iot

application/src/main/java/org/thingsboard/server/controller/SystemInfoController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiOperation;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.info.BuildProperties;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import springfox.documentation.annotations.ApiIgnore;
+
+import javax.annotation.PostConstruct;
+
+@ApiIgnore
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+@Slf4j
+public class SystemInfoController {
+
+    @Autowired(required = false)
+    private BuildProperties buildProperties;
+
+    @PostConstruct
+    public void init() {
+        JsonNode info = buildInfoObject();
+        log.info("System build info: {}", info);
+    }
+
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/system/info", method = RequestMethod.GET)
+    @ResponseBody
+    public JsonNode getSystemVersionInfo() {
+        return buildInfoObject();
+    }
+
+    private JsonNode buildInfoObject() {
+        ObjectMapper objectMapper = new ObjectMapper();
+        ObjectNode infoObject = objectMapper.createObjectNode();
+        if (buildProperties != null) {
+            infoObject.put("version", buildProperties.getVersion());
+            infoObject.put("artifact", buildProperties.getArtifact());
+            infoObject.put("name", buildProperties.getName());
+        } else {
+            infoObject.put("version", "unknown");
+        }
+        return infoObject;
+    }
+}

application/src/main/java/org/thingsboard/server/controller/TbResourceController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.TbResource;
+import org.thingsboard.server.common.data.TbResourceInfo;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.TbResourceId;
+import org.thingsboard.server.common.data.lwm2m.LwM2mObject;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.resource.TbResourceService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+
+import java.util.Base64;
+import java.util.List;
+
+import static org.thingsboard.server.controller.ControllerConstants.LWM2M_OBJECT_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.LWM2M_OBJECT_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_DATA_PARAMETERS;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_NUMBER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_SIZE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.RESOURCE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.RESOURCE_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.RESOURCE_INFO_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.RESOURCE_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.RESOURCE_TEXT_SEARCH_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERTY_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.UUID_WIKI_LINK;
+
+@Slf4j
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+@RequiredArgsConstructor
+public class TbResourceController extends BaseController {
+
+    private final TbResourceService tbResourceService;
+
+    public static final String RESOURCE_ID = "resourceId";
+
+    @ApiOperation(value = "Download Resource (downloadResource)", notes = "Download Resource based on the provided Resource Id." + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/resource/{resourceId}/download", method = RequestMethod.GET)
+    @ResponseBody
+    public ResponseEntity<org.springframework.core.io.Resource> downloadResource(@ApiParam(value = RESOURCE_ID_PARAM_DESCRIPTION)
+                                                                                 @PathVariable(RESOURCE_ID) String strResourceId) throws ThingsboardException {
+        checkParameter(RESOURCE_ID, strResourceId);
+        try {
+            TbResourceId resourceId = new TbResourceId(toUUID(strResourceId));
+            TbResource tbResource = checkResourceId(resourceId, Operation.READ);
+
+            ByteArrayResource resource = new ByteArrayResource(Base64.getDecoder().decode(tbResource.getData().getBytes()));
+            return ResponseEntity.ok()
+                    .header(HttpHeaders.CONTENT_DISPOSITION, "attachment;filename=" + tbResource.getFileName())
+                    .header("x-filename", tbResource.getFileName())
+                    .contentLength(resource.contentLength())
+                    .contentType(MediaType.APPLICATION_OCTET_STREAM)
+                    .body(resource);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Resource Info (getResourceInfoById)",
+            notes = "Fetch the Resource Info object based on the provided Resource Id. " +
+                    RESOURCE_INFO_DESCRIPTION + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH,
+            produces = "application/json")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/resource/info/{resourceId}", method = RequestMethod.GET)
+    @ResponseBody
+    public TbResourceInfo getResourceInfoById(@ApiParam(value = RESOURCE_ID_PARAM_DESCRIPTION)
+                                              @PathVariable(RESOURCE_ID) String strResourceId) throws ThingsboardException {
+        checkParameter(RESOURCE_ID, strResourceId);
+        try {
+            TbResourceId resourceId = new TbResourceId(toUUID(strResourceId));
+            return checkResourceInfoId(resourceId, Operation.READ);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Resource (getResourceById)",
+            notes = "Fetch the Resource object based on the provided Resource Id. " +
+                    RESOURCE_DESCRIPTION + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH,
+            produces = "application/json")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/resource/{resourceId}", method = RequestMethod.GET)
+    @ResponseBody
+    public TbResource getResourceById(@ApiParam(value = RESOURCE_ID_PARAM_DESCRIPTION)
+                                      @PathVariable(RESOURCE_ID) String strResourceId) throws ThingsboardException {
+        checkParameter(RESOURCE_ID, strResourceId);
+        try {
+            TbResourceId resourceId = new TbResourceId(toUUID(strResourceId));
+            return checkResourceId(resourceId, Operation.READ);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Create Or Update Resource (saveResource)",
+            notes = "Create or update the Resource. When creating the Resource, platform generates Resource id as " + UUID_WIKI_LINK +
+                    "The newly created Resource id will be present in the response. " +
+                    "Specify existing Resource id to update the Resource. " +
+                    "Referencing non-existing Resource Id will cause 'Not Found' error. " +
+                    "\n\nResource combination of the title with the key is unique in the scope of tenant. " +
+                    "Remove 'id', 'tenantId' from the request body example (below) to create new Resource entity." +
+                    SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH,
+            produces = "application/json",
+            consumes = "application/json")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/resource", method = RequestMethod.POST)
+    @ResponseBody
+    public TbResource saveResource(@ApiParam(value = "A JSON value representing the Resource.")
+                                   @RequestBody TbResource resource) throws Exception {
+        resource.setTenantId(getTenantId());
+        checkEntity(resource.getId(), resource, Resource.TB_RESOURCE);
+        return tbResourceService.save(resource, getCurrentUser());
+    }
+
+    @ApiOperation(value = "Get Resource Infos (getResources)",
+            notes = "Returns a page of Resource Info objects owned by tenant or sysadmin. " +
+                    PAGE_DATA_PARAMETERS + RESOURCE_INFO_DESCRIPTION + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH,
+            produces = "application/json")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/resource", method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<TbResourceInfo> getResources(@ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+                                                 @RequestParam int pageSize,
+                                                 @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+                                                 @RequestParam int page,
+                                                 @ApiParam(value = RESOURCE_TEXT_SEARCH_DESCRIPTION)
+                                                 @RequestParam(required = false) String textSearch,
+                                                 @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = RESOURCE_SORT_PROPERTY_ALLOWABLE_VALUES)
+                                                 @RequestParam(required = false) String sortProperty,
+                                                 @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+                                                 @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            if (Authority.SYS_ADMIN.equals(getCurrentUser().getAuthority())) {
+                return checkNotNull(resourceService.findTenantResourcesByTenantId(getTenantId(), pageLink));
+            } else {
+                return checkNotNull(resourceService.findAllTenantResourcesByTenantId(getTenantId(), pageLink));
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get LwM2M Objects (getLwm2mListObjectsPage)",
+            notes = "Returns a page of LwM2M objects parsed from Resources with type 'LWM2M_MODEL' owned by tenant or sysadmin. " +
+                    PAGE_DATA_PARAMETERS + LWM2M_OBJECT_DESCRIPTION + TENANT_AUTHORITY_PARAGRAPH,
+            produces = "application/json")
+    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
+    @RequestMapping(value = "/resource/lwm2m/page", method = RequestMethod.GET)
+    @ResponseBody
+    public List<LwM2mObject> getLwm2mListObjectsPage(@ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+                                                     @RequestParam int pageSize,
+                                                     @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+                                                     @RequestParam int page,
+                                                     @ApiParam(value = RESOURCE_TEXT_SEARCH_DESCRIPTION)
+                                                     @RequestParam(required = false) String textSearch,
+                                                     @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = LWM2M_OBJECT_SORT_PROPERTY_ALLOWABLE_VALUES)
+                                                     @RequestParam(required = false) String sortProperty,
+                                                     @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+                                                     @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = new PageLink(pageSize, page, textSearch);
+            return checkNotNull(resourceService.findLwM2mObjectPage(getTenantId(), sortProperty, sortOrder, pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get LwM2M Objects (getLwm2mListObjects)",
+            notes = "Returns a page of LwM2M objects parsed from Resources with type 'LWM2M_MODEL' owned by tenant or sysadmin. " +
+                    "You can specify parameters to filter the results. " + LWM2M_OBJECT_DESCRIPTION + TENANT_AUTHORITY_PARAGRAPH,
+            produces = "application/json")
+    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
+    @RequestMapping(value = "/resource/lwm2m", method = RequestMethod.GET)
+    @ResponseBody
+    public List<LwM2mObject> getLwm2mListObjects(@ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES, required = true)
+                                                 @RequestParam String sortOrder,
+                                                 @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = LWM2M_OBJECT_SORT_PROPERTY_ALLOWABLE_VALUES, required = true)
+                                                 @RequestParam String sortProperty,
+                                                 @ApiParam(value = "LwM2M Object ids.", required = true)
+                                                 @RequestParam(required = false) String[] objectIds) throws ThingsboardException {
+        try {
+            return checkNotNull(resourceService.findLwM2mObject(getTenantId(), sortOrder, sortProperty, objectIds));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Delete Resource (deleteResource)",
+            notes = "Deletes the Resource. Referencing non-existing Resource Id will cause an error." + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/resource/{resourceId}", method = RequestMethod.DELETE)
+    @ResponseBody
+    public void deleteResource(@ApiParam(value = RESOURCE_ID_PARAM_DESCRIPTION)
+                               @PathVariable("resourceId") String strResourceId) throws ThingsboardException {
+        checkParameter(RESOURCE_ID, strResourceId);
+        TbResourceId resourceId = new TbResourceId(toUUID(strResourceId));
+        TbResource tbResource = checkResourceId(resourceId, Operation.DELETE);
+        tbResourceService.delete(tbResource, getCurrentUser());
+    }
+}
\ No newline at end of file

application/src/main/java/org/thingsboard/server/controller/TbUrlConstants.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+/**
+ * Created by ashvayka on 17.05.18.
+ */
+public class TbUrlConstants {
+    public static final String TELEMETRY_URL_PREFIX = "/api/plugins/telemetry";
+    public static final String RPC_V1_URL_PREFIX = "/api/plugins/rpc";
+    public static final String RPC_V2_URL_PREFIX = "/api/rpc";
+}

application/src/main/java/org/thingsboard/server/controller/TelemetryController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.google.common.base.Function;
+import com.google.common.util.concurrent.FutureCallback;
+import com.google.common.util.concurrent.Futures;
+import com.google.common.util.concurrent.ListenableFuture;
+import com.google.common.util.concurrent.MoreExecutors;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonParseException;
+import com.google.gson.JsonParser;
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import io.swagger.annotations.ApiResponse;
+import io.swagger.annotations.ApiResponses;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.context.request.async.DeferredResult;
+import org.thingsboard.common.util.JacksonUtil;
+import org.thingsboard.common.util.ThingsBoardThreadFactory;
+import org.thingsboard.rule.engine.api.msg.DeviceAttributesEventNotificationMsg;
+import org.thingsboard.server.common.data.DataConstants;
+import org.thingsboard.server.common.data.EntityType;
+import org.thingsboard.server.common.data.StringUtils;
+import org.thingsboard.server.common.data.TenantProfile;
+import org.thingsboard.server.common.data.audit.ActionType;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.DeviceId;
+import org.thingsboard.server.common.data.id.EntityId;
+import org.thingsboard.server.common.data.id.EntityIdFactory;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UUIDBased;
+import org.thingsboard.server.common.data.kv.Aggregation;
+import org.thingsboard.server.common.data.kv.AttributeKey;
+import org.thingsboard.server.common.data.kv.AttributeKvEntry;
+import org.thingsboard.server.common.data.kv.BaseAttributeKvEntry;
+import org.thingsboard.server.common.data.kv.BaseDeleteTsKvQuery;
+import org.thingsboard.server.common.data.kv.BaseReadTsKvQuery;
+import org.thingsboard.server.common.data.kv.BasicTsKvEntry;
+import org.thingsboard.server.common.data.kv.BooleanDataEntry;
+import org.thingsboard.server.common.data.kv.DataType;
+import org.thingsboard.server.common.data.kv.DeleteTsKvQuery;
+import org.thingsboard.server.common.data.kv.DoubleDataEntry;
+import org.thingsboard.server.common.data.kv.JsonDataEntry;
+import org.thingsboard.server.common.data.kv.KvEntry;
+import org.thingsboard.server.common.data.kv.LongDataEntry;
+import org.thingsboard.server.common.data.kv.ReadTsKvQuery;
+import org.thingsboard.server.common.data.kv.StringDataEntry;
+import org.thingsboard.server.common.data.kv.TsKvEntry;
+import org.thingsboard.server.common.data.tenant.profile.DefaultTenantProfileConfiguration;
+import org.thingsboard.server.common.transport.adaptor.JsonConverter;
+import org.thingsboard.server.dao.service.ConstraintValidator;
+import org.thingsboard.server.dao.timeseries.TimeseriesService;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.AccessValidator;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.telemetry.AttributeData;
+import org.thingsboard.server.service.telemetry.TsData;
+import org.thingsboard.server.service.telemetry.exception.InvalidParametersException;
+import org.thingsboard.server.service.telemetry.exception.UncheckedApiException;
+
+import javax.annotation.Nullable;
+import javax.annotation.PostConstruct;
+import javax.annotation.PreDestroy;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+import static org.thingsboard.server.controller.ControllerConstants.ATTRIBUTES_JSON_REQUEST_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.ATTRIBUTES_KEYS_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.ATTRIBUTES_SCOPE_ALLOWED_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.ATTRIBUTES_SCOPE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.ATTRIBUTE_DATA_EXAMPLE;
+import static org.thingsboard.server.controller.ControllerConstants.DEVICE_ID;
+import static org.thingsboard.server.controller.ControllerConstants.DEVICE_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.ENTITY_ATTRIBUTE_SCOPES;
+import static org.thingsboard.server.controller.ControllerConstants.ENTITY_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.ENTITY_TYPE_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.INVALID_STRUCTURE_OF_THE_REQUEST;
+import static org.thingsboard.server.controller.ControllerConstants.LATEST_TS_NON_STRICT_DATA_EXAMPLE;
+import static org.thingsboard.server.controller.ControllerConstants.LATEST_TS_STRICT_DATA_EXAMPLE;
+import static org.thingsboard.server.controller.ControllerConstants.MARKDOWN_CODE_BLOCK_END;
+import static org.thingsboard.server.controller.ControllerConstants.MARKDOWN_CODE_BLOCK_START;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ATTIRIBUTES_STATUS_BAD_REQUEST;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ATTIRIBUTES_STATUS_OK;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ATTRIBUTES_REQUEST_PAYLOAD;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ENTITY_ATTRIBUTES_STATUS_INTERNAL_SERVER_ERROR;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ENTITY_ATTRIBUTES_STATUS_OK;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ENTITY_ATTRIBUTES_STATUS_UNAUTHORIZED;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ENTITY_TIMESERIES_STATUS_INTERNAL_SERVER_ERROR;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ENTITY_TIMESERIES_STATUS_OK;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_ENTITY_TIMESERIES_STATUS_UNAUTHORIZED;
+import static org.thingsboard.server.controller.ControllerConstants.SAVE_TIMESERIES_REQUEST_PAYLOAD;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.STRICT_DATA_TYPES_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TELEMETRY_JSON_REQUEST_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TELEMETRY_KEYS_BASE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TELEMETRY_KEYS_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TELEMETRY_SCOPE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.TS_STRICT_DATA_EXAMPLE;
+
+
+/**
+ * Created by ashvayka on 22.03.18.
+ */
+@RestController
+@TbCoreComponent
+@RequestMapping(TbUrlConstants.TELEMETRY_URL_PREFIX)
+@Slf4j
+public class TelemetryController extends BaseController {
+
+    @Autowired
+    private TimeseriesService tsService;
+
+    @Autowired
+    private AccessValidator accessValidator;
+
+    @Value("${transport.json.max_string_value_length:0}")
+    private int maxStringValueLength;
+
+    private ExecutorService executor;
+
+    @PostConstruct
+    public void initExecutor() {
+        executor = Executors.newSingleThreadExecutor(ThingsBoardThreadFactory.forName("telemetry-controller"));
+    }
+
+    @PreDestroy
+    public void shutdownExecutor() {
+        if (executor != null) {
+            executor.shutdownNow();
+        }
+    }
+
+    @ApiOperation(value = "Get all attribute keys (getAttributeKeys)",
+            notes = "Returns a set of unique attribute key names for the selected entity. " +
+                    "The response will include merged key names set for all attribute scopes:" +
+                    "\n\n * SERVER_SCOPE - supported for all entity types;" +
+                    "\n * CLIENT_SCOPE - supported for devices;" +
+                    "\n * SHARED_SCOPE - supported for devices. "
+                    + "\n\n" + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/keys/attributes", method = RequestMethod.GET)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getAttributeKeys(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr) throws ThingsboardException {
+        try {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr, this::getAttributeKeysCallback);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get all attribute keys by scope (getAttributeKeysByScope)",
+            notes = "Returns a set of unique attribute key names for the selected entity and attributes scope: " +
+                    "\n\n * SERVER_SCOPE - supported for all entity types;" +
+                    "\n * CLIENT_SCOPE - supported for devices;" +
+                    "\n * SHARED_SCOPE - supported for devices. "
+                    + "\n\n" + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/keys/attributes/{scope}", method = RequestMethod.GET)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getAttributeKeysByScope(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, required = true, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES) @PathVariable("scope") String scope) throws ThingsboardException {
+        try {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr,
+                    (result, tenantId, entityId) -> getAttributeKeysCallback(result, tenantId, entityId, scope));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get attributes (getAttributes)",
+            notes = "Returns all attributes that belong to specified entity. Use optional 'keys' parameter to return specific attributes."
+                    + "\n Example of the result: \n\n"
+                    + MARKDOWN_CODE_BLOCK_START
+                    + ATTRIBUTE_DATA_EXAMPLE
+                    + MARKDOWN_CODE_BLOCK_END
+                    + "\n\n " + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/values/attributes", method = RequestMethod.GET)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getAttributes(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = ATTRIBUTES_KEYS_DESCRIPTION) @RequestParam(name = "keys", required = false) String keysStr) throws ThingsboardException {
+        try {
+            SecurityUser user = getCurrentUser();
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr,
+                    (result, tenantId, entityId) -> getAttributeValuesCallback(result, user, entityId, null, keysStr));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+
+    @ApiOperation(value = "Get attributes by scope (getAttributesByScope)",
+            notes = "Returns all attributes of a specified scope that belong to specified entity." +
+                    ENTITY_ATTRIBUTE_SCOPES +
+                    "Use optional 'keys' parameter to return specific attributes."
