8. Resource Access Control

This tutorial covers setting fine-grained access control on hardware resources, including time-based expiration, usage limits, and indefinite access grants.

Overview

Hardware access control allows resource owners to:

Grant access to specific users (identities)
Set expiration dates for temporary access
Limit number of uses
Create indefinite access for trusted partners
Revoke access at any time
Track resource usage

Access Control Features

Time-Based: Access expires at specific date/time
Usage-Based: Access limited to N uses
Combined: Both time AND usage limits
Indefinite: Permanent access (overrides limits)
Owner Priority: Owner always has full access

Prerequisites

Completed Hardware Registration tutorial
Completed Role Management tutorial
Registered hardware that you own
RESOURCE_OWNER_ROLE or resource ownership for granting access

Required Roles

Access Control Roles

Access control operations require specific roles:

Role	Purpose	Required For
`ACCESS_MANAGER_ROLE`	Grant/revoke access to ANY resource	Managing access to any resource in the system
`RESOURCE_OWNER_ROLE`	Grant/revoke access to OWNED resources	Managing access to your own resources

Authorization Patterns

To grant/revoke access (Steps 1, 4, 5):

You own the resource (registered it), OR
You have ACCESS_MANAGER_ROLE (can manage any resource), OR
You have RESOURCE_OWNER_ROLE AND own the resource

To check access (Step 3):

No role required (public read operation)

Role Hierarchy

ADMIN_ROLE
├── ACCESS_MANAGER_ROLE (can manage any resource)
└── RESOURCE_OWNER_ROLE (can manage owned resources)

See the Role Management tutorial to understand how to obtain these roles.

Access Control Concepts

Resource Types

Access control applies to three resource types:

Resource Type	Value	Description
Hardware	`"hardware"`	Computational resources
Dataset	`"dataset"`	Training/testing datasets
AI Model	`"ai_model"`	Trained AI models

Access Constraints

Constraint	Type	Description
`expirationTime`	number	Unix timestamp when access expires (0 = never)
`usageLimit`	number	Maximum number of uses (0 = unlimited)
`indefinite`	boolean	Permanent access (overrides other constraints)

Access Check Logic

if (user is resource owner):
    return GRANTED

if (access.indefinite == true):
    return GRANTED

if (expirationTime == 0 AND usageLimit == 0):
    return DENIED

if (expirationTime > now OR expirationTime == 0):
    if (usedCount < usageLimit OR usageLimit == 0):
        return GRANTED

return DENIED

Step 1: Grant Access to Hardware

Allow another identity to use your hardware resource.

Endpoint

POST /api/v1/access/grant-access

Request

curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/grant-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: {SESSION_ID}" \
  -d '{
    "walletId": "00000a4c7d2e9f1b8e5a3c6d",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb7",
    "did": "did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
    "resourceId": "0x2a8f1b4e7c9d3e5f6a8b1c4d7e9f2a5b3c6d8e1f4a7b9c2d5e8f1a4b7c9d2e5f",
    "resourceType": "hardware",
    "expirationTime": 1735689600,
    "usageLimit": 100,
    "indefinite": false
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    await access_api.access_grant_access_post(
        daiedge_middleware_client.GrantAccessBody(
            wallet_id="00000a4c7d2e9f1b8e5a3c6d",
            password="WalletPass123!",
            user_did="did:ethr:development:0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb7",
            did="did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
            resource_id="0x2a8f1b4e7c9d3e5f6a8b1c4d7e9f2a5b3c6d8e1f4a7b9c2d5e8f1a4b7c9d2e5f",
            resource_type="hardware",
            expiration_time=1735689600,
            usage_limit=100,
            indefinite=False,
        )
    )
    print("Access granted")

Request Body

Field	Type	Required	Description
`walletId`	string	Yes	Your wallet ID
`password`	string	Yes	Wallet password
`userDID`	string	Yes	Your identity DID (resource owner or access manager, format: `did:ethr:{network}:0x...`)
`did`	string	Yes	Identity DID to grant access to (format: `did:ethr:{network}:0x...`)
`resourceId`	string	Yes	Hardware ID from registration
`resourceType`	string	Yes	Must be `"hardware"`, `"dataset"`, or `"ai_model"`
`expirationTime`	number	No	Unix timestamp (seconds), 0 = never expires
`usageLimit`	number	No	Maximum uses, 0 = unlimited
`indefinite`	boolean	No	true = permanent access

Resource Types

"hardware"   // Hardware resources
"dataset"    // Datasets
"ai_model"   // AI models

Response (200 OK)

{}

Success returns an empty response. Access grant is recorded on blockchain.

