generated: '2026-08-11'
method: searched
source: https://www.cosmoplat.com/help/detail/304/1038
docs: https://www.cosmoplat.com/help/detail/304/1064
summary:
  types: [userPassword, deviceToken]
  rest_auth_documented: false
  api_key_in: []
  oauth2_flows: []
  openid_connect: false
  mutual_tls: not documented for callers (X509_CERTIFICATE is available as a DEVICE
    credential type)
detail: >-
  COSMOPlat publishes two credential models for the IoT development platform and neither
  of them covers the REST caller. Device-side credentials and MQTT tenant credentials are
  documented; the credential a client presents to the 26 REST operations is not.
schemes:
- name: enterpriseCredentials
  type: userPassword
  surface: mqtt
  applies_to: iot-mqtt.cosmoplat.com:11883 (tenant telemetry subscription)
  username: 企业ID — the enterprise (tenant) ID
  password: 企业密钥 — the enterprise secret
  issued_at: 企业中心 (enterprise center) after signing in to the IoT platform
  prerequisite: The transport component (传输组件) must first be activated by the platform
    system administrator.
  source: https://www.cosmoplat.com/help/detail/304/1064
- name: deviceCredentials
  type: deviceToken
  surface: mqtt
  applies_to: iot.cosmoplat.com:1883 (device telemetry ingest)
  credential_types: [ACCESS_TOKEN, X509_CERTIFICATE, MQTT_BASIC]
  credential_field: Device.deviceCredentialsId (访问令牌 — access token), returned on
    getTenantDevicesnew and getDeviceInfoByDeviceId
  source: https://www.cosmoplat.com/help/detail/304/1038
- name: consoleLogin
  type: interactive
  surface: web
  applies_to: https://tianyun.cosmoplat.com/ (天云控制台 — Tianyun console)
  note: >-
    The platform documents two tenant onboarding routes — a tenant provisioned by the IoT
    platform administrator, or a 卡奥斯天云 (CUBA) tenant signing in directly. Both are human
    console flows; neither is described as issuing an API credential.
  source: https://www.cosmoplat.com/help/detail/304/1026
rest_api_gap:
  documented: false
  evidence: >-
    All 26 operations in the published reference were transcribed on 2026-08-11. The
    Headers tables carry Content-Type and nothing else. No Authorization header, no
    X-Auth-Token, no apiKey query parameter, no signature scheme and no auth section
    appears anywhere in the reference.
  consequence: >-
    A developer cannot call this API from the documentation alone. The onboarding path is
    to contact the platform system administrator, which makes the REST surface effectively
    partner-gated even though its contract is fully public.
well_known:
  openid_configuration: not served (404 on www.cosmoplat.com)
  oauth_authorization_server: not served (404 on www.cosmoplat.com)
  see: well-known/cosmoplat-well-known.yml
gaps:
- id: no-rest-auth-documented
  detail: >-
    Publish the REST credential model — where the token comes from, which header carries
    it, how long it lives. This is the single change that would turn a readable contract
    into a callable one.
- id: no-oauth-or-oidc
  detail: No OAuth 2.0 or OpenID Connect surface is published, and neither discovery
    document is served.
- id: plaintext-mqtt-only
  detail: Credentials are passed as MQTT username/password over the documented plaintext
    ports 1883 and 11883. No TLS port is documented for either broker.
x-evidence:
- url: https://www.cosmoplat.com/help/detail/304/1038
  http_status: 200
  fetched: '2026-08-11'
- url: https://www.cosmoplat.com/help/detail/304/1064
  http_status: 200
  fetched: '2026-08-11'
- url: https://www.cosmoplat.com/.well-known/openid-configuration
  http_status: 404
  fetched: '2026-08-11'