+                    + "\n Example of the result: \n\n"
+                    + MARKDOWN_CODE_BLOCK_START
+                    + ATTRIBUTE_DATA_EXAMPLE
+                    + MARKDOWN_CODE_BLOCK_END
+                    + "\n\n " + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/values/attributes/{scope}", method = RequestMethod.GET)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getAttributesByScope(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES, required = true) @PathVariable("scope") String scope,
+            @ApiParam(value = ATTRIBUTES_KEYS_DESCRIPTION) @RequestParam(name = "keys", required = false) String keysStr) throws ThingsboardException {
+        try {
+            SecurityUser user = getCurrentUser();
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_ATTRIBUTES, entityType, entityIdStr,
+                    (result, tenantId, entityId) -> getAttributeValuesCallback(result, user, entityId, scope, keysStr));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get time-series keys (getTimeseriesKeys)",
+            notes = "Returns a set of unique time-series key names for the selected entity. " +
+                    "\n\n" + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/keys/timeseries", method = RequestMethod.GET)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getTimeseriesKeys(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr) throws ThingsboardException {
+        try {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_TELEMETRY, entityType, entityIdStr,
+                    (result, tenantId, entityId) -> Futures.addCallback(tsService.findAllLatest(tenantId, entityId), getTsKeysToResponseCallback(result), MoreExecutors.directExecutor()));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get latest time-series value (getLatestTimeseries)",
+            notes = "Returns all time-series that belong to specified entity. Use optional 'keys' parameter to return specific time-series." +
+                    " The result is a JSON object. The format of the values depends on the 'useStrictDataTypes' parameter." +
+                    " By default, all time-series values are converted to strings: \n\n"
+                    + MARKDOWN_CODE_BLOCK_START
+                    + LATEST_TS_NON_STRICT_DATA_EXAMPLE
+                    + MARKDOWN_CODE_BLOCK_END
+                    + "\n\n However, it is possible to request the values without conversion ('useStrictDataTypes'=true): \n\n"
+                    + MARKDOWN_CODE_BLOCK_START
+                    + LATEST_TS_STRICT_DATA_EXAMPLE
+                    + MARKDOWN_CODE_BLOCK_END
+                    + "\n\n " + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/values/timeseries", method = RequestMethod.GET)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getLatestTimeseries(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = TELEMETRY_KEYS_DESCRIPTION) @RequestParam(name = "keys", required = false) String keysStr,
+            @ApiParam(value = STRICT_DATA_TYPES_DESCRIPTION)
+            @RequestParam(name = "useStrictDataTypes", required = false, defaultValue = "false") Boolean useStrictDataTypes) throws ThingsboardException {
+        try {
+            SecurityUser user = getCurrentUser();
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_TELEMETRY, entityType, entityIdStr,
+                    (result, tenantId, entityId) -> getLatestTimeseriesValuesCallback(result, user, entityId, keysStr, useStrictDataTypes));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get time-series data (getTimeseries)",
+            notes = "Returns a range of time-series values for specified entity. " +
+                    "Returns not aggregated data by default. " +
+                    "Use aggregation function ('agg') and aggregation interval ('interval') to enable aggregation of the results on the database / server side. " +
+                    "The aggregation is generally more efficient then fetching all records. \n\n"
+                    + MARKDOWN_CODE_BLOCK_START
+                    + TS_STRICT_DATA_EXAMPLE
+                    + MARKDOWN_CODE_BLOCK_END
+                    + "\n\n" + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/values/timeseries", method = RequestMethod.GET, params = {"keys", "startTs", "endTs"})
+    @ResponseBody
+    public DeferredResult<ResponseEntity> getTimeseries(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = TELEMETRY_KEYS_BASE_DESCRIPTION, required = true) @RequestParam(name = "keys") String keys,
+            @ApiParam(value = "A long value representing the start timestamp of the time range in milliseconds, UTC.")
+            @RequestParam(name = "startTs") Long startTs,
+            @ApiParam(value = "A long value representing the end timestamp of the time range in milliseconds, UTC.")
+            @RequestParam(name = "endTs") Long endTs,
+            @ApiParam(value = "A long value representing the aggregation interval range in milliseconds.")
+            @RequestParam(name = "interval", defaultValue = "0") Long interval,
+            @ApiParam(value = "An integer value that represents a max number of timeseries data points to fetch." +
+                    " This parameter is used only in the case if 'agg' parameter is set to 'NONE'.", defaultValue = "100")
+            @RequestParam(name = "limit", defaultValue = "100") Integer limit,
+            @ApiParam(value = "A string value representing the aggregation function. " +
+                    "If the interval is not specified, 'agg' parameter will use 'NONE' value.",
+                    allowableValues = "MIN, MAX, AVG, SUM, COUNT, NONE")
+            @RequestParam(name = "agg", defaultValue = "NONE") String aggStr,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(name = "orderBy", defaultValue = "DESC") String orderBy,
+            @ApiParam(value = STRICT_DATA_TYPES_DESCRIPTION)
+            @RequestParam(name = "useStrictDataTypes", required = false, defaultValue = "false") Boolean useStrictDataTypes) throws ThingsboardException {
+        try {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.READ_TELEMETRY, entityType, entityIdStr,
+                    (result, tenantId, entityId) -> {
+                        // If interval is 0, convert this to a NONE aggregation, which is probably what the user really wanted
+                        Aggregation agg = interval == 0L ? Aggregation.valueOf(Aggregation.NONE.name()) : Aggregation.valueOf(aggStr);
+                        List<ReadTsKvQuery> queries = toKeysList(keys).stream().map(key -> new BaseReadTsKvQuery(key, startTs, endTs, interval, limit, agg, orderBy))
+                                .collect(Collectors.toList());
+
+                        Futures.addCallback(tsService.findAll(tenantId, entityId, queries), getTsKvListCallback(result, useStrictDataTypes), MoreExecutors.directExecutor());
+                    });
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Save device attributes (saveDeviceAttributes)",
+            notes = "Creates or updates the device attributes based on device id and specified attribute scope. " +
+                    SAVE_ATTRIBUTES_REQUEST_PAYLOAD
+                    + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = SAVE_ATTIRIBUTES_STATUS_OK +
+                    "Platform creates an audit log event about device attributes updates with action type 'ATTRIBUTES_UPDATED', " +
+                    "and also sends event msg to the rule engine with msg type 'ATTRIBUTES_UPDATED'."),
+            @ApiResponse(code = 400, message = SAVE_ATTIRIBUTES_STATUS_BAD_REQUEST),
+            @ApiResponse(code = 401, message = "User is not authorized to save device attributes for selected device. Most likely, User belongs to different Customer or Tenant."),
+            @ApiResponse(code = 500, message = "The exception was thrown during processing the request. " +
+                    "Platform creates an audit log event about device attributes updates with action type 'ATTRIBUTES_UPDATED' that includes an error stacktrace."),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{deviceId}/{scope}", method = RequestMethod.POST)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> saveDeviceAttributes(
+            @ApiParam(value = DEVICE_ID_PARAM_DESCRIPTION, required = true) @PathVariable("deviceId") String deviceIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES, required = true) @PathVariable("scope") String scope,
+            @ApiParam(value = ATTRIBUTES_JSON_REQUEST_DESCRIPTION, required = true) @RequestBody JsonNode request) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndUuid(EntityType.DEVICE, deviceIdStr);
+            return saveAttributes(getTenantId(), entityId, scope, request);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Save entity attributes (saveEntityAttributesV1)",
+            notes = "Creates or updates the entity attributes based on Entity Id and the specified attribute scope. " +
+                    ENTITY_ATTRIBUTE_SCOPES +
+                    SAVE_ATTRIBUTES_REQUEST_PAYLOAD
+                    + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = SAVE_ATTIRIBUTES_STATUS_OK + SAVE_ENTITY_ATTRIBUTES_STATUS_OK),
+            @ApiResponse(code = 400, message = SAVE_ATTIRIBUTES_STATUS_BAD_REQUEST),
+            @ApiResponse(code = 401, message = SAVE_ENTITY_ATTRIBUTES_STATUS_UNAUTHORIZED),
+            @ApiResponse(code = 500, message = SAVE_ENTITY_ATTRIBUTES_STATUS_INTERNAL_SERVER_ERROR),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/{scope}", method = RequestMethod.POST)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> saveEntityAttributesV1(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES) @PathVariable("scope") String scope,
+            @ApiParam(value = ATTRIBUTES_JSON_REQUEST_DESCRIPTION, required = true) @RequestBody JsonNode request) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(entityType, entityIdStr);
+            return saveAttributes(getTenantId(), entityId, scope, request);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Save entity attributes (saveEntityAttributesV2)",
+            notes = "Creates or updates the entity attributes based on Entity Id and the specified attribute scope. " +
+                    ENTITY_ATTRIBUTE_SCOPES +
+                    SAVE_ATTRIBUTES_REQUEST_PAYLOAD
+                    + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = SAVE_ATTIRIBUTES_STATUS_OK + SAVE_ENTITY_ATTRIBUTES_STATUS_OK),
+            @ApiResponse(code = 400, message = SAVE_ATTIRIBUTES_STATUS_BAD_REQUEST),
+            @ApiResponse(code = 401, message = SAVE_ENTITY_ATTRIBUTES_STATUS_UNAUTHORIZED),
+            @ApiResponse(code = 500, message = SAVE_ENTITY_ATTRIBUTES_STATUS_INTERNAL_SERVER_ERROR),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/attributes/{scope}", method = RequestMethod.POST)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> saveEntityAttributesV2(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES, required = true) @PathVariable("scope") String scope,
+            @ApiParam(value = ATTRIBUTES_JSON_REQUEST_DESCRIPTION, required = true) @RequestBody JsonNode request) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(entityType, entityIdStr);
+            return saveAttributes(getTenantId(), entityId, scope, request);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+
+    @ApiOperation(value = "Save or update time-series data (saveEntityTelemetry)",
+            notes = "Creates or updates the entity time-series data based on the Entity Id and request payload." +
+                    SAVE_TIMESERIES_REQUEST_PAYLOAD +
+                    "\n\n The scope parameter is not used in the API call implementation but should be specified whatever value because it is used as a path variable. "
+                    + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = SAVE_ENTITY_TIMESERIES_STATUS_OK),
+            @ApiResponse(code = 400, message = INVALID_STRUCTURE_OF_THE_REQUEST),
+            @ApiResponse(code = 401, message = SAVE_ENTITY_TIMESERIES_STATUS_UNAUTHORIZED),
+            @ApiResponse(code = 500, message = SAVE_ENTITY_TIMESERIES_STATUS_INTERNAL_SERVER_ERROR),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/timeseries/{scope}", method = RequestMethod.POST)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> saveEntityTelemetry(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = TELEMETRY_SCOPE_DESCRIPTION, required = true, allowableValues = "ANY") @PathVariable("scope") String scope,
+            @ApiParam(value = TELEMETRY_JSON_REQUEST_DESCRIPTION, required = true) @RequestBody String requestBody) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(entityType, entityIdStr);
+            return saveTelemetry(getTenantId(), entityId, requestBody, 0L);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Save or update time-series data with TTL (saveEntityTelemetryWithTTL)",
+            notes = "Creates or updates the entity time-series data based on the Entity Id and request payload." +
+                    SAVE_TIMESERIES_REQUEST_PAYLOAD +
+                    "\n\n The scope parameter is not used in the API call implementation but should be specified whatever value because it is used as a path variable. "
+                    + "\n\nThe ttl parameter takes affect only in case of Cassandra DB."
+                    + INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = SAVE_ENTITY_TIMESERIES_STATUS_OK),
+            @ApiResponse(code = 400, message = INVALID_STRUCTURE_OF_THE_REQUEST),
+            @ApiResponse(code = 401, message = SAVE_ENTITY_TIMESERIES_STATUS_UNAUTHORIZED),
+            @ApiResponse(code = 500, message = SAVE_ENTITY_TIMESERIES_STATUS_INTERNAL_SERVER_ERROR),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/timeseries/{scope}/{ttl}", method = RequestMethod.POST)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> saveEntityTelemetryWithTTL(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = TELEMETRY_SCOPE_DESCRIPTION, required = true, allowableValues = "ANY") @PathVariable("scope") String scope,
+            @ApiParam(value = "A long value representing TTL (Time to Live) parameter.", required = true) @PathVariable("ttl") Long ttl,
+            @ApiParam(value = TELEMETRY_JSON_REQUEST_DESCRIPTION, required = true) @RequestBody String requestBody) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(entityType, entityIdStr);
+            return saveTelemetry(getTenantId(), entityId, requestBody, ttl);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Delete entity time-series data (deleteEntityTimeseries)",
+            notes = "Delete time-series for selected entity based on entity id, entity type and keys." +
+                    " Use 'deleteAllDataForKeys' to delete all time-series data." +
+                    " Use 'startTs' and 'endTs' to specify time-range instead. " +
+                    " Use 'rewriteLatestIfDeleted' to rewrite latest value (stored in separate table for performance) after deletion of the time range. " +
+                    TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = "Timeseries for the selected keys in the request was removed. " +
+                    "Platform creates an audit log event about entity timeseries removal with action type 'TIMESERIES_DELETED'."),
+            @ApiResponse(code = 400, message = "Platform returns a bad request in case if keys list is empty or start and end timestamp values is empty when deleteAllDataForKeys is set to false."),
+            @ApiResponse(code = 401, message = "User is not authorized to delete entity timeseries for selected entity. Most likely, User belongs to different Customer or Tenant."),
+            @ApiResponse(code = 500, message = "The exception was thrown during processing the request. " +
+                    "Platform creates an audit log event about entity timeseries removal with action type 'TIMESERIES_DELETED' that includes an error stacktrace."),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/timeseries/delete", method = RequestMethod.DELETE)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> deleteEntityTimeseries(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = TELEMETRY_KEYS_DESCRIPTION, required = true) @RequestParam(name = "keys") String keysStr,
+            @ApiParam(value = "A boolean value to specify if should be deleted all data for selected keys or only data that are in the selected time range.")
+            @RequestParam(name = "deleteAllDataForKeys", defaultValue = "false") boolean deleteAllDataForKeys,
+            @ApiParam(value = "A long value representing the start timestamp of removal time range in milliseconds.")
+            @RequestParam(name = "startTs", required = false) Long startTs,
+            @ApiParam(value = "A long value representing the end timestamp of removal time range in milliseconds.")
+            @RequestParam(name = "endTs", required = false) Long endTs,
+            @ApiParam(value = "If the parameter is set to true, the latest telemetry will be rewritten in case that current latest value was removed, otherwise, in case that parameter is set to false the new latest value will not set.")
+            @RequestParam(name = "rewriteLatestIfDeleted", defaultValue = "false") boolean rewriteLatestIfDeleted) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(entityType, entityIdStr);
+            return deleteTimeseries(entityId, keysStr, deleteAllDataForKeys, startTs, endTs, rewriteLatestIfDeleted);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    private DeferredResult<ResponseEntity> deleteTimeseries(EntityId entityIdStr, String keysStr, boolean deleteAllDataForKeys,
+                                                            Long startTs, Long endTs, boolean rewriteLatestIfDeleted) throws ThingsboardException {
+        List<String> keys = toKeysList(keysStr);
+        if (keys.isEmpty()) {
+            return getImmediateDeferredResult("Empty keys: " + keysStr, HttpStatus.BAD_REQUEST);
+        }
+        SecurityUser user = getCurrentUser();
+
+        long deleteFromTs;
+        long deleteToTs;
+        if (deleteAllDataForKeys) {
+            deleteFromTs = 0L;
+            deleteToTs = System.currentTimeMillis();
+        } else {
+            if (startTs == null || endTs == null) {
+                return getImmediateDeferredResult("When deleteAllDataForKeys is false, start and end timestamp values shouldn't be empty", HttpStatus.BAD_REQUEST);
+            } else {
+                deleteFromTs = startTs;
+                deleteToTs = endTs;
+            }
+        }
+
+        return accessValidator.validateEntityAndCallback(user, Operation.WRITE_TELEMETRY, entityIdStr, (result, tenantId, entityId) -> {
+            List<DeleteTsKvQuery> deleteTsKvQueries = new ArrayList<>();
+            for (String key : keys) {
+                deleteTsKvQueries.add(new BaseDeleteTsKvQuery(key, deleteFromTs, deleteToTs, rewriteLatestIfDeleted));
+            }
+            tsSubService.deleteTimeseriesAndNotify(tenantId, entityId, keys, deleteTsKvQueries, new FutureCallback<>() {
+                @Override
+                public void onSuccess(@Nullable Void tmp) {
+                    logTimeseriesDeleted(user, entityId, keys, deleteFromTs, deleteToTs, null);
+                    result.setResult(new ResponseEntity<>(HttpStatus.OK));
+                }
+
+                @Override
+                public void onFailure(Throwable t) {
+                    logTimeseriesDeleted(user, entityId, keys, deleteFromTs, deleteToTs, t);
+                    result.setResult(new ResponseEntity<>(HttpStatus.INTERNAL_SERVER_ERROR));
+                }
+            });
+        });
+    }
+
+    @ApiOperation(value = "Delete device attributes (deleteDeviceAttributes)",
+            notes = "Delete device attributes using provided Device Id, scope and a list of keys. " +
+                    "Referencing a non-existing Device Id will cause an error" + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = "Device attributes was removed for the selected keys in the request. " +
+                    "Platform creates an audit log event about device attributes removal with action type 'ATTRIBUTES_DELETED'."),
+            @ApiResponse(code = 400, message = "Platform returns a bad request in case if keys or scope are not specified."),
+            @ApiResponse(code = 401, message = "User is not authorized to delete device attributes for selected entity. Most likely, User belongs to different Customer or Tenant."),
+            @ApiResponse(code = 500, message = "The exception was thrown during processing the request. " +
+                    "Platform creates an audit log event about device attributes removal with action type 'ATTRIBUTES_DELETED' that includes an error stacktrace."),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{deviceId}/{scope}", method = RequestMethod.DELETE)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> deleteDeviceAttributes(
+            @ApiParam(value = DEVICE_ID_PARAM_DESCRIPTION, required = true) @PathVariable(DEVICE_ID) String deviceIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES, required = true) @PathVariable("scope") String scope,
+            @ApiParam(value = ATTRIBUTES_KEYS_DESCRIPTION, required = true) @RequestParam(name = "keys") String keysStr) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndUuid(EntityType.DEVICE, deviceIdStr);
+            return deleteAttributes(entityId, scope, keysStr);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Delete entity attributes (deleteEntityAttributes)",
+            notes = "Delete entity attributes using provided Entity Id, scope and a list of keys. " +
+                    INVALID_ENTITY_ID_OR_ENTITY_TYPE_DESCRIPTION + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH,
+            produces = MediaType.APPLICATION_JSON_VALUE)
+    @ApiResponses(value = {
+            @ApiResponse(code = 200, message = "Entity attributes was removed for the selected keys in the request. " +
+                    "Platform creates an audit log event about entity attributes removal with action type 'ATTRIBUTES_DELETED'."),
+            @ApiResponse(code = 400, message = "Platform returns a bad request in case if keys or scope are not specified."),
+            @ApiResponse(code = 401, message = "User is not authorized to delete entity attributes for selected entity. Most likely, User belongs to different Customer or Tenant."),
+            @ApiResponse(code = 500, message = "The exception was thrown during processing the request. " +
+                    "Platform creates an audit log event about entity attributes removal with action type 'ATTRIBUTES_DELETED' that includes an error stacktrace."),
+    })
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/{entityType}/{entityId}/{scope}", method = RequestMethod.DELETE)
+    @ResponseBody
+    public DeferredResult<ResponseEntity> deleteEntityAttributes(
+            @ApiParam(value = ENTITY_TYPE_PARAM_DESCRIPTION, required = true, defaultValue = "DEVICE") @PathVariable("entityType") String entityType,
