Glossary

Names that differ between the dashboard and the API

Some things have one name in the dashboard and another in the API, the CLI, and the reference documentation. This is the single most common source of confusion when moving from clicking to scripting, so check here first.

The two alerting entries deserve care: Alerts and AI Alerting are separate systems with separate policies, conditions, and notification channels, backed by different services. See AI Alerting for which to use when.

Core concepts

Organization — Groups projects, and can nest inside another organization. Carries access, region policy, and which services descendants may enable, all of which are inherited downwards. See Organizations and projects.

Project — The unit of ownership and isolation. Holds devices, applications, secrets, metrics, and the role bindings governing them. Two projects share nothing by default.

Region — A geographic location in which resources are created. Part of a resource’s identity rather than a routing hint, so the same identifier in two regions is two different resources.

Resource name — The canonical, permanent identifier of a resource, built from alternating collection and identifier segments, such as projects/acme/regions/us-west2/devices/till-004. See Resource names.

Label — A user-defined key-value pair on a resource. Labels are how you segment a fleet: they drive deployment targeting, alert grouping, query filtering, and staged rollouts.

Devices

Device — One managed machine, represented by a resource in your project. The record persists across hardware replacement.

SPEKTRA Edge OS — The operating system image the platform manages end to end, including OS upgrades.

droplet agent — The agent that runs on a device, reconciles it against its desired configuration, and reports status. It can also be installed on your own Linux machine, in which case OS management is disabled. See Install the droplet agent.

Device type — The hardware family plus CPU architecture, which determines which OS images a device can run.

Provisioning policy — The reusable template deciding what a device becomes when it first connects: its acceptance mode, identity, name, and starting configuration. See Provisioning policies.

Zero-touch provisioning (ZTP) — Onboarding hardware without an administrator present, using pre-registered hardware records or a registration session. See Zero-touch provisioning.

Device hardware — A record of one physical machine’s identifying details (serial number, manufacturer, product), used to recognize expected hardware.

Registration session — A time-limited invitation letting a non-technical person register hardware by scanning QR codes. The link itself carries the authority.

Attestation — Cryptographic verification of a device’s identity, usually backed by a TPM. See TPM attestation.

Applications

Pod — A containerised workload on one device, defined by a Docker Compose recipe. Called an Application in the dashboard.

Distribution — A workload definition targeted at devices by label, which creates a pod on each matching device. Called a Pod template in the dashboard.

Config map — Non-sensitive configuration values, deliverable to a workload.

Secret — Encrypted key-value data, deliverable to a workload. Never replicated across regions. See Secrets.

Access

Principal — Anything that can make a call: a user, a service account, or a group.

Service account — An identity for automation or for a device, belonging to a project and region. See Service accounts.

Role — A named collection of permissions.

Role binding — Grants a role to a principal within a scope. Inherits downwards only, and is applied asynchronously, so a new binding takes a minute or two to take effect.

Condition — An additional constraint on a role binding, such as the IP ranges a caller must come from.

API key — A bearer token belonging to a service account key. Returned once at creation and never retrievable again.

Observability

Metric type — The identifier a metric is stored under, such as devices.edgelq.com/device/cpu/utilizationpercentage. See the metrics reference.

Metric descriptor — The definition of a metric: its kind, value type, unit, and labels.

Monitored resource — What a metric is measured against, such as devices.edgelq.com/device.

Time series — A sequence of measurements for one metric and one resource.

Alerting policy — A group of conditions and the notification channels to tell when they fire.

Notification channel — Where an alert is delivered: email, Slack, or a webhook.

Health check — A probe the device runs against itself or its surroundings, reported as a condition and a metric.

Platform

Limit — The ceiling on how many of a resource type a project may hold, in a region. Derived from the assigned plan and read-only. See Resource limits.

Business tier — The expected size of a project or organization, which determines its default limits.

Retention policy — How long metrics, logs, and audit records are kept.

Watch — A streaming subscription delivering a snapshot followed by changes as they happen, instead of polling. See Watching for changes.

Field mask — A list of field paths added to a read response on top of whatever the view already returns. See Reading resources.

Update mask — A list of field paths an update is allowed to change. Omitting it replaces the entire resource. See Errors and limits.

View — A named baseline set of fields in a response: NAME, BASIC, DETAIL, or FULL.

Compare-and-swap — Supplying the state you believe a resource is in so the server can reject your write if it has changed since you read it. Returns ABORTED when the comparison fails. See Errors and limits.

Resume token — An opaque marker from a STATELESS watch that lets a client reconnect and continue from where its stream broke, instead of restarting from a fresh snapshot. See Watching for changes.

isCurrent — The flag on a watch response marking the end of a batch. Buffer changes while it is false; apply the buffer when it is true. See Watching for changes.

Goten — The framework the platform’s services are generated from. You will see the name in API reference and error messages; it is not something you interact with directly unless you are building a service.