Skip to content
Identity and Access Management

25 August 2025

Production release: 25 August 2025
Staging release: 19 August 2025

25 August 2025

Section titled “25 August 2025”

Features

Section titled “Features”

  • Implementation of Bootstrap v2 API: A public endpoint is implemented for devices to request operational certificates by passing a CSR

  • Introducing Subset Permission Check in Role Assignment APIs: A subset permission check is introduced in role assignment APIs to enhance security.

  • Support Wildcard Search in RSQL Filter: Enhanced the common DB layer to support partial string searches with wildcards (e.g., starts with, ends with, contains) for fields like name, enabling queries such as name==Test*, name==*Test, and name==Test to return all matching records. This feature is available for list endpoints such as /users, /groups, /devices, /accounts, /addresses, and doingBusinessWith.

  • Group Relation Implementation: Added support for group assignment in the “Create Role” API. Using the createGroupOnAssignment query parameter, users can now be automatically added to a role assignment group when a role is assigned to a group, enabling better aggregation of users by group-assigned roles.

  • Scoped Application ID support in application endpoints: Added support for scopedToApplicationId in Application GET endpoints, enabling the retrieval of application data scoped to a specific application ID.

  • User Filtering by IDs in Groups: Added support for filtering users within a specific group by user IDs via the /groups/<group_id>/users endpoint. API consumers can now provide a list of user IDs to retrieve matching users in the group.

  • Subgroup Listing by Parent Group ID: Added support for listing all subgroups within a group by specifying the parent group ID via the GET /groups?parentGroupId= endpoint. Users can now retrieve subgroups by providing the parent group ID as a query parameter.

  • Subgroup Membership Listing by User ID: Added support for retrieving all subgroups a user belongs to by specifying the user ID and parent group ID via the GET /user/{id}/groups?parentGroupId= endpoint. Users can now fetch subgroups associated with a user under a specific parent group.

  • Group creation within another Group: Added support for creating a group within another group, enabling nested group structures. Users can now specify a parent group when creating a new group to establish subgroup relationships.

  • Determine Child IAM Group status: Added support for determining if an IAM group is a child of another IAM group by listing groups based on parent group relationships. Integrating applications can now query groups using the parent group ID to identify subgroup hierarchies.

Enhancements

Section titled “Enhancements”

  • Real-time Events Publish for Invitation: We now publish real-time events for the invitation lifecycle. This allows IAM (Identity and Access Management) consumers and other connected applications to subscribe to these events to automate workflows and enhance monitoring. Events published for following scenarios: Invitation Sent, Invitation Completed (Accepted), Invitation Failed , Invitation Expired, Invitation Cancelled

  • Strategy for Error codes: We’ve updated our Identity and Access Management (IAM) service to include a new, clear, and extensible error code strategy. The error code changes were implemented to users and roles related functionalities and documentation can be reviewed here: https://docs.trimblecloud.com/identity-and-access-management/content/reference/errors/api_errors/

  • Public key management in device api: We’ve streamlined public key management by adding optional attributes directly to the Device API’s POST (create) and PATCH (update) endpoints. Now we can manage a device’s public key at the same time you create or update its configuration, eliminating the need for a separate API call.

  • Events publish for Organization: We now publish add_organization_address and add_organization_enrichment events alongside existing organization lifecycle events. This provides a more complete and reliable data stream for all downstream consumers, including Virtual Warehouse and MTP.

Bugfix

Section titled “Bugfix”

  • Fixed an issue where updating consent in the cloud console triggered a bad request error.

  • Authorization is now bypassed for users updating their own default account, resolving related permission issues.

  • Group migration scripts now prioritize the default account when users are associated with multiple accounts.

  • Addressed issues in the user update workflow, correcting status codes and error messages for negative cases.

  • Resolved an issue where RSQL filters ignored queries specified after a semi-colon (;).

  • Enhanced IAM API search functionality for improved accuracy and relevance of results.

  • Fixed an issue that prevented users from being removed from their default account.