> ## Documentation Index
> Fetch the complete documentation index at: https://docs.industrialpmr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & Authorization

> Obtaining and utilizing API tokens for secure programmatic integration.

Industrial PMR secures all RESTful endpoints, Cloud Functions, and WebSocket interfaces using token-based authentication.

***

## Authenticating Requests

Include your access token in the `Authorization` header of every HTTP request:

```bash theme={null}
curl -X GET "https://rest-middleware-01.industrialpmr.com/time" \
  -H "Authorization: Bearer <YOUR_ACCESS_TOKEN>" \
  -H "Accept: application/json"
```

***

## Authentication Flow

```mermaid theme={null}
sequenceDiagram
    autonumber
    actor Client as Integration Client / ERP
    participant Auth as Industrial PMR Auth Service
    participant API as REST Middleware Gateway

    Client->>Auth: POST /auth/login (email & password)
    Auth->>Auth: Validate user credentials & permissions
    Auth-->>Client: Returns JWT Token & authorized factory list
    Client->>API: GET /machines (with Bearer Token header)
    API->>API: Verify token signature & factory scope
    API-->>Client: Returns 200 OK with machine data
```

***

## Token Lifecycle & Security

* **Token Expiration**: Access tokens are valid for 24 hours from issuance.
* **Scope Isolation**: Tokens are scoped strictly to the user's assigned factories and department permissions.
* **Role Enforcement**:
  * `admin`: Can perform write actions, reconfigure edge hardware, and manage users.
  * `supervisor`: Can create/close targets, categorize downtime, and trigger shift reports.
  * `viewer`: Read-only access to telemetry streams.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.