Live Objects - complete developer guide

Bootstrap Master Entry

Bootstrap Master Entries are an extension of Bootstrap Entries that can be used for a set of endpoints without having to provision credentials for each endpoint. They contain:

An ID to be used in the psk identity (see Endpoint Credentials)
The master secret from which the secrets used by endpoints to authenticate to the LwM2M Bootstrap server are derived (see Endpoint Credentials)
A link to a Bootstrap Config. The config must have useLiveObjects, renewSecurityOnBootstrap, and autoProvisionDeviceOnBootstrap.enabled set to true.
Information about past Bootstrap sessions of endpoints using this Bootstrap Master Entry

When an endpoint bootstraps using a Bootstrap Master Entry, a Bootstrap Entry is automatically created for that endpoint. See the bootstrap sequence for more information.

Example of a Bootstrap Master Entry:

{
  "id": "Kl77BbLBwh",
  "name": "My Master Entry",
  "security": {
    "mode": "PSK",
    "pskInfo": {
      "secret": "5adc592c900f4dae08dc7d68984bd262689f931c0329ceffe3ad374368f20708"
    }
  },
  "definition": {
    "bootstrapConfigId": "686287c6babc0e5f6fe43e8a"
  },
  "activity": {
    "bootstrapRequestCount": 1,
    "lastBootstrapRequestDate": "2025-06-30T12:56:44.182Z",
    "bootstrapFinishCount": 1,
    "lastBootstrapFinishDate": "2025-06-30T12:56:46.604Z"
  },
  "created": "2025-06-30T12:49:16.794Z",
  "updated": "2025-06-30T12:56:46.606Z"
}

Field	Description
id	(mandatory) The Bootstrap Master Entry ID. It is generated and must be used in endpoints PSK identity, see Endpoint Credentials.
name	(mandatory) The Bootstrap Master Entry name. It is user-defined.
security	(mandatory) The security information to authenticate to the LwM2M Bootstrap server.
security.mode	(mandatory) The security mode used to authenticate to the LwM2M Bootstrap server. PSK (Pre-Shared Key) is the only mode available currently.
security.pskInfo	(mandatory) The master Pre-Shared Key (PSK) information to authenticate to the LwM2M Bootstrap server. The endpoint PSK secret is derived from it, see Endpoint Credentials.
security.pskInfo.secret	(mandatory) The PSK master secret key, as a hex-encoded string. It is generated. See Endpoint Credentials
definition	(optional) The Bootstrap Config parameters for the endpoints (must be defined for the Bootstrap to work).
definition.bootstrapConfigId	(optional) The identifier of the Bootstrap Config to use for the endpoints (must be defined for the Bootstrap to work).
activity	(read only) Information about past Bootstrap sessions of endpoints using this Bootstrap Master Entry.
activity.bootstrapRequestCount	(read only) The number of times a Bootstrap sequence has been initiated (a Bootstrap-Request has been received by the LwM2M server).
activity.lastBootstrapRequestDate	(read only) The last time a Bootstrap sequence was initiated (a Bootstrap-Request has been received by the LwM2M server).
activity.bootstrapFinishCount	(read only) The number of times a Bootstrap sequence has been successfully completed (a Bootstrap-Finish has been sent by the LwM2M server).
activity.lastBootstrapFinishDate	(read only) The last time a Bootstrap sequence has been successfully completed (a Bootstrap-Finish has been sent by the LwM2M server).
created	(read only) Date on which the Bootstrap Master Entry was created.
updated	(read only) Date on which the Bootstrap Master Entry was last updated.

Field

Description

(mandatory) The Bootstrap Master Entry ID. It is generated and must be used in endpoints PSK identity, see Endpoint Credentials.

name

(mandatory) The Bootstrap Master Entry name. It is user-defined.

security

(mandatory) The security information to authenticate to the LwM2M Bootstrap server.

security.mode

(mandatory) The security mode used to authenticate to the LwM2M Bootstrap server. PSK (Pre-Shared Key) is the only mode available currently.

security.pskInfo

(mandatory) The master Pre-Shared Key (PSK) information to authenticate to the LwM2M Bootstrap server. The endpoint PSK secret is derived from it, see Endpoint Credentials.

security.pskInfo.secret

(mandatory) The PSK master secret key, as a hex-encoded string. It is generated. See Endpoint Credentials

definition

(optional) The Bootstrap Config parameters for the endpoints (must be defined for the Bootstrap to work).

definition.bootstrapConfigId

(optional) The identifier of the Bootstrap Config to use for the endpoints (must be defined for the Bootstrap to work).

activity

(read only) Information about past Bootstrap sessions of endpoints using this Bootstrap Master Entry.

activity.bootstrapRequestCount

(read only) The number of times a Bootstrap sequence has been initiated (a Bootstrap-Request has been received by the LwM2M server).

activity.lastBootstrapRequestDate

(read only) The last time a Bootstrap sequence was initiated (a Bootstrap-Request has been received by the LwM2M server).

activity.bootstrapFinishCount

(read only) The number of times a Bootstrap sequence has been successfully completed (a Bootstrap-Finish has been sent by the LwM2M server).

activity.lastBootstrapFinishDate

(read only) The last time a Bootstrap sequence has been successfully completed (a Bootstrap-Finish has been sent by the LwM2M server).

created

(read only) Date on which the Bootstrap Master Entry was created.

updated

(read only) Date on which the Bootstrap Master Entry was last updated.

Endpoint credentials

The PSK identity must have the following format:

<endpointName>@<masterEntryId>

Where:

endpointName: The endpoint name used in the Bootstrap Request.
masterEntryId: The Bootstrap Master Entry ID.

Replace <endpointName> and <masterEntryId> with your actual values (do not include the angle brackets).

Only alphanumeric characters (a-z, A-Z, 0-9) and special characters among : - _ are allowed in the endpointName.

The PSK secret is derived from the master secret and the endpoint name using HMAC-SHA256.

Example using openssl:

# ==================
# Linux
# ==================
endpointName=urn:android:device:9774d56d682e549c
masterSecret=efd9a6f6b82b9ecf8ef32cd08f681274e1cd17bfd2adc830d41d2d36d261b270

echo -n $endpointName | openssl dgst -sha256 -mac HMAC -macopt hexkey:$masterSecret

# ==================
# Windows (Commands)
# ==================
(echo|set /p="urn:android:device:9774d56d682e549c") | openssl dgst -sha256 -mac HMAC -macopt hexkey:efd9a6f6b82b9ecf8ef32cd08f681274e1cd17bfd2adc830d41d2d36d261b270


# Replace urn:android:device:9774d56d682e549c and efd9a6f6b82b9ecf8ef32cd08f681274e1cd17bfd2adc830d41d2d36d261b270 with your actual values

The derived secret with the example input values (in hexadecimal format):

e9a6992bd98f629d31cd12980fa1adaed011220cec2d81c2f59ae5ff07037f29

Where:

endpointName: The endpoint name used in the Bootstrap Request.
masterSecret: The Bootstrap Master Entry PSK secret, in hexadecimal format.