+            @ApiParam(value = ENTITY_ID_PARAM_DESCRIPTION, required = true) @PathVariable("entityId") String entityIdStr,
+            @ApiParam(value = ATTRIBUTES_SCOPE_DESCRIPTION, required = true, allowableValues = ATTRIBUTES_SCOPE_ALLOWED_VALUES) @PathVariable("scope") String scope,
+            @ApiParam(value = ATTRIBUTES_KEYS_DESCRIPTION, required = true) @RequestParam(name = "keys") String keysStr) throws ThingsboardException {
+        try {
+            EntityId entityId = EntityIdFactory.getByTypeAndId(entityType, entityIdStr);
+            return deleteAttributes(entityId, scope, keysStr);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    private DeferredResult<ResponseEntity> deleteAttributes(EntityId entityIdSrc, String scope, String keysStr) throws ThingsboardException {
+        List<String> keys = toKeysList(keysStr);
+        if (keys.isEmpty()) {
+            return getImmediateDeferredResult("Empty keys: " + keysStr, HttpStatus.BAD_REQUEST);
+        }
+        SecurityUser user = getCurrentUser();
+
+        if (DataConstants.SERVER_SCOPE.equals(scope) ||
+                DataConstants.SHARED_SCOPE.equals(scope) ||
+                DataConstants.CLIENT_SCOPE.equals(scope)) {
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.WRITE_ATTRIBUTES, entityIdSrc, (result, tenantId, entityId) -> {
+                tsSubService.deleteAndNotify(tenantId, entityId, scope, keys, new FutureCallback<Void>() {
+                    @Override
+                    public void onSuccess(@Nullable Void tmp) {
+                        logAttributesDeleted(user, entityId, scope, keys, null);
+                        if (entityIdSrc.getEntityType().equals(EntityType.DEVICE)) {
+                            DeviceId deviceId = new DeviceId(entityId.getId());
+                            tbClusterService.pushMsgToCore(DeviceAttributesEventNotificationMsg.onDelete(
+                                    user.getTenantId(), deviceId, scope, keys), null);
+                        }
+                        result.setResult(new ResponseEntity<>(HttpStatus.OK));
+                    }
+
+                    @Override
+                    public void onFailure(Throwable t) {
+                        logAttributesDeleted(user, entityId, scope, keys, t);
+                        result.setResult(new ResponseEntity<>(HttpStatus.INTERNAL_SERVER_ERROR));
+                    }
+                });
+            });
+        } else {
+            return getImmediateDeferredResult("Invalid attribute scope: " + scope, HttpStatus.BAD_REQUEST);
+        }
+    }
+
+    private DeferredResult<ResponseEntity> saveAttributes(TenantId srcTenantId, EntityId entityIdSrc, String scope, JsonNode json) throws ThingsboardException {
+        if (!DataConstants.SERVER_SCOPE.equals(scope) && !DataConstants.SHARED_SCOPE.equals(scope)) {
+            return getImmediateDeferredResult("Invalid scope: " + scope, HttpStatus.BAD_REQUEST);
+        }
+        if (json.isObject()) {
+            List<AttributeKvEntry> attributes = extractRequestAttributes(json);
+            attributes.forEach(ConstraintValidator::validateFields);
+            if (attributes.isEmpty()) {
+                return getImmediateDeferredResult("No attributes data found in request body!", HttpStatus.BAD_REQUEST);
+            }
+            for (AttributeKvEntry attributeKvEntry : attributes) {
+                if (attributeKvEntry.getKey().isEmpty() || attributeKvEntry.getKey().trim().length() == 0) {
+                    return getImmediateDeferredResult("Key cannot be empty or contains only spaces", HttpStatus.BAD_REQUEST);
+                }
+            }
+            SecurityUser user = getCurrentUser();
+            return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.WRITE_ATTRIBUTES, entityIdSrc, (result, tenantId, entityId) -> {
+                tsSubService.saveAndNotify(tenantId, entityId, scope, attributes, new FutureCallback<Void>() {
+                    @Override
+                    public void onSuccess(@Nullable Void tmp) {
+                        logAttributesUpdated(user, entityId, scope, attributes, null);
+                        result.setResult(new ResponseEntity(HttpStatus.OK));
+                    }
+
+                    @Override
+                    public void onFailure(Throwable t) {
+                        logAttributesUpdated(user, entityId, scope, attributes, t);
+                        AccessValidator.handleError(t, result, HttpStatus.INTERNAL_SERVER_ERROR);
+                    }
+                });
+            });
+        } else {
+            return getImmediateDeferredResult("Request is not a JSON object", HttpStatus.BAD_REQUEST);
+        }
+    }
+
+    private DeferredResult<ResponseEntity> saveTelemetry(TenantId curTenantId, EntityId entityIdSrc, String requestBody, long ttl) throws ThingsboardException {
+        Map<Long, List<KvEntry>> telemetryRequest;
+        JsonElement telemetryJson;
+        try {
+            telemetryJson = new JsonParser().parse(requestBody);
+        } catch (Exception e) {
+            return getImmediateDeferredResult("Unable to parse timeseries payload: Invalid JSON body!", HttpStatus.BAD_REQUEST);
+        }
+        try {
+            telemetryRequest = JsonConverter.convertToTelemetry(telemetryJson, System.currentTimeMillis());
+        } catch (Exception e) {
+            return getImmediateDeferredResult("Unable to parse timeseries payload. Invalid JSON body: " + e.getMessage(), HttpStatus.BAD_REQUEST);
+        }
+        List<TsKvEntry> entries = new ArrayList<>();
+        for (Map.Entry<Long, List<KvEntry>> entry : telemetryRequest.entrySet()) {
+            for (KvEntry kv : entry.getValue()) {
+                entries.add(new BasicTsKvEntry(entry.getKey(), kv));
+            }
+        }
+        if (entries.isEmpty()) {
+            return getImmediateDeferredResult("No timeseries data found in request body!", HttpStatus.BAD_REQUEST);
+        }
+        SecurityUser user = getCurrentUser();
+        return accessValidator.validateEntityAndCallback(getCurrentUser(), Operation.WRITE_TELEMETRY, entityIdSrc, (result, tenantId, entityId) -> {
+            long tenantTtl = ttl;
+            if (!TenantId.SYS_TENANT_ID.equals(tenantId) && tenantTtl == 0) {
+                TenantProfile tenantProfile = tenantProfileCache.get(tenantId);
+                tenantTtl = TimeUnit.DAYS.toSeconds(((DefaultTenantProfileConfiguration) tenantProfile.getProfileData().getConfiguration()).getDefaultStorageTtlDays());
+            }
+            tsSubService.saveAndNotify(tenantId, user.getCustomerId(), entityId, entries, tenantTtl, new FutureCallback<Void>() {
+                @Override
+                public void onSuccess(@Nullable Void tmp) {
+                    logTelemetryUpdated(user, entityId, entries, null);
+                    result.setResult(new ResponseEntity(HttpStatus.OK));
+                }
+
+                @Override
+                public void onFailure(Throwable t) {
+                    logTelemetryUpdated(user, entityId, entries, t);
+                    AccessValidator.handleError(t, result, HttpStatus.INTERNAL_SERVER_ERROR);
+                }
+            });
+        });
+    }
+
+    private void getLatestTimeseriesValuesCallback(@Nullable DeferredResult<ResponseEntity> result, SecurityUser user, EntityId entityId, String keys, Boolean useStrictDataTypes) {
+        ListenableFuture<List<TsKvEntry>> future;
+        if (StringUtils.isEmpty(keys)) {
+            future = tsService.findAllLatest(user.getTenantId(), entityId);
+        } else {
+            future = tsService.findLatest(user.getTenantId(), entityId, toKeysList(keys));
+        }
+        Futures.addCallback(future, getTsKvListCallback(result, useStrictDataTypes), MoreExecutors.directExecutor());
+    }
+
+    private void getAttributeValuesCallback(@Nullable DeferredResult<ResponseEntity> result, SecurityUser user, EntityId entityId, String scope, String keys) {
+        List<String> keyList = toKeysList(keys);
+        FutureCallback<List<AttributeKvEntry>> callback = getAttributeValuesToResponseCallback(result, user, scope, entityId, keyList);
+        if (!StringUtils.isEmpty(scope)) {
+            if (keyList != null && !keyList.isEmpty()) {
+                Futures.addCallback(attributesService.find(user.getTenantId(), entityId, scope, keyList), callback, MoreExecutors.directExecutor());
+            } else {
+                Futures.addCallback(attributesService.findAll(user.getTenantId(), entityId, scope), callback, MoreExecutors.directExecutor());
+            }
+        } else {
+            List<ListenableFuture<List<AttributeKvEntry>>> futures = new ArrayList<>();
+            for (String tmpScope : DataConstants.allScopes()) {
+                if (keyList != null && !keyList.isEmpty()) {
+                    futures.add(attributesService.find(user.getTenantId(), entityId, tmpScope, keyList));
+                } else {
+                    futures.add(attributesService.findAll(user.getTenantId(), entityId, tmpScope));
+                }
+            }
+
+            ListenableFuture<List<AttributeKvEntry>> future = mergeAllAttributesFutures(futures);
+
+            Futures.addCallback(future, callback, MoreExecutors.directExecutor());
+        }
+    }
+
+    private void getAttributeKeysCallback(@Nullable DeferredResult<ResponseEntity> result, TenantId tenantId, EntityId entityId, String scope) {
+        Futures.addCallback(attributesService.findAll(tenantId, entityId, scope), getAttributeKeysToResponseCallback(result), MoreExecutors.directExecutor());
+    }
+
+    private void getAttributeKeysCallback(@Nullable DeferredResult<ResponseEntity> result, TenantId tenantId, EntityId entityId) {
+        List<ListenableFuture<List<AttributeKvEntry>>> futures = new ArrayList<>();
+        for (String scope : DataConstants.allScopes()) {
+            futures.add(attributesService.findAll(tenantId, entityId, scope));
+        }
+
+        ListenableFuture<List<AttributeKvEntry>> future = mergeAllAttributesFutures(futures);
+
+        Futures.addCallback(future, getAttributeKeysToResponseCallback(result), MoreExecutors.directExecutor());
+    }
+
+    private FutureCallback<List<TsKvEntry>> getTsKeysToResponseCallback(final DeferredResult<ResponseEntity> response) {
+        return new FutureCallback<>() {
+            @Override
+            public void onSuccess(List<TsKvEntry> values) {
+                List<String> keys = values.stream().map(KvEntry::getKey).collect(Collectors.toList());
+                response.setResult(new ResponseEntity<>(keys, HttpStatus.OK));
+            }
+
+            @Override
+            public void onFailure(Throwable e) {
+                log.error("Failed to fetch attributes", e);
+                AccessValidator.handleError(e, response, HttpStatus.INTERNAL_SERVER_ERROR);
+            }
+        };
+    }
+
+    private FutureCallback<List<AttributeKvEntry>> getAttributeKeysToResponseCallback(final DeferredResult<ResponseEntity> response) {
+        return new FutureCallback<List<AttributeKvEntry>>() {
+
+            @Override
+            public void onSuccess(List<AttributeKvEntry> attributes) {
+                List<String> keys = attributes.stream().map(KvEntry::getKey).collect(Collectors.toList());
+                response.setResult(new ResponseEntity<>(keys, HttpStatus.OK));
+            }
+
+            @Override
+            public void onFailure(Throwable e) {
+                log.error("Failed to fetch attributes", e);
+                AccessValidator.handleError(e, response, HttpStatus.INTERNAL_SERVER_ERROR);
+            }
+        };
+    }
+
+    private FutureCallback<List<AttributeKvEntry>> getAttributeValuesToResponseCallback(final DeferredResult<ResponseEntity> response,
+                                                                                        final SecurityUser user, final String scope,
+                                                                                        final EntityId entityId, final List<String> keyList) {
+        return new FutureCallback<>() {
+            @Override
+            public void onSuccess(List<AttributeKvEntry> attributes) {
+                List<AttributeData> values = attributes.stream().map(attribute ->
+                        new AttributeData(attribute.getLastUpdateTs(), attribute.getKey(), getKvValue(attribute))
+                ).collect(Collectors.toList());
+                logAttributesRead(user, entityId, scope, keyList, null);
+                response.setResult(new ResponseEntity<>(values, HttpStatus.OK));
+            }
+
+            @Override
+            public void onFailure(Throwable e) {
+                log.error("Failed to fetch attributes", e);
+                logAttributesRead(user, entityId, scope, keyList, e);
+                AccessValidator.handleError(e, response, HttpStatus.INTERNAL_SERVER_ERROR);
+            }
+        };
+    }
+
+    private FutureCallback<List<TsKvEntry>> getTsKvListCallback(final DeferredResult<ResponseEntity> response, Boolean useStrictDataTypes) {
+        return new FutureCallback<>() {
+            @Override
+            public void onSuccess(List<TsKvEntry> data) {
+                Map<String, List<TsData>> result = new LinkedHashMap<>();
+                for (TsKvEntry entry : data) {
+                    Object value = useStrictDataTypes ? getKvValue(entry) : entry.getValueAsString();
+                    result.computeIfAbsent(entry.getKey(), k -> new ArrayList<>()).add(new TsData(entry.getTs(), value));
+                }
+                response.setResult(new ResponseEntity<>(result, HttpStatus.OK));
+            }
+
+            @Override
+            public void onFailure(Throwable e) {
+                log.error("Failed to fetch historical data", e);
+                AccessValidator.handleError(e, response, HttpStatus.INTERNAL_SERVER_ERROR);
+            }
+        };
+    }
+
+    private void logTimeseriesDeleted(SecurityUser user, EntityId entityId, List<String> keys, long startTs, long endTs, Throwable e) {
+        notificationEntityService.logEntityAction(user.getTenantId(), entityId, ActionType.TIMESERIES_DELETED, user,
+                toException(e), keys, startTs, endTs);
+    }
+
+    private void logTelemetryUpdated(SecurityUser user, EntityId entityId, List<TsKvEntry> telemetry, Throwable e) {
+        notificationEntityService.logEntityAction(user.getTenantId(), entityId, ActionType.TIMESERIES_UPDATED, user,
+                toException(e), telemetry);
+    }
+
+    private void logAttributesDeleted(SecurityUser user, EntityId entityId, String scope, List<String> keys, Throwable e) {
+        notificationEntityService.logEntityAction(user.getTenantId(), (UUIDBased & EntityId) entityId,
+                ActionType.ATTRIBUTES_DELETED, user, toException(e), scope, keys);
+    }
+
+    private void logAttributesUpdated(SecurityUser user, EntityId entityId, String scope, List<AttributeKvEntry> attributes, Throwable e) {
+        notificationEntityService.logEntityAction(user.getTenantId(), entityId, ActionType.ATTRIBUTES_UPDATED, user,
+                toException(e), scope, attributes);
+    }
+
+
+    private void logAttributesRead(SecurityUser user, EntityId entityId, String scope, List<String> keys, Throwable e) {
+        notificationEntityService.logEntityAction(user.getTenantId(), entityId, ActionType.ATTRIBUTES_READ, user,
+                toException(e), scope, keys);
+    }
+
+    private ListenableFuture<List<AttributeKvEntry>> mergeAllAttributesFutures(List<ListenableFuture<List<AttributeKvEntry>>> futures) {
+        return Futures.transform(Futures.successfulAsList(futures),
+                (Function<? super List<List<AttributeKvEntry>>, ? extends List<AttributeKvEntry>>) input -> {
+                    List<AttributeKvEntry> tmp = new ArrayList<>();
+                    if (input != null) {
+                        input.forEach(tmp::addAll);
+                    }
+                    return tmp;
+                }, executor);
+    }
+
+    private List<String> toKeysList(String keys) {
+        List<String> keyList = null;
+        if (!StringUtils.isEmpty(keys)) {
+            keyList = Arrays.asList(keys.split(","));
+        }
+        return keyList;
+    }
+
+    private DeferredResult<ResponseEntity> getImmediateDeferredResult(String message, HttpStatus status) {
+        DeferredResult<ResponseEntity> result = new DeferredResult<>();
+        result.setResult(new ResponseEntity<>(message, status));
+        return result;
+    }
+
+    private List<AttributeKvEntry> extractRequestAttributes(JsonNode jsonNode) {
+        long ts = System.currentTimeMillis();
+        List<AttributeKvEntry> attributes = new ArrayList<>();
+        jsonNode.fields().forEachRemaining(entry -> {
+            String key = entry.getKey();
+            JsonNode value = entry.getValue();
+            if (entry.getValue().isObject() || entry.getValue().isArray()) {
+                attributes.add(new BaseAttributeKvEntry(new JsonDataEntry(key, toJsonStr(value)), ts));
+            } else if (entry.getValue().isTextual()) {
+                if (maxStringValueLength > 0 && entry.getValue().textValue().length() > maxStringValueLength) {
+                    String message = String.format("String value length [%d] for key [%s] is greater than maximum allowed [%d]", entry.getValue().textValue().length(), key, maxStringValueLength);
+                    throw new UncheckedApiException(new InvalidParametersException(message));
+                }
+                attributes.add(new BaseAttributeKvEntry(new StringDataEntry(key, value.textValue()), ts));
+            } else if (entry.getValue().isBoolean()) {
+                attributes.add(new BaseAttributeKvEntry(new BooleanDataEntry(key, value.booleanValue()), ts));
+            } else if (entry.getValue().isDouble()) {
+                attributes.add(new BaseAttributeKvEntry(new DoubleDataEntry(key, value.doubleValue()), ts));
+            } else if (entry.getValue().isNumber()) {
+                if (entry.getValue().isBigInteger()) {
+                    throw new UncheckedApiException(new InvalidParametersException("Big integer values are not supported!"));
+                } else {
+                    attributes.add(new BaseAttributeKvEntry(new LongDataEntry(key, value.longValue()), ts));
+                }
+            }
+        });
+        return attributes;
+    }
+
+    private String toJsonStr(JsonNode value) {
+        try {
+            return JacksonUtil.toString(value);
+        } catch (IllegalArgumentException e) {
+            throw new JsonParseException("Can't parse jsonValue: " + value, e);
+        }
+    }
+
+    private JsonNode toJsonNode(String value) {
+        try {
+            return JacksonUtil.toJsonNode(value);
+        } catch (IllegalArgumentException e) {
+            throw new JsonParseException("Can't parse jsonValue: " + value, e);
+        }
+    }
+
+    private Object getKvValue(KvEntry entry) {
+        if (entry.getDataType() == DataType.JSON) {
+            return toJsonNode(entry.getJsonValue().get());
+        }
+        return entry.getValue();
+    }
+}

application/src/main/java/org/thingsboard/server/controller/TenantController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.Tenant;
+import org.thingsboard.server.common.data.TenantInfo;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.dao.tenant.TenantService;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.entitiy.tenant.TbTenantService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+
+import static org.thingsboard.server.controller.ControllerConstants.HOME_DASHBOARD;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_DATA_PARAMETERS;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_NUMBER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_SIZE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERTY_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_ID;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_INFO_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_TEXT_SEARCH_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.UUID_WIKI_LINK;
+
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+@Slf4j
+@RequiredArgsConstructor
+public class TenantController extends BaseController {
+
+    private static final String TENANT_INFO_DESCRIPTION = "The Tenant Info object extends regular Tenant object and includes Tenant Profile name. ";
+
+    private final TenantService tenantService;
+    private final TbTenantService tbTenantService;
+
+    @ApiOperation(value = "Get Tenant (getTenantById)",
+            notes = "Fetch the Tenant object based on the provided Tenant Id. " + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/tenant/{tenantId}", method = RequestMethod.GET)
+    @ResponseBody
+    public Tenant getTenantById(
+            @ApiParam(value = TENANT_ID_PARAM_DESCRIPTION)
+            @PathVariable(TENANT_ID) String strTenantId) throws ThingsboardException {
+        checkParameter(TENANT_ID, strTenantId);
+        try {
+            TenantId tenantId = TenantId.fromUUID(toUUID(strTenantId));
+            Tenant tenant = checkTenantId(tenantId, Operation.READ);
+            if (!tenant.getAdditionalInfo().isNull()) {
+                processDashboardIdFromAdditionalInfo((ObjectNode) tenant.getAdditionalInfo(), HOME_DASHBOARD);
+            }
+            return tenant;
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Tenant Info (getTenantInfoById)",
+            notes = "Fetch the Tenant Info object based on the provided Tenant Id. " +
+                    TENANT_INFO_DESCRIPTION + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/tenant/info/{tenantId}", method = RequestMethod.GET)
+    @ResponseBody
+    public TenantInfo getTenantInfoById(
+            @ApiParam(value = TENANT_ID_PARAM_DESCRIPTION)
+            @PathVariable(TENANT_ID) String strTenantId) throws ThingsboardException {
+        checkParameter(TENANT_ID, strTenantId);
+        try {
+            TenantId tenantId = TenantId.fromUUID(toUUID(strTenantId));
+            return checkTenantInfoId(tenantId, Operation.READ);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Create Or update Tenant (saveTenant)",
+            notes = "Create or update the Tenant. When creating tenant, platform generates Tenant Id as " + UUID_WIKI_LINK +
+                    "Default Rule Chain and Device profile are also generated for the new tenants automatically. " +
+                    "The newly created Tenant Id will be present in the response. " +
+                    "Specify existing Tenant Id id to update the Tenant. " +
+                    "Referencing non-existing Tenant Id will cause 'Not Found' error." +
+                    "Remove 'id', 'tenantId' from the request body example (below) to create new Tenant entity." +
+                    SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenant", method = RequestMethod.POST)
+    @ResponseBody
+    public Tenant saveTenant(@ApiParam(value = "A JSON value representing the tenant.")
