The platform

What InnovaEdge actually does.

The capability surface, cluster by cluster — IoT device lifecycle, telematics, the telemetry data platform, agent tooling, and the tenancy underneath it. Written to be evaluated, not admired.

API spec fox.device.config/v1 · OAuth 2.1 with PKCE · MQTT-native

01 — Fleet & lifecycle

Devices are adopted, not configured by hand.

A device announces itself, reports what it is and what it can do, and you adopt it into an organization. From that point its whole life is a tracked sequence of states rather than a series of one-off SSH sessions.

Adoption & ownership

Devices announce themselves and are adopted into an organization. Ownership is an explicit, auditable record; unknown or conflicting identities go to quarantine rather than into an arbitrary account.

Onboarding that closes its own loop

A device reports the identity it will actually publish under rather than being told what it is, and the first configuration is triggered from the device side once it lands. The path from unconfigured hardware to a device reporting home completes without a person stepping in at each stage, and a device that arrives under the wrong identity is realigned rather than left in a silent deadlock.

One canonical device identity

A device is addressed by the identity the industry already uses for it, and that is the identity it publishes and is billed under. Vendor-specific keys — a manufacturer serial, a cloud provider's internal id — are resolved at the boundary and never become the identity your fleet is organised by, so moving a device between paths does not rename it.

Fingerprints & capability sets

Every device carries a hardware fingerprint and a queryable capability set, so "which of these can do X" is a query rather than a guess.

Profiles & smart groups

Reusable profiles applied and published to many devices, and smart groups that address sets of devices by what they are rather than by list.

Self-populating equipment discovery

An evidence-gated discovery run learns what is on a device's bus — CAN, or Modbus stations and registers probed in batches — and promotes what answered into a draft profile. Publishing that profile creates the matching twin equipment type as well, so one act fills both what the device reads and what the ontology knows the equipment is. The recipe library grows itself.

Recovery & diagnostics

Per-device recovery actions, LED indicator programs, WiFi profile workflows with retry and cancel, and a connectivity self-heal watchdog on the device itself. A field bootstrap credential can be minted, rotated and revoked so a device that has lost its way home can be brought back without a site visit.

Device clock integrity

A device whose clock is unset or skewed misdates every row it lands, silently corrupting every time-ordered read. Those devices are flagged with the consequence stated, not left to poison the history.

02 — Configuration & OTA

Preview before you publish. Verify before you continue.

Configuration is layered and inspectable. You can see the resolved result for a device before it ships, and updates move through stages instead of landing all at once.

Preview before publish

Read a device's config, its fully resolved config, or its stacked view — with a dry-run diff and a per-device plan — before anything is written.

Stacked, versioned configuration

Device-specific overrides sit on top of shared profiles and you can see which layer supplied each value. Each table module carries its own monotonic version.

Desired-versus-running reconciliation

Devices report the exact table versions they loaded. The fleet view distinguishes applying, missing, rejected, version-drift and synchronized rather than assuming delivery equals effect.

OTA with staged verification

Firmware and agent bundles served per device and per model over TLS, staged through onboarding, upgrade and decommission with a verification step between stages.

Chunked, resumable OTA over thin links

A bundle is served in byte ranges and pulled one socket-sized chunk at a time, verified against a manifest, and resumed from where it stopped rather than restarted. Progress is reported per device while it runs, so a slow cellular update is visible instead of silent.

Last-good rollback

A device retains its last-good fragment through a transient failure and reports what it is actually running, so a bad push degrades instead of going dark.

Visual flow authoring

Wire a flow of source, transform, gate and report nodes on a pan-and-zoom canvas — CAN frames, OBD-II PIDs, GPS, Modbus registers, BLE tags, digital and analog IO. It compiles to the same table definition the form editor produces and deploys down the same path, so it is a second way to author one contract rather than a second contract.

Staged rollout campaigns

Target a cohort, define the rollout, and attach the workflows that carry it out so an update reaches a defined subset on a defined path before it reaches all of it. Waves publish, then soak for an observation window before the next wave begins.

Direct command channel

Queue a command for a device and it is pulled and run once, acknowledged over MQTT. A monotonic sequence per device means a re-queue forces a re-pull and a device cannot silently replay or skip a command.

