Bluetooth Field Service
When a device is offline (a dead uplink, a changed Wi-Fi password, a misbehaving workload), a technician standing next to it can still diagnose and repair it from a browser over Bluetooth. Access is granted by Admiral Cloud according to the technician's permissions, and the device verifies it without needing a network connection.
Open the device in the dashboard and choose Repair over Bluetooth from the action menu (...). This opens https://app.admrl.co/devices/service locked to that device; connecting to a different device is refused.
Browser requirements are the same as Bluetooth provisioning: Chrome or Edge on desktop, or Chrome on Android.
The browser needs internet access only for a moment, to request a short-lived access token from Admiral Cloud when the session starts. The device itself can be completely offline.
What a Technician Can Do
What is available depends on the technician's permission on the device:
| Device permission | Access | Allows |
|---|---|---|
| Viewer | diag | Workload status, diagnostics. |
| Editor | diag, operate, network | Also: start, stop, restart, or recreate the workload; change Wi-Fi and Ethernet settings; control the device's screen. |
| Admin | diag, operate, network, admin | Also: reboot and power off. |
The session header shows the granted access, with Identify (makes the device beep) and Disconnect.
Tabs
- Overview: workload state, configuration, and version. With
operate: Start, Stop, Restart, Recreate, and Diagnostics mode, which keeps the workload stopped while you investigate. Viewers see Your access to this device is read-only. - Network (
network): the same Wi-Fi, Ethernet, static IP, and proxy settings as provisioning. Click Apply network settings. - Diagnostics (
diag): Run diagnostics checks network interfaces, gateway and DNS, reachability and latency to Admiral Cloud, clock drift, device identity and cloud session, Bluetooth, filesystems and crash logs, boot slot and Secure Boot state, and thermals. Results are grouped with pass, warning, and error markers. Copy puts the report on your clipboard; Show on device screen displays it on the device's own display. - Device screen (
operate): switch what the device's attached display shows: Overview, Details, Diagnostics, Wi-Fi, or Event log. On the standard console, Diagnostics and Wi-Fi open their screens, and the other three return the display to its main status screen. The new on-device console has a separate screen for each. - Power (
admin): Reboot or Power off, each with a confirmation.
How Access Works
- The browser connects to the device over an encrypted Bluetooth session and reads a one-time challenge.
- The browser asks Admiral Cloud for an access token. Admiral checks the technician's permission on the device and signs a token valid for five minutes, bound to that device, that Bluetooth session, and that challenge.
- The device verifies the token using keys it received the last time it was online. No network is needed.
A captured token is useless on any other connection, and every request inside the session is encrypted and replay-protected.
Session rules:
- One technician at a time. A session stays reserved for 30 seconds after its last request (the browser keeps it alive automatically), and disconnecting frees the device immediately.
- After five failed authentication attempts in a row, the device refuses new attempts for 60 seconds.
- A claimed device only advertises for field service after it has received its verification keys from Admiral Cloud.
- Factory resetting the device returns it to open, unclaimed setup mode.
API
POST /v1/devices/{deviceId}/access-token with {"nonce": "...", "client_public_key": "..."} returns token, expires_at, scopes, and key_id. This is used by the dashboard; the full Bluetooth exchange is described in BLE Provisioning Protocol.