+                             @RequestBody Tenant tenant) throws Exception {
+        checkEntity(tenant.getId(), tenant, Resource.TENANT);
+        return tbTenantService.save(tenant);
+    }
+
+    @ApiOperation(value = "Delete Tenant (deleteTenant)",
+            notes = "Deletes the tenant, it's customers, rule chains, devices and all other related entities. Referencing non-existing tenant Id will cause an error." + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenant/{tenantId}", method = RequestMethod.DELETE)
+    @ResponseStatus(value = HttpStatus.OK)
+    public void deleteTenant(@ApiParam(value = TENANT_ID_PARAM_DESCRIPTION)
+                             @PathVariable(TENANT_ID) String strTenantId) throws Exception {
+        checkParameter(TENANT_ID, strTenantId);
+        TenantId tenantId = TenantId.fromUUID(toUUID(strTenantId));
+        Tenant tenant = checkTenantId(tenantId, Operation.DELETE);
+        tbTenantService.delete(tenant);
+    }
+
+    @ApiOperation(value = "Get Tenants (getTenants)", notes = "Returns a page of tenants registered in the platform. " + PAGE_DATA_PARAMETERS + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenants", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<Tenant> getTenants(
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = TENANT_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = TENANT_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            return checkNotNull(tenantService.findTenants(pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Tenants Info (getTenants)", notes = "Returns a page of tenant info objects registered in the platform. "
+            + TENANT_INFO_DESCRIPTION + PAGE_DATA_PARAMETERS + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantInfos", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<TenantInfo> getTenantInfos(
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = TENANT_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = TENANT_INFO_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder
+    ) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            return checkNotNull(tenantService.findTenantInfos(pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/TenantProfileController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.EntityInfo;
+import org.thingsboard.server.common.data.TenantProfile;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.TenantProfileId;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.entitiy.tenant.profile.TbTenantProfileService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+
+import static org.thingsboard.server.controller.ControllerConstants.MARKDOWN_CODE_BLOCK_END;
+import static org.thingsboard.server.controller.ControllerConstants.MARKDOWN_CODE_BLOCK_START;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_DATA_PARAMETERS;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_NUMBER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_SIZE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERTY_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_PROFILE_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_PROFILE_INFO_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_PROFILE_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_PROFILE_TEXT_SEARCH_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.UUID_WIKI_LINK;
+
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+@Slf4j
+@RequiredArgsConstructor
+public class TenantProfileController extends BaseController {
+
+    private static final String TENANT_PROFILE_INFO_DESCRIPTION = "Tenant Profile Info is a lightweight object that contains only id and name of the profile. ";
+
+    private final TbTenantProfileService tbTenantProfileService;
+
+    @ApiOperation(value = "Get Tenant Profile (getTenantProfileById)",
+            notes = "Fetch the Tenant Profile object based on the provided Tenant Profile Id. " + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfile/{tenantProfileId}", method = RequestMethod.GET)
+    @ResponseBody
+    public TenantProfile getTenantProfileById(
+            @ApiParam(value = TENANT_PROFILE_ID_PARAM_DESCRIPTION)
+            @PathVariable("tenantProfileId") String strTenantProfileId) throws ThingsboardException {
+        checkParameter("tenantProfileId", strTenantProfileId);
+        try {
+            TenantProfileId tenantProfileId = new TenantProfileId(toUUID(strTenantProfileId));
+            return checkTenantProfileId(tenantProfileId, Operation.READ);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Tenant Profile Info (getTenantProfileInfoById)",
+            notes = "Fetch the Tenant Profile Info object based on the provided Tenant Profile Id. " + TENANT_PROFILE_INFO_DESCRIPTION + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfileInfo/{tenantProfileId}", method = RequestMethod.GET)
+    @ResponseBody
+    public EntityInfo getTenantProfileInfoById(
+            @ApiParam(value = TENANT_PROFILE_ID_PARAM_DESCRIPTION)
+            @PathVariable("tenantProfileId") String strTenantProfileId) throws ThingsboardException {
+        checkParameter("tenantProfileId", strTenantProfileId);
+        try {
+            TenantProfileId tenantProfileId = new TenantProfileId(toUUID(strTenantProfileId));
+            return checkNotNull(tenantProfileService.findTenantProfileInfoById(getTenantId(), tenantProfileId));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get default Tenant Profile Info (getDefaultTenantProfileInfo)",
+            notes = "Fetch the default Tenant Profile Info object based. " + TENANT_PROFILE_INFO_DESCRIPTION + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfileInfo/default", method = RequestMethod.GET)
+    @ResponseBody
+    public EntityInfo getDefaultTenantProfileInfo() throws ThingsboardException {
+        try {
+            return checkNotNull(tenantProfileService.findDefaultTenantProfileInfo(getTenantId()));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Create Or update Tenant Profile (saveTenantProfile)",
+            notes = "Create or update the Tenant Profile. When creating tenant profile, platform generates Tenant Profile Id as " + UUID_WIKI_LINK +
+                    "The newly created Tenant Profile Id will be present in the response. " +
+                    "Specify existing Tenant Profile Id id to update the Tenant Profile. " +
+                    "Referencing non-existing Tenant Profile Id will cause 'Not Found' error. " +
+                    "\n\nUpdate of the tenant profile configuration will cause immediate recalculation of API limits for all affected Tenants. " +
+                    "\n\nThe **'profileData'** object is the part of Tenant Profile that defines API limits and Rate limits. " +
+                    "\n\nYou have an ability to define maximum number of devices ('maxDevice'), assets ('maxAssets') and other entities. " +
+                    "You may also define maximum number of messages to be processed per month ('maxTransportMessages', 'maxREExecutions', etc). " +
+                    "The '*RateLimit' defines the rate limits using simple syntax. For example, '1000:1,20000:60' means up to 1000 events per second but no more than 20000 event per minute. " +
+                    "Let's review the example of tenant profile data below: " +
+                    "\n\n" + MARKDOWN_CODE_BLOCK_START +
+                    "{\n" +
+                    "  \"name\": \"Default\",\n" +
+                    "  \"description\": \"Default tenant profile\",\n" +
+                    "  \"isolatedTbRuleEngine\": false,\n" +
+                    "  \"profileData\": {\n" +
+                    "    \"configuration\": {\n" +
+                    "      \"type\": \"DEFAULT\",\n" +
+                    "      \"maxDevices\": 0,\n" +
+                    "      \"maxAssets\": 0,\n" +
+                    "      \"maxCustomers\": 0,\n" +
+                    "      \"maxUsers\": 0,\n" +
+                    "      \"maxDashboards\": 0,\n" +
+                    "      \"maxRuleChains\": 0,\n" +
+                    "      \"maxResourcesInBytes\": 0,\n" +
+                    "      \"maxOtaPackagesInBytes\": 0,\n" +
+                    "      \"transportTenantMsgRateLimit\": \"1000:1,20000:60\",\n" +
+                    "      \"transportTenantTelemetryMsgRateLimit\": \"1000:1,20000:60\",\n" +
+                    "      \"transportTenantTelemetryDataPointsRateLimit\": \"1000:1,20000:60\",\n" +
+                    "      \"transportDeviceMsgRateLimit\": \"20:1,600:60\",\n" +
+                    "      \"transportDeviceTelemetryMsgRateLimit\": \"20:1,600:60\",\n" +
+                    "      \"transportDeviceTelemetryDataPointsRateLimit\": \"20:1,600:60\",\n" +
+                    "      \"maxTransportMessages\": 10000000,\n" +
+                    "      \"maxTransportDataPoints\": 10000000,\n" +
+                    "      \"maxREExecutions\": 4000000,\n" +
+                    "      \"maxJSExecutions\": 5000000,\n" +
+                    "      \"maxDPStorageDays\": 0,\n" +
+                    "      \"maxRuleNodeExecutionsPerMessage\": 50,\n" +
+                    "      \"maxEmails\": 0,\n" +
+                    "      \"maxSms\": 0,\n" +
+                    "      \"maxCreatedAlarms\": 1000,\n" +
+                    "      \"defaultStorageTtlDays\": 0,\n" +
+                    "      \"alarmsTtlDays\": 0,\n" +
+                    "      \"rpcTtlDays\": 0,\n" +
+                    "      \"warnThreshold\": 0\n" +
+                    "    }\n" +
+                    "  },\n" +
+                    "  \"default\": true\n" +
+                    "}" +
+                    MARKDOWN_CODE_BLOCK_END +
+                    "Remove 'id', from the request body example (below) to create new Tenant Profile entity." +
+                    SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfile", method = RequestMethod.POST)
+    @ResponseBody
+    public TenantProfile saveTenantProfile(@ApiParam(value = "A JSON value representing the tenant profile.")
+                                           @RequestBody TenantProfile tenantProfile) throws ThingsboardException {
+        try {
+            TenantProfile oldProfile;
+            if (tenantProfile.getId() == null) {
+                accessControlService.checkPermission(getCurrentUser(), Resource.TENANT_PROFILE, Operation.CREATE);
+                oldProfile = null;
+            } else {
+                oldProfile = checkTenantProfileId(tenantProfile.getId(), Operation.WRITE);
+            }
+
+            return tbTenantProfileService.save(getTenantId(), tenantProfile, oldProfile);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Delete Tenant Profile (deleteTenantProfile)",
+            notes = "Deletes the tenant profile. Referencing non-existing tenant profile Id will cause an error. Referencing profile that is used by the tenants will cause an error. " + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfile/{tenantProfileId}", method = RequestMethod.DELETE)
+    @ResponseStatus(value = HttpStatus.OK)
+    public void deleteTenantProfile(@ApiParam(value = TENANT_PROFILE_ID_PARAM_DESCRIPTION)
+                                    @PathVariable("tenantProfileId") String strTenantProfileId) throws ThingsboardException {
+        try {
+            checkParameter("tenantProfileId", strTenantProfileId);
+            TenantProfileId tenantProfileId = new TenantProfileId(toUUID(strTenantProfileId));
+            TenantProfile profile = checkTenantProfileId(tenantProfileId, Operation.DELETE);
+            tbTenantProfileService.delete(getTenantId(), profile);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Make tenant profile default (setDefaultTenantProfile)",
+            notes = "Makes specified tenant profile to be default. Referencing non-existing tenant profile Id will cause an error. " + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfile/{tenantProfileId}/default", method = RequestMethod.POST)
+    @ResponseBody
+    public TenantProfile setDefaultTenantProfile(
+            @ApiParam(value = TENANT_PROFILE_ID_PARAM_DESCRIPTION)
+            @PathVariable("tenantProfileId") String strTenantProfileId) throws ThingsboardException {
+        checkParameter("tenantProfileId", strTenantProfileId);
+        try {
+            TenantProfileId tenantProfileId = new TenantProfileId(toUUID(strTenantProfileId));
+            TenantProfile tenantProfile = checkTenantProfileId(tenantProfileId, Operation.WRITE);
+            tenantProfileService.setDefaultTenantProfile(getTenantId(), tenantProfileId);
+            return tenantProfile;
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Tenant Profiles (getTenantProfiles)", notes = "Returns a page of tenant profiles registered in the platform. " + PAGE_DATA_PARAMETERS + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfiles", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<TenantProfile> getTenantProfiles(
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = TENANT_PROFILE_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = TENANT_PROFILE_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            return checkNotNull(tenantProfileService.findTenantProfiles(getTenantId(), pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Tenant Profiles Info (getTenantProfileInfos)", notes = "Returns a page of tenant profile info objects registered in the platform. "
+            + TENANT_PROFILE_INFO_DESCRIPTION + PAGE_DATA_PARAMETERS + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenantProfileInfos", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<EntityInfo> getTenantProfileInfos(
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = TENANT_PROFILE_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = TENANT_PROFILE_INFO_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            return checkNotNull(tenantProfileService.findTenantProfileInfos(getTenantId(), pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+}

application/src/main/java/org/thingsboard/server/controller/TwoFactorAuthConfigController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.security.model.mfa.PlatformTwoFaSettings;
+import org.thingsboard.server.common.data.security.model.mfa.account.AccountTwoFaSettings;
+import org.thingsboard.server.common.data.security.model.mfa.account.TwoFaAccountConfig;
+import org.thingsboard.server.common.data.security.model.mfa.provider.TwoFaProviderConfig;
+import org.thingsboard.server.common.data.security.model.mfa.provider.TwoFaProviderType;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.auth.mfa.TwoFactorAuthService;
+import org.thingsboard.server.service.security.auth.mfa.config.TwoFaConfigManager;
+import org.thingsboard.server.service.security.model.SecurityUser;
+
+import javax.validation.Valid;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.thingsboard.server.controller.ControllerConstants.NEW_LINE;
+
+@RestController
+@RequestMapping("/api/2fa")
+@TbCoreComponent
+@RequiredArgsConstructor
+public class TwoFactorAuthConfigController extends BaseController {
+
+    private final TwoFaConfigManager twoFaConfigManager;
+    private final TwoFactorAuthService twoFactorAuthService;
+
+
+    @ApiOperation(value = "Get account 2FA settings (getAccountTwoFaSettings)",
+            notes = "Get user's account 2FA configuration. Configuration contains configs for different 2FA providers." + NEW_LINE +
+                    "Example:\n" +
+                    "```\n{\n  \"configs\": {\n" +
+                    "    \"EMAIL\": {\n      \"providerType\": \"EMAIL\",\n      \"useByDefault\": true,\n      \"email\": \"tenant@thingsboard.org\"\n    },\n" +
+                    "    \"TOTP\": {\n      \"providerType\": \"TOTP\",\n      \"useByDefault\": false,\n      \"authUrl\": \"otpauth://totp/TB%202FA:tenant@thingsboard.org?issuer=TB+2FA&secret=P6Z2TLYTASOGP6LCJZAD24ETT5DACNNX\"\n    },\n" +
+                    "    \"SMS\": {\n      \"providerType\": \"SMS\",\n      \"useByDefault\": false,\n      \"phoneNumber\": \"+380501253652\"\n    }\n" +
+                    "  }\n}\n```" +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @GetMapping("/account/settings")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public AccountTwoFaSettings getAccountTwoFaSettings() throws ThingsboardException {
+        SecurityUser user = getCurrentUser();
+        return twoFaConfigManager.getAccountTwoFaSettings(user.getTenantId(), user.getId()).orElse(null);
+    }
+
+
+    @ApiOperation(value = "Generate 2FA account config (generateTwoFaAccountConfig)",
+            notes = "Generate new 2FA account config template for specified provider type. " + NEW_LINE +
+                    "For TOTP, this will return a corresponding account config template " +
+                    "with a generated OTP auth URL (with new random secret key for each API call) that can be then " +
+                    "converted to a QR code to scan with an authenticator app. Example:\n" +
+                    "```\n{\n" +
+                    "  \"providerType\": \"TOTP\",\n" +
+                    "  \"useByDefault\": false,\n" +
+                    "  \"authUrl\": \"otpauth://totp/TB%202FA:tenant@thingsboard.org?issuer=TB+2FA&secret=PNJDNWJVAK4ZTUYT7RFGPQLXA7XGU7PX\"\n" +
+                    "}\n```" + NEW_LINE +
+                    "For EMAIL, the generated config will contain email from user's account:\n" +
+                    "```\n{\n" +
+                    "  \"providerType\": \"EMAIL\",\n" +
+                    "  \"useByDefault\": false,\n" +
+                    "  \"email\": \"tenant@thingsboard.org\"\n" +
+                    "}\n```" + NEW_LINE +
+                    "For SMS 2FA this method will just return a config with empty/default values as there is nothing to generate/preset:\n" +
+                    "```\n{\n" +
+                    "  \"providerType\": \"SMS\",\n" +
+                    "  \"useByDefault\": false,\n" +
+                    "  \"phoneNumber\": null\n" +
+                    "}\n```" + NEW_LINE +
+                    "Will throw an error (Bad Request) if the provider is not configured for usage. " +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PostMapping("/account/config/generate")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public TwoFaAccountConfig generateTwoFaAccountConfig(@ApiParam(value = "2FA provider type to generate new account config for", defaultValue = "TOTP", required = true)
+                                                         @RequestParam TwoFaProviderType providerType) throws Exception {
+        SecurityUser user = getCurrentUser();
+        return twoFactorAuthService.generateNewAccountConfig(user, providerType);
+    }
+
+    @ApiOperation(value = "Submit 2FA account config (submitTwoFaAccountConfig)",
+            notes = "Submit 2FA account config to prepare for a future verification. " +
+                    "Basically, this method will send a verification code for a given account config, if this has " +
+                    "sense for a chosen 2FA provider. This code is needed to then verify and save the account config." + NEW_LINE +
+                    "Example of EMAIL 2FA account config:\n" +
+                    "```\n{\n" +
+                    "  \"providerType\": \"EMAIL\",\n" +
+                    "  \"useByDefault\": true,\n" +
+                    "  \"email\": \"separate-email-for-2fa@thingsboard.org\"\n" +
+                    "}\n```" + NEW_LINE +
+                    "Example of SMS 2FA account config:\n" +
+                    "```\n{\n" +
+                    "  \"providerType\": \"SMS\",\n" +
+                    "  \"useByDefault\": false,\n" +
+                    "  \"phoneNumber\": \"+38012312321\"\n" +
+                    "}\n```" + NEW_LINE +
+                    "For TOTP this method does nothing." + NEW_LINE +
+                    "Will throw an error (Bad Request) if submitted account config is not valid, " +
+                    "or if the provider is not configured for usage. " +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PostMapping("/account/config/submit")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public void submitTwoFaAccountConfig(@Valid @RequestBody TwoFaAccountConfig accountConfig) throws Exception {
+        SecurityUser user = getCurrentUser();
+        twoFactorAuthService.prepareVerificationCode(user, accountConfig, false);
+    }
+
+    @ApiOperation(value = "Verify and save 2FA account config (verifyAndSaveTwoFaAccountConfig)",
+            notes = "Checks the verification code for submitted config, and if it is correct, saves the provided account config. " + NEW_LINE +
+                    "Returns whole account's 2FA settings object.\n" +
+                    "Will throw an error (Bad Request) if the provider is not configured for usage. " +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PostMapping("/account/config")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public AccountTwoFaSettings verifyAndSaveTwoFaAccountConfig(@Valid @RequestBody TwoFaAccountConfig accountConfig,
+                                                                @RequestParam(required = false) String verificationCode) throws Exception {
+        SecurityUser user = getCurrentUser();
+        if (twoFaConfigManager.getTwoFaAccountConfig(user.getTenantId(), user.getId(), accountConfig.getProviderType()).isPresent()) {
+            throw new IllegalArgumentException("2FA provider is already configured");
+        }
+
+        boolean verificationSuccess;
+        if (accountConfig.getProviderType() != TwoFaProviderType.BACKUP_CODE) {
+            verificationSuccess = twoFactorAuthService.checkVerificationCode(user, verificationCode, accountConfig, false);
+        } else {
+            verificationSuccess = true;
+        }
+        if (verificationSuccess) {
+            return twoFaConfigManager.saveTwoFaAccountConfig(user.getTenantId(), user.getId(), accountConfig);
+        } else {
+            throw new IllegalArgumentException("Verification code is incorrect");
+        }
+    }
+
+    @ApiOperation(value = "Update 2FA account config (updateTwoFaAccountConfig)", notes =
+            "Update config for a given provider type. \n" +
+                    "Update request example:\n" +
+                    "```\n{\n  \"useByDefault\": true\n}\n```\n" +
+                    "Returns whole account's 2FA settings object.\n" +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PutMapping("/account/config")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public AccountTwoFaSettings updateTwoFaAccountConfig(@RequestParam TwoFaProviderType providerType,