Power & sleep as a compiled profile

Sleep behaviour is authored once and compiled per device family, because the families genuinely differ — what is a cyclic low-power setting on one is an alarm-gated runtime action on another. You describe the behaviour you want; the platform emits whatever that family actually needs.

Platform-owned device defaults

The on-device engine holds no defaults of its own. Device naming, transport topics and QoS, sample and report schedule, connectivity mode, status LEDs and the recovery watchdog all live in one profile the platform stamps into every pushed config, so a device is never running a default nobody chose.

03 — Vehicle telematics

Down to the PID, not just the position.

Vehicle support goes past GPS. The platform can interrogate the bus directly, discover what a given vehicle exposes, and sweep it on a schedule.

CAN bus scan & explore

Stepped scan and explore routines per device, so an unfamiliar vehicle is characterised rather than assumed. Raw and decoded byte access.

OBD-II PID discovery & sweeps

PID discovery, probing, and per-device sweeps that walk the supported PID set and record what actually answers.

Fleet positions

Fleet-wide position reporting on a live map, from native telemetry and from tracker hardware through the Teltonika gateway.

Geofences with on-device evaluation

Geofences evaluated on the device as well as centrally, so entry and exit still fire when the link is down — stronger than the usual server-only model.

Trips & playback

Position history segmented into trips on a reporting gap, with a bounding-box test that discards the path a parked device accumulates from GPS jitter rather than reporting it as travel. Selecting a trip draws it on the map and a slider scrubs a marker along its fixes. A trip is a view over landing telemetry rather than a stored record: the device drawer reads the last 48 hours and any window is cut off at 5,000 fixes, so a fast-reporting device is read back over less elapsed time than a slow one.

Driver & asset safety scoring

Harsh braking, harsh acceleration and idling detected from the same position stream trips are built from, weighted into a 0–100 score over the same 48 hours the device drawer asks for, with speed taken from the device's own channel or derived from consecutive fixes where it reports none. Speeding is a fourth event the scorer can count, but only against a limit passed on the API call — the panel does not ask for one and no posted limit is held per device or per asset, so in the console the scorecard is three event types. An empty window means there was no speed data in range, not a clean driver.

Diagnostic trouble codes

A vehicle's current OBD-II fault codes read off its latest telemetry and classified by system, by generic against manufacturer-specific, and by severity. A watch pass diffs each device's code set against the set it last saw and raises the transition — a fault that appeared, a fault that cleared — rather than the same codes again on every heartbeat. The severity ranking is a documented heuristic, since OBD-II defines none, and a device whose config does not report a fault register has nothing to classify.

04 — Telemetry data platform

Telemetry becomes a table you own.

This is the part most fleet tools skip. Incoming telemetry lands in tables with real schema, retention you control, and anomaly rules attached — not in an opaque store you query through someone else’s chart widget.

One definition, both sides

A table definition tells the device what to acquire and when to report, and tells the platform how to parse and store the result. Device config and database schema are compiled from the same module, so they cannot drift apart.

Schema & retention control

Inspect a table's schema, rename or drop columns, and set retention per table on your policy — without losing the stream while you do it.

Catalogs & enrichment

CSV/XLSX uploads or a linked live database joined onto raw telemetry by device key, so rows arrive already carrying the customer, asset or contract record you hold. Connecting a catalog to a twin type suggests a column for each field with a confidence on the match, for you to accept or correct; a field with no close enough column is left blank rather than guessed at.

Your broker, your database

Bring your own MQTT broker and your own Postgres sink, or use the managed ones. A broken private sink fails visibly — customer data is never quietly redirected into platform storage.

Data-quality expectations

Per-table expectations with quarantine for rows that fail them, plus medallion tiers, so a bad sensor does not silently become a trusted number.

Durable sink spool & replay

Writes that a private sink cannot accept are spooled and replayed rather than lost, with backlog and dead-letter counts surfaced instead of hidden.

05 — Digital twin

Model the plant once, not once per system.

Equipment and locations are typed models, not tags on a dashboard. Every device resolves onto an instance in a relationship graph, so a reading is always traceable back to the asset it describes — the same discipline a plant historian gives you, built into the fleet layer instead of bolted on.