Error Responses

Code	Error	Cause
404	`WALLET_NOT_FOUND`	Wallet doesn’t exist
400	`WRONG_PASSWORD`	Wallet password incorrect
400	`INVALID_USER_DID`	User DID format invalid
400	`INVALID_DID`	Identity format invalid
400	`INVALID_RESOURCE`	Resource ID empty
400	`INVALID_EXPIRATION_TIME`	Expiration time negative
400	`INVALID_USAGE_LIMIT`	Usage limit negative
403	`INVALID_WALLET`	Wallet doesn’t belong to you
500	`TRANSACTION_ERROR`	Blockchain transaction failed (may be authorization issue)

Authorization

You can grant access if:

You own the resource (identity that registered it), OR
You have ACCESS_MANAGER_ROLE, OR
You have RESOURCE_OWNER_ROLE AND own this resource

Step 2: Access Grant Patterns

Pattern 1: Time-Limited Access

Grant access until a specific date:

# Access expires on January 1, 2025 at midnight UTC
curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/grant-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: $SESSION_ID" \
  -d '{
    "walletId": "00000b5d8e3f2a1c9d7e4b6f",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x9cA2d14B5F8E3C1a7D2e6B4f9C8a1E5d3B7f6A9c",
    "did": "did:ethr:development:0x3E7b2A9c5D1f8E4b6C9a2D5e8F1a3B6c9D2e5F8a",
    "resourceId": "0x5f2a8b1e4c7d9f3e6a8b2c5d8e1f4a7b9c3d6e9f2a5b8c1e4d7f9a3b6c8e2d5f",
    "resourceType": "hardware",
    "expirationTime": 1735689600,
    "usageLimit": 0,
    "indefinite": false
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    await access_api.access_grant_access_post(
        daiedge_middleware_client.GrantAccessBody(
            wallet_id="00000b5d8e3f2a1c9d7e4b6f",
            password="WalletPass123!",
            user_did="did:ethr:development:0x742d35Cc...",
            did="did:ethr:development:0x8Ba1f109...",
            resource_id="0x5f2a8b1e4c7d9f3e6a8b2c5d...",
            resource_type="hardware",
            expiration_time=1735689600,  # expires Jan 1, 2025
            usage_limit=0,
            indefinite=False,
        )
    )

Use Cases:

Trial periods
Temporary collaborations
Time-bound contracts

Pattern 2: Usage-Limited Access

Grant access for a limited number of uses:

# Maximum 100 uses, no time limit
curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/grant-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: $SESSION_ID" \
  -d '{
    "walletId": "00000c6e9f4a3b2d8e5c7f1a",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x4D8e3B1a9C6f2E5b7A3d6C9e2F5a8B1c4D7e9F2a",
    "did": "did:ethr:development:0x6F2a5D8b1C4e7A9c3B6d9E2f5A8b1C4d7E9f2A5b",
    "resourceId": "0x9c3e6f2a8b1d4e7f9a2c5e8b1d4f7a9c2e5f8b1c4d7e9f2a5b8c1d4e7f9a2c5e",
    "resourceType": "hardware",
    "expirationTime": 0,
    "usageLimit": 100,
    "indefinite": false
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    await access_api.access_grant_access_post(
        daiedge_middleware_client.GrantAccessBody(
            wallet_id="00000c6e9f4a3b2d8e5c7f1a",
            password="WalletPass123!",
            user_did="did:ethr:development:0x742d35Cc...",
            did="did:ethr:development:0x8Ba1f109...",
            resource_id="0x9c3e6f2a8b1d4e7f9a2c5e8b...",
            resource_type="hardware",
            expiration_time=0,
            usage_limit=100,  # max 100 uses
            indefinite=False,
        )
    )

Use Cases:

Pay-per-use models
Metered access
Credit-based systems

Pattern 3: Time AND Usage Limited

Combine both constraints (whichever comes first):