+                                                         @RequestBody TwoFaAccountConfigUpdateRequest updateRequest) throws ThingsboardException {
+        SecurityUser user = getCurrentUser();
+
+        TwoFaAccountConfig accountConfig = twoFaConfigManager.getTwoFaAccountConfig(user.getTenantId(), user.getId(), providerType)
+                .orElseThrow(() -> new IllegalArgumentException("Config for " + providerType + " 2FA provider not found"));
+        accountConfig.setUseByDefault(updateRequest.isUseByDefault());
+        return twoFaConfigManager.saveTwoFaAccountConfig(user.getTenantId(), user.getId(), accountConfig);
+    }
+
+    @ApiOperation(value = "Delete 2FA account config (deleteTwoFaAccountConfig)", notes =
+            "Delete 2FA config for a given 2FA provider type. \n" +
+                    "Returns whole account's 2FA settings object.\n" +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @DeleteMapping("/account/config")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public AccountTwoFaSettings deleteTwoFaAccountConfig(@RequestParam TwoFaProviderType providerType) throws ThingsboardException {
+        SecurityUser user = getCurrentUser();
+        return twoFaConfigManager.deleteTwoFaAccountConfig(user.getTenantId(), user.getId(), providerType);
+    }
+
+
+    @ApiOperation(value = "Get available 2FA providers (getAvailableTwoFaProviders)", notes =
+            "Get the list of provider types available for user to use (the ones configured by tenant or sysadmin).\n" +
+                    "Example of response:\n" +
+                    "```\n[\n  \"TOTP\",\n  \"EMAIL\",\n  \"SMS\"\n]\n```" +
+                    ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER
+    )
+    @GetMapping("/providers")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    public List<TwoFaProviderType> getAvailableTwoFaProviders() throws ThingsboardException {
+        return twoFaConfigManager.getPlatformTwoFaSettings(getTenantId(), true)
+                .map(PlatformTwoFaSettings::getProviders).orElse(Collections.emptyList()).stream()
+                .map(TwoFaProviderConfig::getProviderType)
+                .collect(Collectors.toList());
+    }
+
+
+    @ApiOperation(value = "Get platform 2FA settings (getPlatformTwoFaSettings)",
+            notes = "Get platform settings for 2FA. The settings are described for savePlatformTwoFaSettings API method. " +
+                    "If 2FA is not configured, then an empty response will be returned." +
+                    ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @GetMapping("/settings")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    public PlatformTwoFaSettings getPlatformTwoFaSettings() throws ThingsboardException {
+        return twoFaConfigManager.getPlatformTwoFaSettings(getTenantId(), false).orElse(null);
+    }
+
+    @ApiOperation(value = "Save platform 2FA settings (savePlatformTwoFaSettings)",
+            notes = "Save 2FA settings for platform. The settings have following properties:\n" +
+                    "- `providers` - the list of 2FA providers' configs. Users will only be allowed to use 2FA providers from this list. \n\n" +
+                    "- `minVerificationCodeSendPeriod` - minimal period in seconds to wait after verification code send request to send next request. \n" +
+                    "- `verificationCodeCheckRateLimit` - rate limit configuration for verification code checking.\n" +
+                    "The format is standard: 'amountOfRequests:periodInSeconds'. The value of '1:60' would limit verification " +
+                    "code checking requests to one per minute.\n" +
+                    "- `maxVerificationFailuresBeforeUserLockout` - maximum number of verification failures before a user gets disabled.\n" +
+                    "- `totalAllowedTimeForVerification` - total amount of time in seconds allotted for verification. " +
+                    "Basically, this property sets a lifetime for pre-verification token. If not set, default value of 30 minutes is used.\n" + NEW_LINE +
+                    "TOTP 2FA provider config has following settings:\n" +
+                    "- `issuerName` - issuer name that will be displayed in an authenticator app near a username. Must not be blank.\n\n" +
+                    "For SMS 2FA provider:\n" +
+                    "- `smsVerificationMessageTemplate` - verification message template.  Available template variables " +
+                    "are ${code} and ${userEmail}. It must not be blank and must contain verification code variable.\n" +
+                    "- `verificationCodeLifetime` - verification code lifetime in seconds. Required to be positive.\n\n" +
+                    "For EMAIL provider type:\n" +
+                    "- `verificationCodeLifetime` - the same as for SMS." + NEW_LINE +
+                    "Example of the settings:\n" +
+                    "```\n{\n" +
+                    "  \"providers\": [\n" +
+                    "    {\n" +
+                    "      \"providerType\": \"TOTP\",\n" +
+                    "      \"issuerName\": \"TB\"\n" +
+                    "    },\n" +
+                    "    {\n" +
+                    "      \"providerType\": \"EMAIL\",\n" +
+                    "      \"verificationCodeLifetime\": 60\n" +
+                    "    },\n" +
+                    "    {\n" +
+                    "      \"providerType\": \"SMS\",\n" +
+                    "      \"verificationCodeLifetime\": 60,\n" +
+                    "      \"smsVerificationMessageTemplate\": \"Here is your verification code: ${code}\"\n" +
+                    "    }\n" +
+                    "  ],\n" +
+                    "  \"minVerificationCodeSendPeriod\": 60,\n" +
+                    "  \"verificationCodeCheckRateLimit\": \"3:900\",\n" +
+                    "  \"maxVerificationFailuresBeforeUserLockout\": 10,\n" +
+                    "  \"totalAllowedTimeForVerification\": 600\n" +
+                    "}\n```" +
+                    ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PostMapping("/settings")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    public PlatformTwoFaSettings savePlatformTwoFaSettings(@ApiParam(value = "Settings value", required = true)
+                                          @RequestBody PlatformTwoFaSettings twoFaSettings) throws ThingsboardException {
+        return twoFaConfigManager.savePlatformTwoFaSettings(getTenantId(), twoFaSettings);
+    }
+
+
+    @Data
+    public static class TwoFaAccountConfigUpdateRequest {
+        private boolean useByDefault;
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/TwoFactorAuthController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.StringUtils;
+import org.thingsboard.server.common.data.audit.ActionType;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.security.model.mfa.PlatformTwoFaSettings;
+import org.thingsboard.server.common.data.security.model.mfa.account.EmailTwoFaAccountConfig;
+import org.thingsboard.server.common.data.security.model.mfa.account.SmsTwoFaAccountConfig;
+import org.thingsboard.server.common.data.security.model.mfa.provider.TwoFaProviderType;
+import org.thingsboard.server.dao.user.UserService;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.auth.mfa.TwoFactorAuthService;
+import org.thingsboard.server.service.security.auth.mfa.config.TwoFaConfigManager;
+import org.thingsboard.server.service.security.auth.rest.RestAuthenticationDetails;
+import org.thingsboard.server.common.data.security.model.JwtPair;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
+import org.thingsboard.server.service.security.system.SystemSecurityService;
+
+import javax.servlet.http.HttpServletRequest;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+import static org.thingsboard.server.controller.ControllerConstants.NEW_LINE;
+
+@RestController
+@RequestMapping("/api/auth/2fa")
+@TbCoreComponent
+@RequiredArgsConstructor
+public class TwoFactorAuthController extends BaseController {
+
+    private final TwoFactorAuthService twoFactorAuthService;
+    private final TwoFaConfigManager twoFaConfigManager;
+    private final JwtTokenFactory tokenFactory;
+    private final SystemSecurityService systemSecurityService;
+    private final UserService userService;
+
+
+    @ApiOperation(value = "Request 2FA verification code (requestTwoFaVerificationCode)",
+            notes = "Request 2FA verification code." + NEW_LINE +
+                    "To make a request to this endpoint, you need an access token with the scope of PRE_VERIFICATION_TOKEN, " +
+                    "which is issued on username/password auth if 2FA is enabled." + NEW_LINE +
+                    "The API method is rate limited (using rate limit config from TwoFactorAuthSettings). " +
+                    "Will return a Bad Request error if provider is not configured for usage, " +
+                    "and Too Many Requests error if rate limits are exceeded.")
+    @PostMapping("/verification/send")
+    @PreAuthorize("hasAuthority('PRE_VERIFICATION_TOKEN')")
+    public void requestTwoFaVerificationCode(@RequestParam TwoFaProviderType providerType) throws Exception {
+        SecurityUser user = getCurrentUser();
+        twoFactorAuthService.prepareVerificationCode(user, providerType, true);
+    }
+
+    @ApiOperation(value = "Check 2FA verification code (checkTwoFaVerificationCode)",
+            notes = "Checks 2FA verification code, and if it is correct the method returns a regular access and refresh token pair." + NEW_LINE +
+                    "The API method is rate limited (using rate limit config from TwoFactorAuthSettings), and also will block a user " +
+                    "after X unsuccessful verification attempts if such behavior is configured (in TwoFactorAuthSettings)." + NEW_LINE +
+                    "Will return a Bad Request error if provider is not configured for usage, " +
+                    "and Too Many Requests error if rate limits are exceeded.")
+    @PostMapping("/verification/check")
+    @PreAuthorize("hasAuthority('PRE_VERIFICATION_TOKEN')")
+    public JwtPair checkTwoFaVerificationCode(@RequestParam TwoFaProviderType providerType,
+                                              @RequestParam String verificationCode, HttpServletRequest servletRequest) throws Exception {
+        SecurityUser user = getCurrentUser();
+        boolean verificationSuccess = twoFactorAuthService.checkVerificationCode(user, providerType, verificationCode, true);
+        if (verificationSuccess) {
+            systemSecurityService.logLoginAction(user, new RestAuthenticationDetails(servletRequest), ActionType.LOGIN, null);
+            user = new SecurityUser(userService.findUserById(user.getTenantId(), user.getId()), true, user.getUserPrincipal());
+            return tokenFactory.createTokenPair(user);
+        } else {
+            ThingsboardException error = new ThingsboardException("Verification code is incorrect", ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+            systemSecurityService.logLoginAction(user, new RestAuthenticationDetails(servletRequest), ActionType.LOGIN, error);
+            throw error;
+        }
+    }
+
+
+    @ApiOperation(value = "Get available 2FA providers (getAvailableTwoFaProviders)", notes =
+            "Get the list of 2FA provider infos available for user to use. Example:\n" +
+                    "```\n[\n" +
+                    "  {\n    \"type\": \"EMAIL\",\n    \"default\": true,\n    \"contact\": \"ab*****ko@gmail.com\"\n  },\n" +
+                    "  {\n    \"type\": \"TOTP\",\n    \"default\": false,\n    \"contact\": null\n  },\n" +
+                    "  {\n    \"type\": \"SMS\",\n    \"default\": false,\n    \"contact\": \"+38********12\"\n  }\n" +
+                    "]\n```")
+    @GetMapping("/providers")
+    @PreAuthorize("hasAuthority('PRE_VERIFICATION_TOKEN')")
+    public List<TwoFaProviderInfo> getAvailableTwoFaProviders() throws ThingsboardException {
+        SecurityUser user = getCurrentUser();
+        Optional<PlatformTwoFaSettings> platformTwoFaSettings = twoFaConfigManager.getPlatformTwoFaSettings(user.getTenantId(), true);
+        return twoFaConfigManager.getAccountTwoFaSettings(user.getTenantId(), user.getId())
+                .map(settings -> settings.getConfigs().values()).orElse(Collections.emptyList())
+                .stream().map(config -> {
+                    String contact = null;
+                    switch (config.getProviderType()) {
+                        case SMS:
+                            String phoneNumber = ((SmsTwoFaAccountConfig) config).getPhoneNumber();
+                            contact = StringUtils.obfuscate(phoneNumber, 2, '*', phoneNumber.indexOf('+') + 1, phoneNumber.length());
+                            break;
+                        case EMAIL:
+                            String email = ((EmailTwoFaAccountConfig) config).getEmail();
+                            contact = StringUtils.obfuscate(email, 2, '*', 0, email.indexOf('@'));
+                            break;
+                    }
+                    return TwoFaProviderInfo.builder()
+                            .type(config.getProviderType())
+                            .isDefault(config.isUseByDefault())
+                            .contact(contact)
+                            .minVerificationCodeSendPeriod(platformTwoFaSettings.get().getMinVerificationCodeSendPeriod())
+                            .build();
+                })
+                .collect(Collectors.toList());
+    }
+
+    @Data
+    @AllArgsConstructor
+    @Builder
+    public static class TwoFaProviderInfo {
+        private TwoFaProviderType type;
+        private boolean isDefault;
+        private String contact;
+        private Integer minVerificationCodeSendPeriod;
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/UiSettingsController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+public class UiSettingsController extends BaseController {
+
+    @Value("${ui.help.base-url}")
+    private String helpBaseUrl;
+
+    @ApiOperation(value = "Get UI help base url (getHelpBaseUrl)",
+            notes = "Get UI help base url used to fetch help assets. " +
+                    "The actual value of the base url is configurable in the system configuration file.")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/uiSettings/helpBaseUrl", method = RequestMethod.GET)
+    @ResponseBody
+    public String getHelpBaseUrl() throws ThingsboardException {
+        return helpBaseUrl;
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/UserController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.rule.engine.api.MailService;
+import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.CustomerId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.common.data.security.UserCredentials;
+import org.thingsboard.server.common.data.security.event.UserCredentialsInvalidationEvent;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.entitiy.user.TbUserService;
+import org.thingsboard.server.common.data.security.model.JwtPair;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.model.UserPrincipal;
+import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+import org.thingsboard.server.service.security.system.SystemSecurityService;
+
+import javax.servlet.http.HttpServletRequest;
+
+import static org.thingsboard.server.controller.ControllerConstants.CUSTOMER_ID;
+import static org.thingsboard.server.controller.ControllerConstants.CUSTOMER_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.DEFAULT_DASHBOARD;
+import static org.thingsboard.server.controller.ControllerConstants.HOME_DASHBOARD;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_DATA_PARAMETERS;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_NUMBER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_SIZE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERTY_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_ID;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.USER_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.USER_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.USER_TEXT_SEARCH_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.UUID_WIKI_LINK;
+
+@RequiredArgsConstructor
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+public class UserController extends BaseController {
+
+    public static final String USER_ID = "userId";
+    public static final String YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION = "You don't have permission to perform this operation!";
+    public static final String ACTIVATE_URL_PATTERN = "%s/api/noauth/activate?activateToken=%s";
+
+    @Value("${security.user_token_access_enabled}")
+    @Getter
+    private boolean userTokenAccessEnabled;
+
+    private final MailService mailService;
+    private final JwtTokenFactory tokenFactory;
+    private final SystemSecurityService systemSecurityService;
+    private final ApplicationEventPublisher eventPublisher;
+    private final TbUserService tbUserService;
+
+    @ApiOperation(value = "Get User (getUserById)",
+            notes = "Fetch the User object based on the provided User Id. " +
+                    "If the user has the authority of 'SYS_ADMIN', the server does not perform additional checks. " +
+                    "If the user has the authority of 'TENANT_ADMIN', the server checks that the requested user is owned by the same tenant. " +
+                    "If the user has the authority of 'CUSTOMER_USER', the server checks that the requested user is owned by the same customer.")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/user/{userId}", method = RequestMethod.GET)
+    @ResponseBody
+    public User getUserById(
+            @ApiParam(value = USER_ID_PARAM_DESCRIPTION)
+            @PathVariable(USER_ID) String strUserId) throws ThingsboardException {
+        checkParameter(USER_ID, strUserId);
+        try {
+            UserId userId = new UserId(toUUID(strUserId));
+            User user = checkUserId(userId, Operation.READ);
+            if (user.getAdditionalInfo().isObject()) {
+                ObjectNode additionalInfo = (ObjectNode) user.getAdditionalInfo();
+                processDashboardIdFromAdditionalInfo(additionalInfo, DEFAULT_DASHBOARD);
+                processDashboardIdFromAdditionalInfo(additionalInfo, HOME_DASHBOARD);
+                UserCredentials userCredentials = userService.findUserCredentialsByUserId(user.getTenantId(), user.getId());
+                if (userCredentials.isEnabled() && !additionalInfo.has("userCredentialsEnabled")) {
+                    additionalInfo.put("userCredentialsEnabled", true);
+                }
+            }
+            return user;
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Check Token Access Enabled (isUserTokenAccessEnabled)",
+            notes = "Checks that the system is configured to allow administrators to impersonate themself as other users. " +
+                    "If the user who performs the request has the authority of 'SYS_ADMIN', it is possible to login as any tenant administrator. " +
+                    "If the user who performs the request has the authority of 'TENANT_ADMIN', it is possible to login as any customer user. ")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/user/tokenAccessEnabled", method = RequestMethod.GET)
+    @ResponseBody
+    public boolean isUserTokenAccessEnabled() {
+        return userTokenAccessEnabled;
+    }
+
+    @ApiOperation(value = "Get User Token (getUserToken)",
+            notes = "Returns the token of the User based on the provided User Id. " +
+                    "If the user who performs the request has the authority of 'SYS_ADMIN', it is possible to get the token of any tenant administrator. " +
+                    "If the user who performs the request has the authority of 'TENANT_ADMIN', it is possible to get the token of any customer user that belongs to the same tenant. ")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/user/{userId}/token", method = RequestMethod.GET)
+    @ResponseBody
+    public JwtPair getUserToken(
+            @ApiParam(value = USER_ID_PARAM_DESCRIPTION)
+            @PathVariable(USER_ID) String strUserId) throws ThingsboardException {
+        checkParameter(USER_ID, strUserId);
+        try {
+            if (!userTokenAccessEnabled) {
+                throw new ThingsboardException(YOU_DON_T_HAVE_PERMISSION_TO_PERFORM_THIS_OPERATION,
+                        ThingsboardErrorCode.PERMISSION_DENIED);
+            }
+            UserId userId = new UserId(toUUID(strUserId));
+            SecurityUser authUser = getCurrentUser();
+            User user = checkUserId(userId, Operation.READ);
+            UserPrincipal principal = new UserPrincipal(UserPrincipal.Type.USER_NAME, user.getEmail());
+            UserCredentials credentials = userService.findUserCredentialsByUserId(authUser.getTenantId(), userId);
+            SecurityUser securityUser = new SecurityUser(user, credentials.isEnabled(), principal);
+            return tokenFactory.createTokenPair(securityUser);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Save Or update User (saveUser)",
+            notes = "Create or update the User. When creating user, platform generates User Id as " + UUID_WIKI_LINK +
+                    "The newly created User Id will be present in the response. " +
+                    "Specify existing User Id to update the device. " +
+                    "Referencing non-existing User Id will cause 'Not Found' error." +
+                    "\n\nDevice email is unique for entire platform setup." +
+                    "Remove 'id', 'tenantId' and optionally 'customerId' from the request body example (below) to create new User entity." +
+                    "\n\nAvailable for users with 'SYS_ADMIN', 'TENANT_ADMIN' or 'CUSTOMER_USER' authority.")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/user", method = RequestMethod.POST)
+    @ResponseBody
+    public User saveUser(
+            @ApiParam(value = "A JSON value representing the User.", required = true)
+            @RequestBody User user,
+            @ApiParam(value = "Send activation email (or use activation link)", defaultValue = "true")
+            @RequestParam(required = false, defaultValue = "true") boolean sendActivationMail, HttpServletRequest request) throws ThingsboardException {
+        if (!Authority.SYS_ADMIN.equals(getCurrentUser().getAuthority())) {
+            user.setTenantId(getCurrentUser().getTenantId());
+        }
+        checkEntity(user.getId(), user, Resource.USER);