Typed equipment & location models

User-defined equipment and location types built from a closed primitive set, with references, GeoJSON geometry and versioning. Model and instance are separate, as they are in a plant historian.

Instances & relationship graph

Asset instances with a navigable relationship graph and lineage, and a single-home device-to-equipment edge so it is never ambiguous which asset a reading describes.

Typed, audited actions

Every change to a twin object or the device-to-equipment graph flows through one typed action rather than a scatter of bespoke endpoints. Each call is validated, permissioned, and written to the organization audit trail with its provenance, so what changed, who changed it and why is answerable after the fact.

Twin-driven observabilityIn development

Attach geofences and thresholds to a location or equipment type rather than to a device, and let the platform fan them out to every device that resolves to it. Author once, watch the whole class.

06 — Interoperability

The twin speaks i3X, OPC UA, and Sparkplug.

The model that configures a device is the same model exported to your plant systems — a CESMII i3X server with writeback, an OPC UA NodeSet2 export, W3C WoT Thing Descriptions, and Sparkplug B into your Unified Namespace. That is a full page on its own.

See the interoperability surface

07 — Dashboards & alerting

Charts under the same session.

Anomaly & threshold rules

Rules defined per table and evaluated continuously, with detected anomalies queryable per table rather than only surfaced as a notification.

Device monitors with hysteresis

Offline devices, stale or rejected state, runtime faults and missing telemetry raise alerts with hysteresis, so a flapping link does not generate a pager storm.

Notification channels

Webhook, Slack, PagerDuty, email and SMS channels you can create, update and send a test through before trusting them. An SMS number is checked as E.164 when the channel is saved rather than when it is needed, and the provider credentials it sends through are encrypted at rest and never read back out.

Grafana under the same session

Charts served inside the platform under the same login, with identity forwarded. No second user directory to keep in sync and no separate sign-in.

Scheduled reports

Daily or weekly digests of any authored table, rendered as a summary with a CSV attached and delivered through the same notification channels your alerts use. A failed delivery is recorded against the schedule rather than silently retried into a gap.

Maintenance reminders

Recurring service tasks filed against the equipment rather than against the device bolted to it, due on a calendar interval, on a meter such as engine hours or odometer, or on whichever of the two comes first. Swapping the box on an asset does not take the asset's service history with it. A due item fires once per cycle through the same notification channels your alerts use — the last completion is latched, so a reminder that has already gone out does not go again on the next pass. An item can be filed on a device that is not on equipment yet, and if it triggers on a meter you are told at that point that the trigger cannot be evaluated until the device is placed and only the calendar interval applies.

Operational visibility

A metrics catalog, background job status, fleet engine status and infrastructure health, so the platform's own condition is inspectable rather than inferred.

Support bundles

A per-organization bundle that packages a problem together with its context, so a question can be handed over without a round of screenshots.

08 — Agent & MCP

An agent that asks before it acts.

The platform ships an operations agent and, separately, exposes itself as a tool surface your own assistants can call. Both are gated — nothing executes on your fleet because a model suggested it.

MCP server with scoped tokens

A first-class machine interface, not a chat window bolted on: typed resources and tools over the fleet, devices, the twin, telemetry tables, actions, monitors and dashboards, served from the same domain services the REST API and the app use, so authorization and tenancy cannot diverge between them. Access is an OAuth 2.1 server with PKCE, or an organization-scoped bearer token for unattended agents and CI — individually revocable either way.

Approval gates

The agent proposes and waits. Execution happens against an approval ID as a separate deliberate call — nothing runs on your fleet because a model suggested it.

Bring your own model

Configure your own model providers, run capability discovery against them, and select a default. The product remains fully operable with no agent at all.

Agents propose, people approve

An agent can draft a state definition, a Grafana alert rule or a dashboard and submit it, but the draft is a first-class reviewable object rather than a change. Approvals are their own resource, so an agent that is wrong is a rejected draft instead of an incident.

Native approval cards & deep linksIn development

Proposed actions rendered as native preview cards with links to the product object they act on, and long-running workflow milestones shown in the conversation.

Tokens are scoped, and read is separable from write. This is the whole list a machine token can carry — the platform’s other write scopes, over billing, partner tenants and integrations, cannot be delegated to one at all: mcp:readorg:readfleet:readdefinitions:readdeployments:readintegrations:readdata:readaudit:readdefinitions:write

09 — Your tenancy

Your organization is the boundary.