# Expires Jan 1, 2025 OR after 50 uses, whichever comes first
curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/grant-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: $SESSION_ID" \
  -d '{
    "walletId": "00000d7f8a2b5c9e3d6f1a4b",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x7A2c4E9b1D6f8C3a5B7d9E2f4A8c1B5d7E9f2A4b",
    "did": "did:ethr:development:0x2B5d7F9a3C6e8A1c4D7f9B2e5A8c1D4f7B9e2A5c",
    "resourceId": "0x1d4f7b9e2c5a8d1f4a7c9e2b5d8f1a4c7e9b2d5f8a1c4e7f9b2d5a8c1e4f7b9e",
    "resourceType": "hardware",
    "expirationTime": 1735689600,
    "usageLimit": 50,
    "indefinite": false
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    await access_api.access_grant_access_post(
        daiedge_middleware_client.GrantAccessBody(
            wallet_id="00000d7f8a2b5c9e3d6f1a4b",
            password="WalletPass123!",
            user_did="did:ethr:development:0x742d35Cc...",
            did="did:ethr:development:0x8Ba1f109...",
            resource_id="0x1d4f7b9e2c5a8d1f4a7c9e2b...",
            resource_type="hardware",
            expiration_time=1735689600,
            usage_limit=50,
            indefinite=False,
        )
    )

Use Cases:

Subscription + usage caps
Trial with usage limits
Hybrid billing models

Pattern 4: Indefinite Access

Grant permanent access (overrides all limits):

# Permanent access for trusted partner
curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/grant-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: $SESSION_ID" \
  -d '{
    "walletId": "00000e8a9b3c6d2f7e4a1b5c",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x8C3e5A1d7B9f2C4a6D8e1F3b5A7c9E2d4F6b8A1c",
    "did": "did:ethr:development:0x5A7c9F2b4D6e8A1c3E5f7B9d2A4c6E8f1B3d5A7c",
    "resourceId": "0x3e6a9c2f5b8d1e4a7c9f2b5e8a1d4f7b9c2e5f8a1d4e7b9c2f5a8d1e4f7b9c2e",
    "resourceType": "hardware",
    "expirationTime": 0,
    "usageLimit": 0,
    "indefinite": true
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
  access_api = daiedge_middleware_client.AccessControlApi(api_client)
  await access_api.access_grant_access_post(
      daiedge_middleware_client.GrantAccessBody(
          wallet_id="00000e8a9b3c6d2f7e4a1b5c",
          password="WalletPass123!",
          user_did="did:ethr:development:0x742d35Cc...",
          did="did:ethr:development:0x8Ba1f109...",
          resource_id="0x3e6a9c2f5b8d1e4a7c9f2b5e...",
          resource_type="hardware",
          expiration_time=0,
          usage_limit=0,
          indefinite=True,  # permanent access
      )
  )

Use Cases:

Long-term partnerships
Internal team members
Subsidiary organizations

Pattern 5: Public/No Access

Default state - no access granted:

# No access (default state)
{
  "expirationTime": 0,
  "usageLimit": 0,
  "indefinite": false
}
# Result: Access DENIED

Step 3: Check Access

Verify if an identity has access to a resource.

Endpoint

GET /api/v1/access?did={did}&resourceId={resourceId}

Request

curl -X GET "https://middleware-daiedge.bisite.usal.es/api/v1/access?did=did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72&resourceId=0x7f2b5e8a1c4d9f3e6a8c1d4f7b9e2a5c8d1f4a7b9c2e5f8a1d4f7b9c2e5a8d1f"

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    result = await access_api.access_get(
        did="did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
        resource_id="0x7f2b5e8a1c4d9f3e6a8c1d4f7b9e2a5c8d1f4a7b9c2e5f8a1d4f7b9c2e5a8d1f",
    )
    print(f"has access: {result.result}")

Query Parameters

Parameter	Type	Required	Description
`did`	string	Yes	Identity DID to check access for
`resourceId`	string	Yes	Resource ID to check

Response (200 OK)

{
  "result": true
}

Returns true if access granted, false if denied.

Error Responses

Code	Error	Cause
400	`INVALID_DID`	Identity format invalid
400	`INVALID_RESOURCE`	Resource ID empty
500	`TRANSACTION_ERROR`	Blockchain query failed

Step 4: Revoke Access

Remove access from an identity.

