1. Create a Permission Group

A Permission Group is a named team of users. It can optionally be seeded with initial members, owners, company directory groups, and Permissions at creation time — or those can be added afterward via the endpoints below. Superuser only.

Request:

POST /qrms/permissionGroups

{
  "name": "Qualcomm IT Admins",
  "description": "Qualcomm's IT team managing their fleet",
  "userIds": ["alice@qualcomm.com"],
  "groups": ["qualcomm-it-team"],
  "ownerUserIds": ["alice@qualcomm.com"],
  "permissionIds": ["a1b2c3d4-e5f6-4a1b-8c2d-3e4f5a6b7c8d"]
}

Response (200):

{
  "id": "21aa2a81-a1dc-4963-82d5-ac2e157ee4fd",
  "name": "Qualcomm IT Admins",
  "description": "Qualcomm's IT team managing their fleet",
  "memberCount": 1,
  "userIds": null,
  "groups": ["qualcomm-it-team"],
  "createdOn": "2026-07-02T10:15:00.000Z",
  "createdBy": "superuser@example.com",
  "lastModifiedOn": "2026-07-02T10:15:00.000Z",
  "lastModifiedBy": "superuser@example.com",
  "ownerUserIds": null,
  "deviceGroupsInfo": null
}

Name rules: max 40 characters; letters, digits, spaces, -, _, . only; must be unique (case-insensitive).

All fields except name are optional — userIds, groups, ownerUserIds, and permissionIds can each be omitted and added later via the endpoints below. If ownerUserIds or permissionIds fail to apply after the group is created in UM, the whole operation is rolled back (owners/group deleted) and the original error is returned.

To list or search existing groups:

GET /qrms/permissionGroups?query=name_cnt:qualcomm

To fetch one group, including member/owner/device-group info:

GET /qrms/permissionGroups/{id}?expand=userIdsInfo,ownersInfo,deviceGroupsInfo

expand=userIdsInfo returns only the manually-added members (the userIds set directly on the group) — it does not include members synced in through a company directory group (see Add or Remove Company Directory Groups). Use GET /qrms/permissionGroups/{id}/members (below) to get the full membership list from both sources.

Combined update: PATCH /qrms/permissionGroups/{id} accepts name, description, userIds, groups, and ownerUserIds together in one call — userIds/groups are full replacements (not add/remove) when passed this way, and ownerUserIds behaves the same as "replace" on the owners endpoint. Use this when you want to set a group's full state atomically in one request; use the dedicated endpoints for members, directory groups, and owners when you want incremental add/remove semantics instead.

2. Delete a Permission Group

Superuser only. Deletes the group from UM and cleans up its Snapdragon Guardian-side records (owners, assigned Permissions, and Device Group scoping).

Request:

DELETE /qrms/permissionGroups/21aa2a81-a1dc-4963-82d5-ac2e157ee4fd

Response (200):

{
  "success": true
}

3. Add or Remove Members (Users) of a Permission Group

Members added this way are added directly by username/email. Superuser or existing group owner.

Request:

PATCH /qrms/permissionGroups/21aa2a81-a1dc-4963-82d5-ac2e157ee4fd/members

{
  "action": "add",
  "userIds": ["bob@qualcomm.com", "charlie@qualcomm.com"]
}

Response (200):

{
  "success": true
}

action also supports "remove" and "replace" (replace overwrites the full member list). Users that don't yet exist are auto-created on add; remove errors if the user isn't a member. To list current members:

GET /qrms/permissionGroups/{id}/members?pageNum=0&pageSize=50

Note: this endpoint only removes users added directly (manual userIds). A user synced in via a company directory group (see Add or Remove Company Directory Groups) can't be removed here — they must be removed from every directory group attached to the Permission Group that they belong to before they drop out of membership.

4. Add or Remove Company Directory Groups (e.g. Entra ID Groups)

Instead of (or in addition to) adding users individually, you can attach a company directory group by name — every current and future member of that directory group is synced into the Permission Group automatically. Superuser or existing group owner.

First, search for the directory group name:

GET /qrms/userGroups/qualcomm-it*

Then attach it:

Request:

PATCH /qrms/permissionGroups/21aa2a81-a1dc-4963-82d5-ac2e157ee4fd/groups

{
  "action": "add",
  "groupNames": ["qualcomm-it-team"]
}

Response (200):

{
  "success": true
}

A user can be a member through both an individual userIds entry and a directory groupNames entry at the same time. They remain a member as long as at least one source still includes them.

5. Add or Remove Owners of a Permission Group

An Owner can manage the group's name/description, members, and other owners — without needing full Superuser access. Being an Owner does not grant device access; add the same user via Add or Remove Members if they also need to be a member. Superuser or existing group owner.