+        return tbUserService.save(getTenantId(), getCurrentUser().getCustomerId(), user, sendActivationMail, request, getCurrentUser());
+    }
+
+    @ApiOperation(value = "Send or re-send the activation email",
+            notes = "Force send the activation email to the user. Useful to resend the email if user has accidentally deleted it. " + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/user/sendActivationMail", method = RequestMethod.POST)
+    @ResponseStatus(value = HttpStatus.OK)
+    public void sendActivationEmail(
+            @ApiParam(value = "Email of the user", required = true)
+            @RequestParam(value = "email") String email,
+            HttpServletRequest request) throws ThingsboardException {
+        try {
+            User user = checkNotNull(userService.findUserByEmail(getCurrentUser().getTenantId(), email));
+
+            accessControlService.checkPermission(getCurrentUser(), Resource.USER, Operation.READ,
+                    user.getId(), user);
+
+            UserCredentials userCredentials = userService.findUserCredentialsByUserId(getCurrentUser().getTenantId(), user.getId());
+            if (!userCredentials.isEnabled() && userCredentials.getActivateToken() != null) {
+                String baseUrl = systemSecurityService.getBaseUrl(getTenantId(), getCurrentUser().getCustomerId(), request);
+                String activateUrl = String.format(ACTIVATE_URL_PATTERN, baseUrl,
+                        userCredentials.getActivateToken());
+                mailService.sendActivationEmail(activateUrl, email);
+            } else {
+                throw new ThingsboardException("User is already activated!", ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get the activation link (getActivationLink)",
+            notes = "Get the activation link for the user. " +
+                    "The base url for activation link is configurable in the general settings of system administrator. " + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/user/{userId}/activationLink", method = RequestMethod.GET, produces = "text/plain")
+    @ResponseBody
+    public String getActivationLink(
+            @ApiParam(value = USER_ID_PARAM_DESCRIPTION)
+            @PathVariable(USER_ID) String strUserId,
+            HttpServletRequest request) throws ThingsboardException {
+        checkParameter(USER_ID, strUserId);
+        try {
+            UserId userId = new UserId(toUUID(strUserId));
+            User user = checkUserId(userId, Operation.READ);
+            SecurityUser authUser = getCurrentUser();
+            UserCredentials userCredentials = userService.findUserCredentialsByUserId(authUser.getTenantId(), user.getId());
+            if (!userCredentials.isEnabled() && userCredentials.getActivateToken() != null) {
+                String baseUrl = systemSecurityService.getBaseUrl(getTenantId(), getCurrentUser().getCustomerId(), request);
+                String activateUrl = String.format(ACTIVATE_URL_PATTERN, baseUrl,
+                        userCredentials.getActivateToken());
+                return activateUrl;
+            } else {
+                throw new ThingsboardException("User is already activated!", ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Delete User (deleteUser)",
+            notes = "Deletes the User, it's credentials and all the relations (from and to the User). " +
+                    "Referencing non-existing User Id will cause an error. " + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/user/{userId}", method = RequestMethod.DELETE)
+    @ResponseStatus(value = HttpStatus.OK)
+    public void deleteUser(
+            @ApiParam(value = USER_ID_PARAM_DESCRIPTION)
+            @PathVariable(USER_ID) String strUserId) throws ThingsboardException {
+        checkParameter(USER_ID, strUserId);
+        UserId userId = new UserId(toUUID(strUserId));
+        User user = checkUserId(userId, Operation.DELETE);
+        if (user.getAuthority() == Authority.SYS_ADMIN && getCurrentUser().getId().equals(userId)) {
+            throw new ThingsboardException("Sysadmin is not allowed to delete himself", ThingsboardErrorCode.PERMISSION_DENIED);
+        }
+        tbUserService.delete(getTenantId(), getCurrentUser().getCustomerId(), user, getCurrentUser());
+    }
+
+    @ApiOperation(value = "Get Users (getUsers)",
+            notes = "Returns a page of users owned by tenant or customer. The scope depends on authority of the user that performs the request." +
+                    PAGE_DATA_PARAMETERS + TENANT_OR_CUSTOMER_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/users", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<User> getUsers(
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = USER_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = USER_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            SecurityUser currentUser = getCurrentUser();
+            if (Authority.TENANT_ADMIN.equals(currentUser.getAuthority())) {
+                return checkNotNull(userService.findUsersByTenantId(currentUser.getTenantId(), pageLink));
+            } else {
+                return checkNotNull(userService.findCustomerUsers(currentUser.getTenantId(), currentUser.getCustomerId(), pageLink));
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Tenant Users (getTenantAdmins)",
+            notes = "Returns a page of users owned by tenant. " + PAGE_DATA_PARAMETERS + SYSTEM_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    @RequestMapping(value = "/tenant/{tenantId}/users", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<User> getTenantAdmins(
+            @ApiParam(value = TENANT_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable(TENANT_ID) String strTenantId,
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = USER_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = USER_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        checkParameter("tenantId", strTenantId);
+        try {
+            TenantId tenantId = TenantId.fromUUID(toUUID(strTenantId));
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            return checkNotNull(userService.findTenantAdmins(tenantId, pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Customer Users (getCustomerUsers)",
+            notes = "Returns a page of users owned by customer. " + PAGE_DATA_PARAMETERS + TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAuthority('TENANT_ADMIN')")
+    @RequestMapping(value = "/customer/{customerId}/users", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<User> getCustomerUsers(
+            @ApiParam(value = CUSTOMER_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable(CUSTOMER_ID) String strCustomerId,
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = USER_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = USER_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        checkParameter("customerId", strCustomerId);
+        try {
+            CustomerId customerId = new CustomerId(toUUID(strCustomerId));
+            checkCustomerId(customerId, Operation.READ);
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            TenantId tenantId = getCurrentUser().getTenantId();
+            return checkNotNull(userService.findCustomerUsers(tenantId, customerId, pageLink));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Enable/Disable User credentials (setUserCredentialsEnabled)",
+            notes = "Enables or Disables user credentials. Useful when you would like to block user account without deleting it. " + PAGE_DATA_PARAMETERS + TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/user/{userId}/userCredentialsEnabled", method = RequestMethod.POST)
+    @ResponseBody
+    public void setUserCredentialsEnabled(
+            @ApiParam(value = USER_ID_PARAM_DESCRIPTION)
+            @PathVariable(USER_ID) String strUserId,
+            @ApiParam(value = "Disable (\"true\") or enable (\"false\") the credentials.", defaultValue = "true")
+            @RequestParam(required = false, defaultValue = "true") boolean userCredentialsEnabled) throws ThingsboardException {
+        checkParameter(USER_ID, strUserId);
+        try {
+            UserId userId = new UserId(toUUID(strUserId));
+            User user = checkUserId(userId, Operation.WRITE);
+            TenantId tenantId = getCurrentUser().getTenantId();
+            userService.setUserCredentialsEnabled(tenantId, userId, userCredentialsEnabled);
+
+            if (!userCredentialsEnabled) {
+                eventPublisher.publishEvent(new UserCredentialsInvalidationEvent(userId));
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.edge.EdgeEventActionType;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.WidgetTypeId;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.common.data.widget.WidgetType;
+import org.thingsboard.server.common.data.widget.WidgetTypeDetails;
+import org.thingsboard.server.common.data.widget.WidgetTypeInfo;
+import org.thingsboard.server.common.data.widget.WidgetsBundle;
+import org.thingsboard.server.dao.model.ModelConstants;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+
+import java.util.List;
+
+import static org.thingsboard.server.controller.ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.UUID_WIKI_LINK;
+import static org.thingsboard.server.controller.ControllerConstants.WIDGET_TYPE_ID_PARAM_DESCRIPTION;
+
+@Slf4j
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+public class WidgetTypeController extends AutoCommitController {
+
+    private static final String WIDGET_TYPE_DESCRIPTION = "Widget Type represents the template for widget creation. Widget Type and Widget are similar to class and object in OOP theory.";
+    private static final String WIDGET_TYPE_DETAILS_DESCRIPTION = "Widget Type Details extend Widget Type and add image and description properties. " +
+            "Those properties are useful to edit the Widget Type but they are not required for Dashboard rendering. ";
+    private static final String WIDGET_TYPE_INFO_DESCRIPTION = "Widget Type Info is a lightweight object that represents Widget Type but does not contain the heavyweight widget descriptor JSON";
+
+
+    @ApiOperation(value = "Get Widget Type Details (getWidgetTypeById)",
+            notes = "Get the Widget Type Details based on the provided Widget Type Id. " + WIDGET_TYPE_DETAILS_DESCRIPTION + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetType/{widgetTypeId}", method = RequestMethod.GET)
+    @ResponseBody
+    public WidgetTypeDetails getWidgetTypeById(
+            @ApiParam(value = WIDGET_TYPE_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable("widgetTypeId") String strWidgetTypeId) throws ThingsboardException {
+        checkParameter("widgetTypeId", strWidgetTypeId);
+        try {
+            WidgetTypeId widgetTypeId = new WidgetTypeId(toUUID(strWidgetTypeId));
+            return checkWidgetTypeId(widgetTypeId, Operation.READ);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Create Or Update Widget Type (saveWidgetType)",
+            notes = "Create or update the Widget Type. " + WIDGET_TYPE_DESCRIPTION + " " +
+                    "When creating the Widget Type, platform generates Widget Type Id as " + UUID_WIKI_LINK +
+                    "The newly created Widget Type Id will be present in the response. " +
+                    "Specify existing Widget Type id to update the Widget Type. " +
+                    "Referencing non-existing Widget Type Id will cause 'Not Found' error." +
+                    "\n\nWidget Type alias is unique in the scope of Widget Bundle. " +
+                    "Special Tenant Id '13814000-1dd2-11b2-8080-808080808080' is automatically used if the create request is sent by user with 'SYS_ADMIN' authority." +
+                    "Remove 'id', 'tenantId' rom the request body example (below) to create new Widget Type entity." +
+                    SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetType", method = RequestMethod.POST)
+    @ResponseBody
+    public WidgetTypeDetails saveWidgetType(
+            @ApiParam(value = "A JSON value representing the Widget Type Details.", required = true)
+            @RequestBody WidgetTypeDetails widgetTypeDetails) throws ThingsboardException {
+        try {
+            var currentUser = getCurrentUser();
+            if (Authority.SYS_ADMIN.equals(currentUser.getAuthority())) {
+                widgetTypeDetails.setTenantId(TenantId.SYS_TENANT_ID);
+            } else {
+                widgetTypeDetails.setTenantId(currentUser.getTenantId());
+            }
+
+            checkEntity(widgetTypeDetails.getId(), widgetTypeDetails, Resource.WIDGET_TYPE);
+            WidgetTypeDetails savedWidgetTypeDetails = widgetTypeService.saveWidgetType(widgetTypeDetails);
+
+            if (!Authority.SYS_ADMIN.equals(currentUser.getAuthority())) {
+                WidgetsBundle widgetsBundle = widgetsBundleService.findWidgetsBundleByTenantIdAndAlias(widgetTypeDetails.getTenantId(), widgetTypeDetails.getBundleAlias());
+                if (widgetsBundle != null) {
+                    autoCommit(currentUser, widgetsBundle.getId());
+                }
+            }
+
+            sendEntityNotificationMsg(getTenantId(), savedWidgetTypeDetails.getId(),
+                    widgetTypeDetails.getId() == null ? EdgeEventActionType.ADDED : EdgeEventActionType.UPDATED);
+
+            return checkNotNull(savedWidgetTypeDetails);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Delete widget type (deleteWidgetType)",
+            notes = "Deletes the  Widget Type. Referencing non-existing Widget Type Id will cause an error." + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetType/{widgetTypeId}", method = RequestMethod.DELETE)
+    @ResponseStatus(value = HttpStatus.OK)
+    public void deleteWidgetType(
+            @ApiParam(value = WIDGET_TYPE_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable("widgetTypeId") String strWidgetTypeId) throws ThingsboardException {
+        checkParameter("widgetTypeId", strWidgetTypeId);
+        try {
+            var currentUser = getCurrentUser();
+            WidgetTypeId widgetTypeId = new WidgetTypeId(toUUID(strWidgetTypeId));
+            WidgetTypeDetails wtd = checkWidgetTypeId(widgetTypeId, Operation.DELETE);
+            widgetTypeService.deleteWidgetType(currentUser.getTenantId(), widgetTypeId);
+
+            if (wtd != null && !Authority.SYS_ADMIN.equals(currentUser.getAuthority())) {
+                WidgetsBundle widgetsBundle = widgetsBundleService.findWidgetsBundleByTenantIdAndAlias(wtd.getTenantId(), wtd.getBundleAlias());
+                if (widgetsBundle != null) {
+                    autoCommit(currentUser, widgetsBundle.getId());
+                }
+            }
+
+            sendEntityNotificationMsg(getTenantId(), widgetTypeId, EdgeEventActionType.DELETED);
+
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get all Widget types for specified Bundle (getBundleWidgetTypes)",
+            notes = "Returns an array of Widget Type objects that belong to specified Widget Bundle." + WIDGET_TYPE_DESCRIPTION + " " + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetTypes", params = {"isSystem", "bundleAlias"}, method = RequestMethod.GET)
+    @ResponseBody
+    public List<WidgetType> getBundleWidgetTypes(
+            @ApiParam(value = "System or Tenant", required = true)
+            @RequestParam boolean isSystem,
+            @ApiParam(value = "Widget Bundle alias", required = true)
+            @RequestParam String bundleAlias) throws ThingsboardException {
+        try {
+            TenantId tenantId;
+            if (isSystem) {
+                tenantId = TenantId.SYS_TENANT_ID;
+            } else {
+                tenantId = getCurrentUser().getTenantId();
+            }
+            return checkNotNull(widgetTypeService.findWidgetTypesByTenantIdAndBundleAlias(tenantId, bundleAlias));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get all Widget types details for specified Bundle (getBundleWidgetTypes)",
+            notes = "Returns an array of Widget Type Details objects that belong to specified Widget Bundle." + WIDGET_TYPE_DETAILS_DESCRIPTION + " " + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetTypesDetails", params = {"isSystem", "bundleAlias"}, method = RequestMethod.GET)
+    @ResponseBody
+    public List<WidgetTypeDetails> getBundleWidgetTypesDetails(
+            @ApiParam(value = "System or Tenant", required = true)
+            @RequestParam boolean isSystem,
+            @ApiParam(value = "Widget Bundle alias", required = true)
+            @RequestParam String bundleAlias) throws ThingsboardException {
+        try {
+            TenantId tenantId;
+            if (isSystem) {
+                tenantId = TenantId.SYS_TENANT_ID;
+            } else {
+                tenantId = getCurrentUser().getTenantId();
+            }
+            return checkNotNull(widgetTypeService.findWidgetTypesDetailsByTenantIdAndBundleAlias(tenantId, bundleAlias));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Widget Type Info objects (getBundleWidgetTypesInfos)",
+            notes = "Get the Widget Type Info objects based on the provided parameters. " + WIDGET_TYPE_INFO_DESCRIPTION + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetTypesInfos", params = {"isSystem", "bundleAlias"}, method = RequestMethod.GET)
+    @ResponseBody
+    public List<WidgetTypeInfo> getBundleWidgetTypesInfos(
+            @ApiParam(value = "System or Tenant", required = true)
+            @RequestParam boolean isSystem,
+            @ApiParam(value = "Widget Bundle alias", required = true)
+            @RequestParam String bundleAlias) throws ThingsboardException {
+        try {
+            TenantId tenantId;
+            if (isSystem) {
+                tenantId = TenantId.SYS_TENANT_ID;
+            } else {
+                tenantId = getCurrentUser().getTenantId();
+            }
+            return checkNotNull(widgetTypeService.findWidgetTypesInfosByTenantIdAndBundleAlias(tenantId, bundleAlias));
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get Widget Type (getWidgetType)",
+            notes = "Get the Widget Type based on the provided parameters. " + WIDGET_TYPE_DESCRIPTION + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/widgetType", params = {"isSystem", "bundleAlias", "alias"}, method = RequestMethod.GET)
+    @ResponseBody
+    public WidgetType getWidgetType(
+            @ApiParam(value = "System or Tenant", required = true)
+            @RequestParam boolean isSystem,
+            @ApiParam(value = "Widget Bundle alias", required = true)
+            @RequestParam String bundleAlias,
+            @ApiParam(value = "Widget Type alias", required = true)
+            @RequestParam String alias) throws ThingsboardException {
+        try {
+            TenantId tenantId;
+            if (isSystem) {
+                tenantId = TenantId.fromUUID(ModelConstants.NULL_UUID);
+            } else {
+                tenantId = getCurrentUser().getTenantId();
+            }
+            WidgetType widgetType = widgetTypeService.findWidgetTypeByTenantIdBundleAliasAndAlias(tenantId, bundleAlias, alias);
+            checkNotNull(widgetType);
+            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGET_TYPE, Operation.READ, widgetType.getId(), widgetType);
+            return widgetType;
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.annotations.ApiOperation;
+import io.swagger.annotations.ApiParam;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.WidgetsBundleId;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.data.security.Authority;
+import org.thingsboard.server.common.data.widget.WidgetsBundle;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.entitiy.widgets.bundle.TbWidgetsBundleService;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+
+import java.util.List;
+
+import static org.thingsboard.server.controller.ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_DATA_PARAMETERS;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_NUMBER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_SIZE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERTY_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH;
+import static org.thingsboard.server.controller.ControllerConstants.UUID_WIKI_LINK;
+import static org.thingsboard.server.controller.ControllerConstants.WIDGET_BUNDLE_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.WIDGET_BUNDLE_SORT_PROPERTY_ALLOWABLE_VALUES;
+import static org.thingsboard.server.controller.ControllerConstants.WIDGET_BUNDLE_TEXT_SEARCH_DESCRIPTION;
+
+@RestController
+@TbCoreComponent
+@RequestMapping("/api")
+@RequiredArgsConstructor
+public class WidgetsBundleController extends BaseController {
+
+    private final TbWidgetsBundleService tbWidgetsBundleService;
+
+    private static final String WIDGET_BUNDLE_DESCRIPTION = "Widget Bundle represents a group(bundle) of widgets. Widgets are grouped into bundle by type or use case. ";
+
+    @ApiOperation(value = "Get Widget Bundle (getWidgetsBundleById)",
+            notes = "Get the Widget Bundle based on the provided Widget Bundle Id. " + WIDGET_BUNDLE_DESCRIPTION + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/widgetsBundle/{widgetsBundleId}", method = RequestMethod.GET)
+    @ResponseBody
+    public WidgetsBundle getWidgetsBundleById(
+            @ApiParam(value = WIDGET_BUNDLE_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable("widgetsBundleId") String strWidgetsBundleId) throws ThingsboardException {
+        checkParameter("widgetsBundleId", strWidgetsBundleId);
+        try {
+            WidgetsBundleId widgetsBundleId = new WidgetsBundleId(toUUID(strWidgetsBundleId));
+            return checkWidgetsBundleId(widgetsBundleId, Operation.READ);
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Create Or Update Widget Bundle (saveWidgetsBundle)",
+            notes = "Create or update the Widget Bundle. " + WIDGET_BUNDLE_DESCRIPTION + " " +
+                    "When creating the bundle, platform generates Widget Bundle Id as " + UUID_WIKI_LINK +
+                    "The newly created Widget Bundle Id will be present in the response. " +
+                    "Specify existing Widget Bundle id to update the Widget Bundle. " +
+                    "Referencing non-existing Widget Bundle Id will cause 'Not Found' error." +
+                    "\n\nWidget Bundle alias is unique in the scope of tenant. " +
+                    "Special Tenant Id '13814000-1dd2-11b2-8080-808080808080' is automatically used if the create bundle request is sent by user with 'SYS_ADMIN' authority." +
+                    "Remove 'id', 'tenantId' from the request body example (below) to create new Widgets Bundle entity." +
