> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fased.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# devices

# `fased devices`

Manage device pairing requests and device-scoped tokens for gateway access.

## Commands

### `fased devices list`

List pending pairing requests and paired devices.

```
fased devices list
fased devices list --json
```

### `fased devices remove <deviceId>`

Remove one paired device entry.

```
fased devices remove <deviceId>
fased devices remove <deviceId> --json
```

### `fased devices clear --yes [--pending]`

Clear paired devices in bulk.

```
fased devices clear --yes
fased devices clear --yes --pending
fased devices clear --yes --pending --json
```

### `fased devices approve [requestId] [--latest]`

Approve a pending device pairing request. If `requestId` is omitted, Fased
automatically approves the most recent pending request.

```
fased devices approve
fased devices approve <requestId>
fased devices approve --latest
```

### `fased devices reject <requestId>`

Reject a pending device pairing request.

```
fased devices reject <requestId>
```

### `fased devices rotate --device <id> --role <role> [--scope <scope...>]`

Rotate a device token for a specific role (optionally updating scopes).

```
fased devices rotate --device <deviceId> --role operator --scope operator.read --scope operator.write
```

The command prints the new token result as JSON. Treat the returned token as a
secret.

### `fased devices revoke --device <id> --role <role>`

Revoke a device token for a specific role.

```
fased devices revoke --device <deviceId> --role node
```

## Common options

* `--url <url>`: Gateway WebSocket URL. Defaults to `gateway.remote.url` when
  configured.
* `--token <token>`: Gateway token (if required).
* `--password <password>`: Gateway password (password auth).
* `--timeout <ms>`: RPC timeout.
* `--json`: JSON output (recommended for scripting).

Note: when you set `--url`, the CLI requires explicit credentials for that
target. Pass `--token` or `--password` explicitly. Missing explicit credentials
is an error.

## Notes

* These commands require `operator.pairing` (or `operator.admin`) scope.
* `devices clear` is intentionally gated by `--yes`.
* If pairing scope is unavailable on local loopback and no explicit `--url` is
  passed, list/approve can use a local pairing fallback.