Endpoint

POST /api/v1/access/revoke-access

Request

curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/revoke-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: {SESSION_ID}" \
  -d '{
    "walletId": "00000f9b8a7c6d5e4f3a2b1c",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb7",
    "did": "did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
    "resourceId": "0x4c7e9a2d5f8b1c4e7a9d2f5b8c1e4a7d9f2b5c8e1d4f7a9c2e5f8b1d4e7a9c2f",
    "resourceType": "hardware"
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    await access_api.access_revoke_access_post(
        daiedge_middleware_client.RevokeAccessBody(
            wallet_id="00000f9b8a7c6d5e4f3a2b1c",
            password="WalletPass123!",
            user_did="did:ethr:development:0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb7",
            did="did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
            resource_id="0x4c7e9a2d5f8b1c4e7a9d2f5b8c1e4a7d9f2b5c8e1d4f7a9c2e5f8b1d4e7a9c2f",
            resource_type="hardware",
        )
    )
    print("Access revoked")

Request Body

Field	Type	Required	Description
`walletId`	string	Yes	Your wallet ID
`password`	string	Yes	Wallet password
`userDID`	string	Yes	Your identity DID (resource owner or access manager, format: `did:ethr:{network}:0x...`)
`did`	string	Yes	Identity DID to revoke access from (format: `did:ethr:{network}:0x...`)
`resourceId`	string	Yes	Resource ID
`resourceType`	string	Yes	Resource type

Response (200 OK)

{}

Authorization

Same as grant access.

Step 5: Register Access Usage

Increment the usage counter for resources with usage limits.

Endpoint

POST /api/v1/access/register-access

Request

curl -X POST https://middleware-daiedge.bisite.usal.es/api/v1/access/register-access \
  -H "Content-Type: application/json" \
  -H "x-session-id: {SESSION_ID}" \
  -d '{
    "walletId": "0000018a7c5e9d3f6b2a8c4e",
    "password": "WalletPass123!",
    "userDID": "did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
    "did": "did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
    "resourceId": "0x8b1d4f7a9c2e5f8b1d4a7c9e2f5b8d1a4f7c9e2b5d8f1a4c7e9b2d5f8a1c4e7f",
    "resourceType": "hardware"
  }'

async with daiedge_middleware_client.ApiClient() as api_client:
    access_api = daiedge_middleware_client.AccessControlApi(api_client)
    await access_api.access_register_access_post(
        daiedge_middleware_client.RegisterAccessBody(
            wallet_id="0000018a7c5e9d3f6b2a8c4e",
            password="WalletPass123!",
            user_did="did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
            did="did:ethr:development:0x8Ba1f109551bD432803012645Ac136ddd64DBA72",
            resource_id="0x8b1d4f7a9c2e5f8b1d4a7c9e2f5b8d1a4f7c9e2b5d8f1a4c7e9b2d5f8a1c4e7f",
            resource_type="hardware",
        )
    )
    print("Usage registered")

When to Use

Call this endpoint each time a user uses a resource to:

Increment usedCount
Enforce usage limits
Track resource utilization
Trigger automatic revocation when limit reached

Response (200 OK)

{}

Next Steps

Now that you understand hardware access control, you can:

Benchmarking - Execute benchmarks with access-controlled hardware
Marketplace - Trade access to hardware resources

8. Resource Access Control

Overview

Access Control Features

Prerequisites

Required Roles

Access Control Roles

Authorization Patterns

Role Hierarchy

Access Control Concepts

Resource Types

Access Constraints

Access Check Logic

Step 1: Grant Access to Hardware

Endpoint

Request

Request Body

Resource Types

Response (200 OK)

Error Responses

Authorization

Step 2: Access Grant Patterns

Pattern 1: Time-Limited Access

Pattern 2: Usage-Limited Access

Pattern 3: Time AND Usage Limited

Pattern 4: Indefinite Access

Pattern 5: Public/No Access

Step 3: Check Access

Endpoint

Request

Query Parameters

Response (200 OK)

Error Responses

Step 4: Revoke Access

Endpoint

Request

Request Body

Response (200 OK)

Authorization

Step 5: Register Access Usage

Endpoint

Request

When to Use

Response (200 OK)

Next Steps

Related Topics