+                    SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetsBundle", method = RequestMethod.POST)
+    @ResponseBody
+    public WidgetsBundle saveWidgetsBundle(
+            @ApiParam(value = "A JSON value representing the Widget Bundle.", required = true)
+            @RequestBody WidgetsBundle widgetsBundle) throws Exception {
+        var currentUser = getCurrentUser();
+        if (Authority.SYS_ADMIN.equals(currentUser.getAuthority())) {
+            widgetsBundle.setTenantId(TenantId.SYS_TENANT_ID);
+        } else {
+            widgetsBundle.setTenantId(currentUser.getTenantId());
+        }
+
+        checkEntity(widgetsBundle.getId(), widgetsBundle, Resource.WIDGETS_BUNDLE);
+
+        return tbWidgetsBundleService.save(widgetsBundle, currentUser);
+    }
+
+    @ApiOperation(value = "Delete widgets bundle (deleteWidgetsBundle)",
+            notes = "Deletes the widget bundle. Referencing non-existing Widget Bundle Id will cause an error." + SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
+    @RequestMapping(value = "/widgetsBundle/{widgetsBundleId}", method = RequestMethod.DELETE)
+    @ResponseStatus(value = HttpStatus.OK)
+    public void deleteWidgetsBundle(
+            @ApiParam(value = WIDGET_BUNDLE_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable("widgetsBundleId") String strWidgetsBundleId) throws ThingsboardException {
+        checkParameter("widgetsBundleId", strWidgetsBundleId);
+        WidgetsBundleId widgetsBundleId = new WidgetsBundleId(toUUID(strWidgetsBundleId));
+        WidgetsBundle widgetsBundle = checkWidgetsBundleId(widgetsBundleId, Operation.DELETE);
+        tbWidgetsBundleService.delete(widgetsBundle);
+    }
+
+    @ApiOperation(value = "Get Widget Bundles (getWidgetsBundles)",
+            notes = "Returns a page of Widget Bundle objects available for current user. " + WIDGET_BUNDLE_DESCRIPTION + " " +
+                    PAGE_DATA_PARAMETERS + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/widgetsBundles", params = {"pageSize", "page"}, method = RequestMethod.GET)
+    @ResponseBody
+    public PageData<WidgetsBundle> getWidgetsBundles(
+            @ApiParam(value = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @ApiParam(value = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @ApiParam(value = WIDGET_BUNDLE_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @ApiParam(value = SORT_PROPERTY_DESCRIPTION, allowableValues = WIDGET_BUNDLE_SORT_PROPERTY_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortProperty,
+            @ApiParam(value = SORT_ORDER_DESCRIPTION, allowableValues = SORT_ORDER_ALLOWABLE_VALUES)
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        try {
+            PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+            if (Authority.SYS_ADMIN.equals(getCurrentUser().getAuthority())) {
+                return checkNotNull(widgetsBundleService.findSystemWidgetsBundlesByPageLink(getTenantId(), pageLink));
+            } else {
+                TenantId tenantId = getCurrentUser().getTenantId();
+                return checkNotNull(widgetsBundleService.findAllTenantWidgetsBundlesByTenantIdAndPageLink(tenantId, pageLink));
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+    @ApiOperation(value = "Get all Widget Bundles (getWidgetsBundles)",
+            notes = "Returns an array of Widget Bundle objects that are available for current user." + WIDGET_BUNDLE_DESCRIPTION + " " + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
+    @RequestMapping(value = "/widgetsBundles", method = RequestMethod.GET)
+    @ResponseBody
+    public List<WidgetsBundle> getWidgetsBundles() throws ThingsboardException {
+        try {
+            if (Authority.SYS_ADMIN.equals(getCurrentUser().getAuthority())) {
+                return checkNotNull(widgetsBundleService.findSystemWidgetsBundles(getTenantId()));
+            } else {
+                TenantId tenantId = getCurrentUser().getTenantId();
+                return checkNotNull(widgetsBundleService.findAllTenantWidgetsBundlesByTenantId(tenantId));
+            }
+        } catch (Exception e) {
+            throw handleException(e);
+        }
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/plugin/TbWebSocketHandler.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller.plugin;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.BeanCreationNotAllowedException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.core.Authentication;
+import org.springframework.stereotype.Service;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.PongMessage;
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.WebSocketSession;
+import org.springframework.web.socket.adapter.NativeWebSocketSession;
+import org.springframework.web.socket.handler.TextWebSocketHandler;
+import org.thingsboard.server.common.data.StringUtils;
+import org.thingsboard.server.common.data.TenantProfile;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+import org.thingsboard.server.common.data.id.CustomerId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.tenant.profile.DefaultTenantProfileConfiguration;
+import org.thingsboard.server.common.msg.tools.TbRateLimits;
+import org.thingsboard.server.config.WebSocketConfiguration;
+import org.thingsboard.server.dao.tenant.TbTenantProfileCache;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.model.UserPrincipal;
+import org.thingsboard.server.service.telemetry.SessionEvent;
+import org.thingsboard.server.service.telemetry.TelemetryWebSocketMsgEndpoint;
+import org.thingsboard.server.service.telemetry.TelemetryWebSocketService;
+import org.thingsboard.server.service.telemetry.TelemetryWebSocketSessionRef;
+
+import javax.websocket.RemoteEndpoint;
+import javax.websocket.SendHandler;
+import javax.websocket.SendResult;
+import javax.websocket.Session;
+import java.io.IOException;
+import java.net.URI;
+import java.security.InvalidParameterException;
+import java.util.Optional;
+import java.util.Queue;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.LinkedBlockingQueue;
+
+import static org.thingsboard.server.service.telemetry.DefaultTelemetryWebSocketService.NUMBER_OF_PING_ATTEMPTS;
+
+@Service
+@TbCoreComponent
+@Slf4j
+public class TbWebSocketHandler extends TextWebSocketHandler implements TelemetryWebSocketMsgEndpoint {
+
+    private static final ConcurrentMap<String, SessionMetaData> internalSessionMap = new ConcurrentHashMap<>();
+    private static final ConcurrentMap<String, String> externalSessionMap = new ConcurrentHashMap<>();
+
+
+    @Autowired
+    private TelemetryWebSocketService webSocketService;
+
+    @Autowired
+    private TbTenantProfileCache tenantProfileCache;
+
+    @Value("${server.ws.send_timeout:5000}")
+    private long sendTimeout;
+    @Value("${server.ws.ping_timeout:30000}")
+    private long pingTimeout;
+
+    private ConcurrentMap<String, TelemetryWebSocketSessionRef> blacklistedSessions = new ConcurrentHashMap<>();
+    private ConcurrentMap<String, TbRateLimits> perSessionUpdateLimits = new ConcurrentHashMap<>();
+
+    private ConcurrentMap<TenantId, Set<String>> tenantSessionsMap = new ConcurrentHashMap<>();
+    private ConcurrentMap<CustomerId, Set<String>> customerSessionsMap = new ConcurrentHashMap<>();
+    private ConcurrentMap<UserId, Set<String>> regularUserSessionsMap = new ConcurrentHashMap<>();
+    private ConcurrentMap<UserId, Set<String>> publicUserSessionsMap = new ConcurrentHashMap<>();
+
+    @Override
+    public void handleTextMessage(WebSocketSession session, TextMessage message) {
+        try {
+            SessionMetaData sessionMd = internalSessionMap.get(session.getId());
+            if (sessionMd != null) {
+                log.trace("[{}][{}] Processing {}", sessionMd.sessionRef.getSecurityCtx().getTenantId(), session.getId(), message.getPayload());
+                webSocketService.handleWebSocketMsg(sessionMd.sessionRef, message.getPayload());
+            } else {
+                log.trace("[{}] Failed to find session", session.getId());
+                session.close(CloseStatus.SERVER_ERROR.withReason("Session not found!"));
+            }
+        } catch (IOException e) {
+            log.warn("IO error", e);
+        }
+    }
+
+    @Override
+    protected void handlePongMessage(WebSocketSession session, PongMessage message) throws Exception {
+        try {
+            SessionMetaData sessionMd = internalSessionMap.get(session.getId());
+            if (sessionMd != null) {
+                log.trace("[{}][{}] Processing pong response {}", sessionMd.sessionRef.getSecurityCtx().getTenantId(), session.getId(), message.getPayload());
+                sessionMd.processPongMessage(System.currentTimeMillis());
+            } else {
+                log.trace("[{}] Failed to find session", session.getId());
+                session.close(CloseStatus.SERVER_ERROR.withReason("Session not found!"));
+            }
+        } catch (IOException e) {
+            log.warn("IO error", e);
+        }
+    }
+
+    @Override
+    public void afterConnectionEstablished(WebSocketSession session) throws Exception {
+        super.afterConnectionEstablished(session);
+        try {
+            if (session instanceof NativeWebSocketSession) {
+                Session nativeSession = ((NativeWebSocketSession) session).getNativeSession(Session.class);
+                if (nativeSession != null) {
+                    nativeSession.getAsyncRemote().setSendTimeout(sendTimeout);
+                }
+            }
+            String internalSessionId = session.getId();
+            TelemetryWebSocketSessionRef sessionRef = toRef(session);
+            String externalSessionId = sessionRef.getSessionId();
+
+            if (!checkLimits(session, sessionRef)) {
+                return;
+            }
+            var tenantProfileConfiguration = getTenantProfileConfiguration(sessionRef);
+            internalSessionMap.put(internalSessionId, new SessionMetaData(session, sessionRef,
+                    tenantProfileConfiguration != null && tenantProfileConfiguration.getWsMsgQueueLimitPerSession() > 0 ?
+                    tenantProfileConfiguration.getWsMsgQueueLimitPerSession() : 500));
+
+            externalSessionMap.put(externalSessionId, internalSessionId);
+            processInWebSocketService(sessionRef, SessionEvent.onEstablished());
+            log.info("[{}][{}][{}] Session is opened from address: {}", sessionRef.getSecurityCtx().getTenantId(), externalSessionId, session.getId(), session.getRemoteAddress());
+        } catch (InvalidParameterException e) {
+            log.warn("[{}] Failed to start session", session.getId(), e);
+            session.close(CloseStatus.BAD_DATA.withReason(e.getMessage()));
+        } catch (Exception e) {
+            log.warn("[{}] Failed to start session", session.getId(), e);
+            session.close(CloseStatus.SERVER_ERROR.withReason(e.getMessage()));
+        }
+    }
+
+    @Override
+    public void handleTransportError(WebSocketSession session, Throwable tError) throws Exception {
+        super.handleTransportError(session, tError);
+        SessionMetaData sessionMd = internalSessionMap.get(session.getId());
+        if (sessionMd != null) {
+            processInWebSocketService(sessionMd.sessionRef, SessionEvent.onError(tError));
+        } else {
+            log.trace("[{}] Failed to find session", session.getId());
+        }
+        log.trace("[{}] Session transport error", session.getId(), tError);
+    }
+
+    @Override
+    public void afterConnectionClosed(WebSocketSession session, CloseStatus closeStatus) throws Exception {
+        super.afterConnectionClosed(session, closeStatus);
+        SessionMetaData sessionMd = internalSessionMap.remove(session.getId());
+        if (sessionMd != null) {
+            cleanupLimits(session, sessionMd.sessionRef);
+            externalSessionMap.remove(sessionMd.sessionRef.getSessionId());
+            processInWebSocketService(sessionMd.sessionRef, SessionEvent.onClosed());
+            log.info("[{}][{}][{}] Session is closed", sessionMd.sessionRef.getSecurityCtx().getTenantId(), sessionMd.sessionRef.getSessionId(), session.getId());
+        } else {
+            log.info("[{}] Session is closed", session.getId());
+        }
+    }
+
+    private void processInWebSocketService(TelemetryWebSocketSessionRef sessionRef, SessionEvent event) {
+        try {
+            webSocketService.handleWebSocketSessionEvent(sessionRef, event);
+        } catch (BeanCreationNotAllowedException e) {
+            log.warn("[{}] Failed to close session due to possible shutdown state", sessionRef.getSessionId());
+        }
+    }
+
+    private TelemetryWebSocketSessionRef toRef(WebSocketSession session) throws IOException {
+        URI sessionUri = session.getUri();
+        String path = sessionUri.getPath();
+        path = path.substring(WebSocketConfiguration.WS_PLUGIN_PREFIX.length());
+        if (path.length() == 0) {
+            throw new IllegalArgumentException("URL should contain plugin token!");
+        }
+        String[] pathElements = path.split("/");
+        String serviceToken = pathElements[0];
+        if (!"telemetry".equalsIgnoreCase(serviceToken)) {
+            throw new InvalidParameterException("Can't find plugin with specified token!");
+        } else {
+            SecurityUser currentUser = (SecurityUser) ((Authentication) session.getPrincipal()).getPrincipal();
+            return new TelemetryWebSocketSessionRef(UUID.randomUUID().toString(), currentUser, session.getLocalAddress(), session.getRemoteAddress());
+        }
+    }
+
+    private class SessionMetaData implements SendHandler {
+        private final WebSocketSession session;
+        private final RemoteEndpoint.Async asyncRemote;
+        private final TelemetryWebSocketSessionRef sessionRef;
+
+        private volatile boolean isSending = false;
+        private final Queue<TbWebSocketMsg<?>> msgQueue;
+
+        private volatile long lastActivityTime;
+
+        SessionMetaData(WebSocketSession session, TelemetryWebSocketSessionRef sessionRef, int maxMsgQueuePerSession) {
+            super();
+            this.session = session;
+            Session nativeSession = ((NativeWebSocketSession) session).getNativeSession(Session.class);
+            this.asyncRemote = nativeSession.getAsyncRemote();
+            this.sessionRef = sessionRef;
+            this.msgQueue = new LinkedBlockingQueue<>(maxMsgQueuePerSession);
+            this.lastActivityTime = System.currentTimeMillis();
+        }
+
+        synchronized void sendPing(long currentTime) {
+            try {
+                long timeSinceLastActivity = currentTime - lastActivityTime;
+                if (timeSinceLastActivity >= pingTimeout) {
+                    log.warn("[{}] Closing session due to ping timeout", session.getId());
+                    closeSession(CloseStatus.SESSION_NOT_RELIABLE);
+                } else if (timeSinceLastActivity >= pingTimeout / NUMBER_OF_PING_ATTEMPTS) {
+                    sendMsg(TbWebSocketPingMsg.INSTANCE);
+                }
+            } catch (Exception e) {
+                log.trace("[{}] Failed to send ping msg", session.getId(), e);
+                closeSession(CloseStatus.SESSION_NOT_RELIABLE);
+            }
+        }
+
+        private void closeSession(CloseStatus reason) {
+            try {
+                close(this.sessionRef, reason);
+            } catch (IOException ioe) {
+                log.trace("[{}] Session transport error", session.getId(), ioe);
+            }
+        }
+
+        synchronized void processPongMessage(long currentTime) {
+            lastActivityTime = currentTime;
+        }
+
+        synchronized void sendMsg(String msg) {
+            sendMsg(new TbWebSocketTextMsg(msg));
+        }
+
+        synchronized void sendMsg(TbWebSocketMsg<?> msg) {
+            if (isSending) {
+                try {
+                    msgQueue.add(msg);
+                } catch (RuntimeException e) {
+                    if (log.isTraceEnabled()) {
+                        log.trace("[{}][{}] Session closed due to queue error", sessionRef.getSecurityCtx().getTenantId(), session.getId(), e);
+                    } else {
+                        log.info("[{}][{}] Session closed due to queue error", sessionRef.getSecurityCtx().getTenantId(), session.getId());
+                    }
+                    closeSession(CloseStatus.POLICY_VIOLATION.withReason("Max pending updates limit reached!"));
+                }
+            } else {
+                isSending = true;
+                sendMsgInternal(msg);
+            }
+        }
+
+        private void sendMsgInternal(TbWebSocketMsg<?> msg) {
+            try {
+                if (TbWebSocketMsgType.TEXT.equals(msg.getType())) {
+                    TbWebSocketTextMsg textMsg = (TbWebSocketTextMsg) msg;
+                    this.asyncRemote.sendText(textMsg.getMsg(), this);
+                } else {
+                    TbWebSocketPingMsg pingMsg = (TbWebSocketPingMsg) msg;
+                    this.asyncRemote.sendPing(pingMsg.getMsg());
+                    processNextMsg();
+                }
+            } catch (Exception e) {
+                log.trace("[{}] Failed to send msg", session.getId(), e);
+                closeSession(CloseStatus.SESSION_NOT_RELIABLE);
+            }
+        }
+
+        @Override
+        public void onResult(SendResult result) {
+            if (!result.isOK()) {
+                log.trace("[{}] Failed to send msg", session.getId(), result.getException());
+                closeSession(CloseStatus.SESSION_NOT_RELIABLE);
+            } else {
+                processNextMsg();
+            }
+        }
+
+        private void processNextMsg() {
+            TbWebSocketMsg<?> msg = msgQueue.poll();
+            if (msg != null) {
+                sendMsgInternal(msg);
+            } else {
+                isSending = false;
+            }
+        }
+    }
+
+    @Override
+    public void send(TelemetryWebSocketSessionRef sessionRef, int subscriptionId, String msg) throws IOException {
+        String externalId = sessionRef.getSessionId();
+        log.debug("[{}] Processing {}", externalId, msg);
+        String internalId = externalSessionMap.get(externalId);
+        if (internalId != null) {
+            SessionMetaData sessionMd = internalSessionMap.get(internalId);
+            if (sessionMd != null) {
+                var tenantProfileConfiguration = getTenantProfileConfiguration(sessionRef);
+                if (tenantProfileConfiguration != null) {
+                    if (StringUtils.isNotEmpty(tenantProfileConfiguration.getWsUpdatesPerSessionRateLimit())) {
+                        TbRateLimits rateLimits = perSessionUpdateLimits.computeIfAbsent(sessionRef.getSessionId(), sid -> new TbRateLimits(tenantProfileConfiguration.getWsUpdatesPerSessionRateLimit()));
+                        if (!rateLimits.tryConsume()) {
+                            if (blacklistedSessions.putIfAbsent(externalId, sessionRef) == null) {
+                                log.info("[{}][{}][{}] Failed to process session update. Max session updates limit reached"
+                                        , sessionRef.getSecurityCtx().getTenantId(), sessionRef.getSecurityCtx().getId(), externalId);
+                                sessionMd.sendMsg("{\"subscriptionId\":" + subscriptionId + ", \"errorCode\":" + ThingsboardErrorCode.TOO_MANY_UPDATES.getErrorCode() + ", \"errorMsg\":\"Too many updates!\"}");
+                            }
+                            return;
+                        } else {
+                            log.debug("[{}][{}][{}] Session is no longer blacklisted.", sessionRef.getSecurityCtx().getTenantId(), sessionRef.getSecurityCtx().getId(), externalId);
+                            blacklistedSessions.remove(externalId);
+                        }
+                    } else {
+                        perSessionUpdateLimits.remove(sessionRef.getSessionId());
+                    }
+                }
+                sessionMd.sendMsg(msg);
+            } else {
+                log.warn("[{}][{}] Failed to find session by internal id", externalId, internalId);
+            }
+        } else {
+            log.warn("[{}] Failed to find session by external id", externalId);
+        }
+    }
+
+    @Override
+    public void sendPing(TelemetryWebSocketSessionRef sessionRef, long currentTime) throws IOException {
+        String externalId = sessionRef.getSessionId();
+        String internalId = externalSessionMap.get(externalId);
+        if (internalId != null) {
+            SessionMetaData sessionMd = internalSessionMap.get(internalId);
+            if (sessionMd != null) {
+                sessionMd.sendPing(currentTime);
+            } else {
+                log.warn("[{}][{}] Failed to find session by internal id", externalId, internalId);
+            }
+        } else {
+            log.warn("[{}] Failed to find session by external id", externalId);
+        }
+    }
+
+    @Override
+    public void close(TelemetryWebSocketSessionRef sessionRef, CloseStatus reason) throws IOException {
+        String externalId = sessionRef.getSessionId();
+        log.debug("[{}] Processing close request", externalId);
+        String internalId = externalSessionMap.get(externalId);
+        if (internalId != null) {
+            SessionMetaData sessionMd = internalSessionMap.get(internalId);
+            if (sessionMd != null) {
+                sessionMd.session.close(reason);
+            } else {
+                log.warn("[{}][{}] Failed to find session by internal id", externalId, internalId);
+            }
+        } else {
+            log.warn("[{}] Failed to find session by external id", externalId);
+        }
+    }
+
+    private boolean checkLimits(WebSocketSession session, TelemetryWebSocketSessionRef sessionRef) throws Exception {
+        var tenantProfileConfiguration = getTenantProfileConfiguration(sessionRef);
+        if (tenantProfileConfiguration == null) {
+            return true;
+        }
+
+        String sessionId = session.getId();
+        if (tenantProfileConfiguration.getMaxWsSessionsPerTenant() > 0) {
+            Set<String> tenantSessions = tenantSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getTenantId(), id -> ConcurrentHashMap.newKeySet());
+            synchronized (tenantSessions) {
+                if (tenantSessions.size() < tenantProfileConfiguration.getMaxWsSessionsPerTenant()) {
+                    tenantSessions.add(sessionId);
+                } else {