Request:

PATCH /qrms/permissionGroups/21aa2a81-a1dc-4963-82d5-ac2e157ee4fd/owners

{
  "action": "add",
  "userIds": ["bob@qualcomm.com"]
}

Response (200):

{
  "success": true
}

action also supports "remove" and "replace". To list current owners:

GET /qrms/permissionGroups/{id}/owners

{
  "permissionGroupId": "21aa2a81-a1dc-4963-82d5-ac2e157ee4fd",
  "ownerUserIds": ["alice@qualcomm.com", "bob@qualcomm.com"]
}

See Known Issues / Limitations for a workaround needed when adding an owner who doesn't already exist in Snapdragon Guardian.

6. Assign or Remove Permissions on a Permission Group

Links a Permission (created under Access Control Setup) to a Permission Group, granting its members those Authorities on the group's scoped Device Groups. Superuser only.

Request:

PATCH /qrms/permissionGroups/21aa2a81-a1dc-4963-82d5-ac2e157ee4fd/permissions

{
  "action": "add",
  "permissionIds": ["a1b2c3d4-e5f6-4a1b-8c2d-3e4f5a6b7c8d"]
}

Response (200):

{
  "success": true
}

action also supports "remove". To list Permissions currently assigned to a group:

GET /qrms/permissionGroups/{id}/permissions

7. Create a Device Group

A Device Group is a collection of devices, managed in DM. Devices can optionally be added at creation time. Superuser only.

Request:

POST /qrms/deviceGroups?moveDevices=true

{
  "name": "TEST_SCOPE_GROUP_AAA",
  "description": "TEST_SCOPE_GROUP_AAA",
  "deviceIds": ["Device_G"],
  "deviceIdType": "DSN"
}

Response (200):

{
  "id": "2be7416f-b024-44f3-a9e8-3d3e814e0bce",
  "name": "TEST_SCOPE_GROUP_AAA",
  "description": "TEST_SCOPE_GROUP_AAA",
  "deviceCount": 1
}

deviceIds, productType, deviceType, and deviceIdType are all optional — omit deviceIds to create an empty group and add devices later (see Add Devices to a Device Group). deviceIdType can be DSN or UUID (defaults to UUID if omitted). Pass ?moveDevices=true on the query string if any of the devices being added already belong to another Device Group — otherwise the request fails for devices that are already assigned elsewhere.

8. Delete a Device Group

Superuser only. Deletes the group from DM and cleans up Snapdragon Guardian-side records (Permission Group scoping) for it.

Request:

DELETE /qrms/deviceGroups/2be7416f-b024-44f3-a9e8-3d3e814e0bce

Response (200):

{
  "success": true
}

9. Assign a Permission Group to a Device Group

Without this, the group's members cannot see or act on any devices. Superuser only.

Request:

PATCH /qrms/deviceGroups/{deviceGroupId}/permissionGroups

{
  "action": "add",
  "permissionGroupIds": ["21aa2a81-a1dc-4963-82d5-ac2e157ee4fd"]
}

Response (200):

{
  "success": true
}

action also supports "remove" and "replace" (replace overwrites the full list of scoped Permission Groups for this Device Group). To check current scoping:

GET /qrms/deviceGroups/{deviceGroupId}/permissionGroups

{
  "deviceGroupId": "2be7416f-b024-44f3-a9e8-3d3e814e0bce",
  "permissionGroupIds": ["21aa2a81-a1dc-4963-82d5-ac2e157ee4fd"]
}

10. Add Devices to a Device Group

Newly enrolled devices are not assigned to any Device Group by default and are only visible to Superusers until assigned. Use PATCH /qrms/deviceGroups/{id} to add devices to a group (Superuser only); the same endpoint also renames the group or removes devices.

Request:

PATCH /qrms/deviceGroups/2be7416f-b024-44f3-a9e8-3d3e814e0bce?moveDevices=true

{
  "action": "add",
  "deviceIds": ["Device_G", "Device_H"],
  "deviceIdType": "DSN"
}

Response (200):

{
  "id": "2be7416f-b024-44f3-a9e8-3d3e814e0bce",
  "name": "TEST_SCOPE_GROUP_AAA",
  "description": "TEST_SCOPE_GROUP_AAA",
  "deviceCount": 3
}

action also supports "remove" and "replace". deviceIdType can be DSN (serial-style external identifier) or UUID (defaults to UUID if omitted). Pass moveDevices=true on the query string if any of the devices being added already belong to another Device Group — otherwise the request fails for devices that are already assigned elsewhere.