InnovaEdge is a managed cloud platform. Everything you put into it — devices, telemetry tables, dashboards, audit history — is scoped to your organization. Full trust-boundary, encryption, and disclosure detail lives on the security page; this is the summary.

Organization isolation

Every request resolves against your organization. Fleet, tables, charts and audit are scoped to it, each organization owns a stable physical telemetry namespace, and device ownership is fail-closed.

Native identity, SSO and MFA

Argon2id passwords, verified email, invitations, four roles, TOTP MFA, and OIDC single sign-on scoped to your organization so access follows the directory you already run.

Immutable audit stream

A per-organization audit event stream over the state-changing surface, plus failed authorization and failed sign-ins. Exportable as a support bundle.

Usage visibility

Broker messages, bytes, sink storage and active devices metered per organization and visible to you, so what you are billed for is something you can check rather than take on trust.

Scoped machine API keys

Long-lived keys for scripts and integrations, separate from login sessions. A key carries scopes that can only narrow the permissions of the person who issued it, is shown once and stored as a hash, so an integration credential can never quietly outrank its owner.

Enterprise SSO & passkeysPlanned

SCIM-style membership administration, enterprise SSO connectors and passkey authentication.

Full security & tenant isolation detail

10 — Partner & white-label

Resell it. Your customers see your brand.

If you sell to customers who need their own fleet, a customer organization is a full tenant beneath yours — the same isolation, under your name.

Customer tenants under your account

Create and manage customer organizations beneath your own. A tenant is an ordinary organization, so every isolation rule applies to it unchanged — there is no weaker "sub-account" path.

Pooled usage across your tenants

A tenant bills into your allowance by default, so device and asset consumption pools across your whole customer base and the volume floors apply to the total rather than to each tenant separately. A tenant can instead be set to bill on its own, which starts a separate pool.

Per-tenant quotas & suspension

Set a device ceiling per tenant, enforced at the single adoption choke-point so bulk import and auto-accept respect it too. Suspension takes effect at the next resolve, across every session and API key.

Brand inheritance

Product name, logo and accent set per organization; a tenant without its own branding inherits yours. Your customers see your product.

Inventory & device transfer

Adopt hardware into your own organization as inventory, then re-home a device to the customer tenant when it ships.

Custom domains & login brandingPlanned

A branded login page on your own domain, mapped to your organization.

11 — Build on top of it

If you are shipping your own product, stay in front of it.

OEMs generally do not want to hand their customers someone else’s console. InnovaEdge is built to sit underneath your product: it handles device config, ingest, parsing, and the data layer, and you build the application your customers actually log into. This section is integration framing, not a capability list — every capability it composes from is a badged entry in the sections above.

Your database

Sinks take a connection string and write telemetry into a database you own. The data lands in your infrastructure, in your schema, and stays there.

Your broker

Point the platform at your own MQTT broker — host, port, credentials, TLS — or run on the default until you have one.

Parsing done for you

CAN frames, OBD-II PIDs and tracker payloads are decoded and normalised into tables with real schema. Your application consumes structured telemetry rather than reimplementing a decoder per device family.

Join your own data

Link an external database as a catalog, keyed by device, so telemetry arrives already joined to the customer, asset, or contract record you already hold.

Read it from your app

Scoped OAuth tokens with read separated from write, table export, and per-table JSON — so your product reads the fleet over a documented API with credentials you can revoke.

Where the line sits

You own the customer-facing application, the branding, and the relationship. InnovaEdge stays the device and data layer behind it. We are not asking you to resell our console.

Where to go next

Pricing

Four tiers, the metered device floor, and what is included in each.

Supported devices

Which hardware is sovereign, native, bridged or telemetry-only — and which is not reached at all.

Interoperability

i3X, OPC UA NodeSet2 in and out, Sparkplug B egress and W3C WoT.

See it against your own fleet.

Demo access is granted after a short conversation — the platform runs real customer organizations, so we don’t hand out anonymous logins. Tell us what you operate and we’ll walk it live.

Every rate is published on the pricing page — four tiers and a metered device floor. Integrate and Ultimate are quoted from a published floor, because dedicated infrastructure is scoped per deployment.