+                    log.info("[{}][{}][{}] Failed to start session. Max tenant sessions limit reached"
+                            , sessionRef.getSecurityCtx().getTenantId(), sessionRef.getSecurityCtx().getId(), sessionId);
+                    session.close(CloseStatus.POLICY_VIOLATION.withReason("Max tenant sessions limit reached!"));
+                    return false;
+                }
+            }
+        }
+
+        if (sessionRef.getSecurityCtx().isCustomerUser()) {
+            if (tenantProfileConfiguration.getMaxWsSessionsPerCustomer() > 0) {
+                Set<String> customerSessions = customerSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getCustomerId(), id -> ConcurrentHashMap.newKeySet());
+                synchronized (customerSessions) {
+                    if (customerSessions.size() < tenantProfileConfiguration.getMaxWsSessionsPerCustomer()) {
+                        customerSessions.add(sessionId);
+                    } else {
+                        log.info("[{}][{}][{}] Failed to start session. Max customer sessions limit reached"
+                                , sessionRef.getSecurityCtx().getTenantId(), sessionRef.getSecurityCtx().getId(), sessionId);
+                        session.close(CloseStatus.POLICY_VIOLATION.withReason("Max customer sessions limit reached"));
+                        return false;
+                    }
+                }
+            }
+            if (tenantProfileConfiguration.getMaxWsSessionsPerRegularUser() > 0
+                    && UserPrincipal.Type.USER_NAME.equals(sessionRef.getSecurityCtx().getUserPrincipal().getType())) {
+                Set<String> regularUserSessions = regularUserSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getId(), id -> ConcurrentHashMap.newKeySet());
+                synchronized (regularUserSessions) {
+                    if (regularUserSessions.size() < tenantProfileConfiguration.getMaxWsSessionsPerRegularUser()) {
+                        regularUserSessions.add(sessionId);
+                    } else {
+                        log.info("[{}][{}][{}] Failed to start session. Max regular user sessions limit reached"
+                                , sessionRef.getSecurityCtx().getTenantId(), sessionRef.getSecurityCtx().getId(), sessionId);
+                        session.close(CloseStatus.POLICY_VIOLATION.withReason("Max regular user sessions limit reached"));
+                        return false;
+                    }
+                }
+            }
+            if (tenantProfileConfiguration.getMaxWsSessionsPerPublicUser() > 0
+                    && UserPrincipal.Type.PUBLIC_ID.equals(sessionRef.getSecurityCtx().getUserPrincipal().getType())) {
+                Set<String> publicUserSessions = publicUserSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getId(), id -> ConcurrentHashMap.newKeySet());
+                synchronized (publicUserSessions) {
+                    if (publicUserSessions.size() < tenantProfileConfiguration.getMaxWsSessionsPerPublicUser()) {
+                        publicUserSessions.add(sessionId);
+                    } else {
+                        log.info("[{}][{}][{}] Failed to start session. Max public user sessions limit reached"
+                                , sessionRef.getSecurityCtx().getTenantId(), sessionRef.getSecurityCtx().getId(), sessionId);
+                        session.close(CloseStatus.POLICY_VIOLATION.withReason("Max public user sessions limit reached"));
+                        return false;
+                    }
+                }
+            }
+        }
+        return true;
+    }
+
+    private void cleanupLimits(WebSocketSession session, TelemetryWebSocketSessionRef sessionRef) {
+        var tenantProfileConfiguration = getTenantProfileConfiguration(sessionRef);
+        if (tenantProfileConfiguration == null) return;
+
+        String sessionId = session.getId();
+        perSessionUpdateLimits.remove(sessionRef.getSessionId());
+        blacklistedSessions.remove(sessionRef.getSessionId());
+        if (tenantProfileConfiguration.getMaxWsSessionsPerTenant() > 0) {
+            Set<String> tenantSessions = tenantSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getTenantId(), id -> ConcurrentHashMap.newKeySet());
+            synchronized (tenantSessions) {
+                tenantSessions.remove(sessionId);
+            }
+        }
+        if (sessionRef.getSecurityCtx().isCustomerUser()) {
+            if (tenantProfileConfiguration.getMaxWsSessionsPerCustomer() > 0) {
+                Set<String> customerSessions = customerSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getCustomerId(), id -> ConcurrentHashMap.newKeySet());
+                synchronized (customerSessions) {
+                    customerSessions.remove(sessionId);
+                }
+            }
+            if (tenantProfileConfiguration.getMaxWsSessionsPerRegularUser() > 0 && UserPrincipal.Type.USER_NAME.equals(sessionRef.getSecurityCtx().getUserPrincipal().getType())) {
+                Set<String> regularUserSessions = regularUserSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getId(), id -> ConcurrentHashMap.newKeySet());
+                synchronized (regularUserSessions) {
+                    regularUserSessions.remove(sessionId);
+                }
+            }
+            if (tenantProfileConfiguration.getMaxWsSessionsPerPublicUser() > 0 && UserPrincipal.Type.PUBLIC_ID.equals(sessionRef.getSecurityCtx().getUserPrincipal().getType())) {
+                Set<String> publicUserSessions = publicUserSessionsMap.computeIfAbsent(sessionRef.getSecurityCtx().getId(), id -> ConcurrentHashMap.newKeySet());
+                synchronized (publicUserSessions) {
+                    publicUserSessions.remove(sessionId);
+                }
+            }
+        }
+    }
+
+    private DefaultTenantProfileConfiguration getTenantProfileConfiguration(TelemetryWebSocketSessionRef sessionRef) {
+        return Optional.ofNullable(tenantProfileCache.get(sessionRef.getSecurityCtx().getTenantId()))
+                .map(TenantProfile::getDefaultProfileConfiguration).orElse(null);
+    }
+
+}
\ No newline at end of file

application/src/main/java/org/thingsboard/server/controller/plugin/TbWebSocketMsg.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller.plugin;
+
+public interface TbWebSocketMsg<T> {
+
+    TbWebSocketMsgType getType();
+
+    T getMsg();
+
+}

application/src/main/java/org/thingsboard/server/controller/plugin/TbWebSocketMsgType.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller.plugin;
+
+public enum TbWebSocketMsgType {
+
+    PING, TEXT
+}

application/src/main/java/org/thingsboard/server/controller/plugin/TbWebSocketPingMsg.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller.plugin;
+
+import lombok.RequiredArgsConstructor;
+
+import java.nio.ByteBuffer;
+
+@RequiredArgsConstructor
+public class TbWebSocketPingMsg implements TbWebSocketMsg<ByteBuffer> {
+
+    public static TbWebSocketPingMsg INSTANCE = new TbWebSocketPingMsg();
+
+    private static final ByteBuffer PING_MSG = ByteBuffer.wrap(new byte[]{});
+
+    @Override
+    public TbWebSocketMsgType getType() {
+        return TbWebSocketMsgType.PING;
+    }
+
+    @Override
+    public ByteBuffer getMsg() {
+        return PING_MSG;
+    }
+}

application/src/main/java/org/thingsboard/server/controller/plugin/TbWebSocketTextMsg.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller.plugin;
+
+import lombok.RequiredArgsConstructor;
+
+@RequiredArgsConstructor
+public class TbWebSocketTextMsg implements TbWebSocketMsg<String> {
+
+    private final String value;
+
+    @Override
+    public TbWebSocketMsgType getType() {
+        return TbWebSocketMsgType.TEXT;
+    }
+
+    @Override
+    public String getMsg() {
+        return value;
+    }
+}

application/src/main/java/org/thingsboard/server/exception/ThingsboardCredentialsExpiredResponse.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.exception;
+
+import io.swagger.annotations.ApiModel;
+import io.swagger.annotations.ApiModelProperty;
+import org.springframework.http.HttpStatus;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+
+@ApiModel
+public class ThingsboardCredentialsExpiredResponse extends ThingsboardErrorResponse {
+
+    private final String resetToken;
+
+    protected ThingsboardCredentialsExpiredResponse(String message, String resetToken) {
+        super(message, ThingsboardErrorCode.CREDENTIALS_EXPIRED, HttpStatus.UNAUTHORIZED);
+        this.resetToken = resetToken;
+    }
+
+    public static ThingsboardCredentialsExpiredResponse of(final String message, final String resetToken) {
+        return new ThingsboardCredentialsExpiredResponse(message, resetToken);
+    }
+
+    @ApiModelProperty(position = 5, value = "Password reset token", accessMode = ApiModelProperty.AccessMode.READ_ONLY)
+    public String getResetToken() {
+        return resetToken;
+    }
+}

application/src/main/java/org/thingsboard/server/exception/ThingsboardErrorResponse.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.exception;
+
+import io.swagger.annotations.ApiModel;
+import io.swagger.annotations.ApiModelProperty;
+import org.springframework.http.HttpStatus;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+
+import java.util.Date;
+
+@ApiModel
+public class ThingsboardErrorResponse {
+    // HTTP Response Status Code
+    private final HttpStatus status;
+
+    // General Error message
+    private final String message;
+
+    // Error code
+    private final ThingsboardErrorCode errorCode;
+
+    private final Date timestamp;
+
+    protected ThingsboardErrorResponse(final String message, final ThingsboardErrorCode errorCode, HttpStatus status) {
+        this.message = message;
+        this.errorCode = errorCode;
+        this.status = status;
+        this.timestamp = new java.util.Date();
+    }
+
+    public static ThingsboardErrorResponse of(final String message, final ThingsboardErrorCode errorCode, HttpStatus status) {
+        return new ThingsboardErrorResponse(message, errorCode, status);
+    }
+
+    @ApiModelProperty(position = 1, value = "HTTP Response Status Code", example = "401", accessMode = ApiModelProperty.AccessMode.READ_ONLY)
+    public Integer getStatus() {
+        return status.value();
+    }
+
+    @ApiModelProperty(position = 2, value = "Error message", example = "Authentication failed", accessMode = ApiModelProperty.AccessMode.READ_ONLY)
+    public String getMessage() {
+        return message;
+    }
+
+    @ApiModelProperty(position = 3, value = "Platform error code:" +
+            "\n* `2` - General error (HTTP: 500 - Internal Server Error)" +
+            "\n\n* `10` - Authentication failed (HTTP: 401 - Unauthorized)" +
+            "\n\n* `11` - JWT token expired (HTTP: 401 - Unauthorized)" +
+            "\n\n* `15` - Credentials expired (HTTP: 401 - Unauthorized)" +
+            "\n\n* `20` - Permission denied (HTTP: 403 - Forbidden)" +
+            "\n\n* `30` - Invalid arguments (HTTP: 400 - Bad Request)" +
+            "\n\n* `31` - Bad request params (HTTP: 400 - Bad Request)" +
+            "\n\n* `32` - Item not found (HTTP: 404 - Not Found)" +
+            "\n\n* `33` - Too many requests (HTTP: 429 - Too Many Requests)" +
+            "\n\n* `34` - Too many updates (Too many updates over Websocket session)" +
+            "\n\n* `40` - Subscription violation (HTTP: 403 - Forbidden)",
+            example = "10", dataType = "integer",
+            accessMode = ApiModelProperty.AccessMode.READ_ONLY)
+    public ThingsboardErrorCode getErrorCode() {
+        return errorCode;
+    }
+
+    @ApiModelProperty(position = 4, value = "Timestamp", accessMode = ApiModelProperty.AccessMode.READ_ONLY)
+    public Date getTimestamp() {
+        return timestamp;
+    }
+}

application/src/main/java/org/thingsboard/server/exception/ThingsboardErrorResponseHandler.java

+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.exception;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.lang.Nullable;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.DisabledException;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.web.access.AccessDeniedHandler;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.client.HttpClientErrorException;
+import org.springframework.web.context.request.WebRequest;
+import org.springframework.web.servlet.mvc.method.annotation.ResponseEntityExceptionHandler;
+import org.springframework.web.util.WebUtils;
+import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.msg.tools.TbRateLimitsException;
+import org.thingsboard.server.service.security.exception.AuthMethodNotSupportedException;
+import org.thingsboard.server.service.security.exception.JwtExpiredTokenException;
+import org.thingsboard.server.service.security.exception.UserPasswordExpiredException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+@Slf4j
+@RestControllerAdvice
+public class ThingsboardErrorResponseHandler extends ResponseEntityExceptionHandler implements AccessDeniedHandler {
+
+    private static final Map<HttpStatus, ThingsboardErrorCode> statusToErrorCodeMap = new HashMap<>();
+    static {
+        statusToErrorCodeMap.put(HttpStatus.BAD_REQUEST, ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+        statusToErrorCodeMap.put(HttpStatus.UNAUTHORIZED, ThingsboardErrorCode.AUTHENTICATION);
+        statusToErrorCodeMap.put(HttpStatus.FORBIDDEN, ThingsboardErrorCode.PERMISSION_DENIED);
+        statusToErrorCodeMap.put(HttpStatus.NOT_FOUND, ThingsboardErrorCode.ITEM_NOT_FOUND);
+        statusToErrorCodeMap.put(HttpStatus.METHOD_NOT_ALLOWED, ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+        statusToErrorCodeMap.put(HttpStatus.NOT_ACCEPTABLE, ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+        statusToErrorCodeMap.put(HttpStatus.UNSUPPORTED_MEDIA_TYPE, ThingsboardErrorCode.BAD_REQUEST_PARAMS);
+        statusToErrorCodeMap.put(HttpStatus.TOO_MANY_REQUESTS, ThingsboardErrorCode.TOO_MANY_REQUESTS);
+        statusToErrorCodeMap.put(HttpStatus.INTERNAL_SERVER_ERROR, ThingsboardErrorCode.GENERAL);
+        statusToErrorCodeMap.put(HttpStatus.SERVICE_UNAVAILABLE, ThingsboardErrorCode.GENERAL);
+    }
+    private static final Map<ThingsboardErrorCode, HttpStatus> errorCodeToStatusMap = new HashMap<>();
+    static {
+        errorCodeToStatusMap.put(ThingsboardErrorCode.GENERAL, HttpStatus.INTERNAL_SERVER_ERROR);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.JWT_TOKEN_EXPIRED, HttpStatus.UNAUTHORIZED);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.CREDENTIALS_EXPIRED, HttpStatus.UNAUTHORIZED);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.PERMISSION_DENIED, HttpStatus.FORBIDDEN);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.INVALID_ARGUMENTS, HttpStatus.BAD_REQUEST);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.BAD_REQUEST_PARAMS, HttpStatus.BAD_REQUEST);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.ITEM_NOT_FOUND, HttpStatus.NOT_FOUND);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.TOO_MANY_REQUESTS, HttpStatus.TOO_MANY_REQUESTS);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.TOO_MANY_UPDATES, HttpStatus.TOO_MANY_REQUESTS);
+        errorCodeToStatusMap.put(ThingsboardErrorCode.SUBSCRIPTION_VIOLATION, HttpStatus.FORBIDDEN);
+    }
+
+    private static ThingsboardErrorCode statusToErrorCode(HttpStatus status) {
+        return statusToErrorCodeMap.getOrDefault(status, ThingsboardErrorCode.GENERAL);
+    }
+
+    private static HttpStatus errorCodeToStatus(ThingsboardErrorCode errorCode) {
+        return errorCodeToStatusMap.getOrDefault(errorCode, HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+
+    @Autowired
+    private ObjectMapper mapper;
+
+    @Override
+    @ExceptionHandler(AccessDeniedException.class)
+    public void handle(HttpServletRequest request, HttpServletResponse response,
+                       AccessDeniedException accessDeniedException) throws IOException,
+            ServletException {
+        if (!response.isCommitted()) {
+            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+            response.setStatus(HttpStatus.FORBIDDEN.value());
+            mapper.writeValue(response.getWriter(),
+                    ThingsboardErrorResponse.of("You don't have permission to perform this operation!",
+                            ThingsboardErrorCode.PERMISSION_DENIED, HttpStatus.FORBIDDEN));
+        }
+    }
+
+    @ExceptionHandler(Exception.class)
+    public void handle(Exception exception, HttpServletResponse response) {
+        log.debug("Processing exception {}", exception.getMessage(), exception);
+        if (!response.isCommitted()) {
+            try {
+                response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+
+                if (exception instanceof ThingsboardException) {
+                    ThingsboardException thingsboardException = (ThingsboardException) exception;
+                    if (thingsboardException.getErrorCode() == ThingsboardErrorCode.SUBSCRIPTION_VIOLATION) {
+                        handleSubscriptionException((ThingsboardException) exception, response);
+                    } else {
+                        handleThingsboardException((ThingsboardException) exception, response);
+                    }
+                } else if (exception instanceof TbRateLimitsException) {
+                    handleRateLimitException(response, (TbRateLimitsException) exception);
+                } else if (exception instanceof AccessDeniedException) {
+                    handleAccessDeniedException(response);
+                } else if (exception instanceof AuthenticationException) {
+                    handleAuthenticationException((AuthenticationException) exception, response);
+                } else {
+                    response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
+                    mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of(exception.getMessage(),
+                            ThingsboardErrorCode.GENERAL, HttpStatus.INTERNAL_SERVER_ERROR));
+                }
+            } catch (IOException e) {
+                log.error("Can't handle exception", e);
+            }
+        }
+    }
+
+    @Override
+    protected ResponseEntity<Object> handleExceptionInternal(
+            Exception ex, @Nullable Object body,
+            HttpHeaders headers, HttpStatus status,
+            WebRequest request) {
+        if (HttpStatus.INTERNAL_SERVER_ERROR.equals(status)) {
+            request.setAttribute(WebUtils.ERROR_EXCEPTION_ATTRIBUTE, ex, WebRequest.SCOPE_REQUEST);
+        }
+        ThingsboardErrorCode errorCode = statusToErrorCode(status);
+        return new ResponseEntity<>(ThingsboardErrorResponse.of(ex.getMessage(), errorCode, status), headers, status);
+    }
+
+    private void handleThingsboardException(ThingsboardException thingsboardException, HttpServletResponse response) throws IOException {
+        ThingsboardErrorCode errorCode = thingsboardException.getErrorCode();
+        HttpStatus status = errorCodeToStatus(errorCode);
+        response.setStatus(status.value());
+        mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of(thingsboardException.getMessage(), errorCode, status));
+    }
+
+    private void handleRateLimitException(HttpServletResponse response, TbRateLimitsException exception) throws IOException {
+        response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
+        String message = "Too many requests for current " + exception.getEntityType().name().toLowerCase() + "!";
+        mapper.writeValue(response.getWriter(),
+                ThingsboardErrorResponse.of(message,
+                        ThingsboardErrorCode.TOO_MANY_REQUESTS, HttpStatus.TOO_MANY_REQUESTS));
+    }
+
+    private void handleSubscriptionException(ThingsboardException subscriptionException, HttpServletResponse response) throws IOException {
+        response.setStatus(HttpStatus.FORBIDDEN.value());
+        mapper.writeValue(response.getWriter(),
+                (new ObjectMapper()).readValue(((HttpClientErrorException) subscriptionException.getCause()).getResponseBodyAsByteArray(), Object.class));
+    }
+
+    private void handleAccessDeniedException(HttpServletResponse response) throws IOException {
+        response.setStatus(HttpStatus.FORBIDDEN.value());
+        mapper.writeValue(response.getWriter(),
+                ThingsboardErrorResponse.of("You don't have permission to perform this operation!",
+                        ThingsboardErrorCode.PERMISSION_DENIED, HttpStatus.FORBIDDEN));
+
+    }
+
+    private void handleAuthenticationException(AuthenticationException authenticationException, HttpServletResponse response) throws IOException {
+        response.setStatus(HttpStatus.UNAUTHORIZED.value());
+        if (authenticationException instanceof BadCredentialsException || authenticationException instanceof UsernameNotFoundException) {
+            mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of("Invalid username or password", ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
+        } else if (authenticationException instanceof DisabledException) {
+            mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of("User account is not active", ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
+        } else if (authenticationException instanceof LockedException) {
+            mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of("User account is locked due to security policy", ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
+        } else if (authenticationException instanceof JwtExpiredTokenException) {
+            mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of("Token has expired", ThingsboardErrorCode.JWT_TOKEN_EXPIRED, HttpStatus.UNAUTHORIZED));
+        } else if (authenticationException instanceof AuthMethodNotSupportedException) {
+            mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of(authenticationException.getMessage(), ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
+        } else if (authenticationException instanceof UserPasswordExpiredException) {
+            UserPasswordExpiredException expiredException = (UserPasswordExpiredException) authenticationException;
+            String resetToken = expiredException.getResetToken();
+            mapper.writeValue(response.getWriter(), ThingsboardCredentialsExpiredResponse.of(expiredException.getMessage(), resetToken));
+        } else {
+            mapper.writeValue(response.getWriter(), ThingsboardErrorResponse.of("Authentication failed", ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
+        }
+    }
+
+}