated writes require X-CSRF-Token. Scoped cookie requests also carry X-EyesOnIt-Session-Id after workspace rotation. Bearer service clients use their service token’s authority.

Operation pages show declared authentication alternatives and the baseline capability from the server’s shared routing policy. Additional role checks, tenant restrictions, licenses, and resource-specific validations can apply.

A provider workspace switch requires a provider user session, recent authentication, confirmed MFA, CSRF, and the current workspace revision in If-Match. See Authentication and permissions for setup and Manage customer workspaces and access for switching.