Merge branch 'master' of github.com:thingsboard/thingsboard into related-entities-agg-cf-tests

application/src/main/data/upgrade/basic/schema_update.sql

@@ -78,6 +78,25 @@ ALTER TABLE calculated_field ADD CONSTRAINT calculated_field_unq_key UNIQUE (ent
 
 -- CALCULATED FIELD UNIQUE CONSTRAINT UPDATE END
 
+-- CALCULATED FIELD OUTPUT STRATEGY UPDATE START
+
+UPDATE calculated_field
+SET configuration = jsonb_set(
+        configuration::jsonb,
+        '{output}',
+        (configuration::jsonb -> 'output')
+            || jsonb_build_object(
+                'strategy',
+                jsonb_build_object(
+                        'type', 'RULE_CHAIN'
+                )
+               ),
+        false
+                    )
+WHERE (configuration::jsonb -> 'output' -> 'strategy') IS NULL;
+
+-- CALCULATED FIELD OUTPUT STRATEGY UPDATE END
+
 -- REMOVAL OF CALCULATED FIELD LINKS PERSISTENCE START
 
 DROP TABLE IF EXISTS calculated_field_link;

application/src/main/java/org/thingsboard/server/actors/ActorSystemContext.java

@@ -94,6 +94,7 @@ import org.thingsboard.server.dao.notification.NotificationTargetService;
 import org.thingsboard.server.dao.notification.NotificationTemplateService;
 import org.thingsboard.server.dao.oauth2.OAuth2ClientService;
 import org.thingsboard.server.dao.ota.OtaPackageService;
+import org.thingsboard.server.dao.pat.ApiKeyService;
 import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.queue.QueueStatsService;
 import org.thingsboard.server.dao.relation.RelationService;
@@ -572,6 +573,10 @@ public class ActorSystemContext {
     @Getter
     private JobManager jobManager;
 
+    @Autowired
+    @Getter
+    private ApiKeyService apiKeyService;
+
     @Autowired
     @Getter
     private OwnerService ownerService;

application/src/main/java/org/thingsboard/server/actors/calculatedField/CalculatedFieldEntityMessageProcessor.java

@@ -486,7 +486,7 @@ public class CalculatedFieldEntityMessageProcessor extends AbstractContextAwareM
                 stateSizeChecked = true;
                 if (state.isSizeOk()) {
                     if (!calculationResult.isEmpty()) {
-                        cfService.pushMsgToRuleEngine(tenantId, entityId, calculationResult, cfIdList, callback);
+                        cfService.processResult(tenantId, entityId, calculationResult, cfIdList, callback);
                     } else {
                         callback.onSuccess();
                     }

application/src/main/java/org/thingsboard/server/actors/ruleChain/DefaultTbContext.java

@@ -109,6 +109,7 @@ import org.thingsboard.server.dao.notification.NotificationTargetService;
 import org.thingsboard.server.dao.notification.NotificationTemplateService;
 import org.thingsboard.server.dao.oauth2.OAuth2ClientService;
 import org.thingsboard.server.dao.ota.OtaPackageService;
+import org.thingsboard.server.dao.pat.ApiKeyService;
 import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.queue.QueueStatsService;
 import org.thingsboard.server.dao.relation.RelationService;
@@ -911,6 +912,11 @@ public class DefaultTbContext implements TbContext {
         return mainCtx.getJobManager();
     }
 
+    @Override
+    public ApiKeyService getApiKeyService() {
+        return mainCtx.getApiKeyService();
+    }
+
     @Override
     public boolean isExternalNodeForceAck() {
         return mainCtx.isExternalNodeForceAck();

application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java

@@ -31,7 +31,6 @@ import org.springframework.security.config.annotation.method.configuration.Enabl
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
-import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
 import org.springframework.security.config.annotation.web.configurers.RequestCacheConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestResolver;
@@ -48,21 +47,23 @@ import org.thingsboard.server.dao.oauth2.OAuth2Configuration;
 import org.thingsboard.server.exception.ThingsboardErrorResponseHandler;
 import org.thingsboard.server.queue.util.TbCoreComponent;
 import org.thingsboard.server.service.security.auth.AuthExceptionHandler;
+import org.thingsboard.server.service.security.auth.extractor.TokenExtractor;
 import org.thingsboard.server.service.security.auth.jwt.JwtAuthenticationProvider;
 import org.thingsboard.server.service.security.auth.jwt.JwtTokenAuthenticationProcessingFilter;
 import org.thingsboard.server.service.security.auth.jwt.RefreshTokenAuthenticationProvider;
 import org.thingsboard.server.service.security.auth.jwt.RefreshTokenProcessingFilter;
 import org.thingsboard.server.service.security.auth.jwt.SkipPathRequestMatcher;
-import org.thingsboard.server.service.security.auth.jwt.extractor.TokenExtractor;
 import org.thingsboard.server.service.security.auth.oauth2.HttpCookieOAuth2AuthorizationRequestRepository;
+import org.thingsboard.server.service.security.auth.pat.ApiKeyAuthenticationProvider;
+import org.thingsboard.server.service.security.auth.pat.ApiKeyTokenAuthenticationProcessingFilter;
 import org.thingsboard.server.service.security.auth.rest.RestAuthenticationProvider;
 import org.thingsboard.server.service.security.auth.rest.RestLoginProcessingFilter;
 import org.thingsboard.server.service.security.auth.rest.RestPublicLoginProcessingFilter;
 import org.thingsboard.server.transport.http.config.PayloadSizeFilter;
 
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.stream.Stream;
 
 @Configuration
 @EnableWebSecurity
@@ -71,10 +72,13 @@ import java.util.List;
 @TbCoreComponent
 public class ThingsboardSecurityConfiguration {
 
-    public static final String JWT_TOKEN_HEADER_PARAM = "X-Authorization";
+    public static final String AUTHORIZATION_HEADER = "X-Authorization";
-    public static final String JWT_TOKEN_HEADER_PARAM_V2 = "Authorization";
+    public static final String AUTHORIZATION_HEADER_V2 = "Authorization";
     public static final String JWT_TOKEN_QUERY_PARAM = "token";
 
+    public static final String API_KEY_HEADER_PREFIX = "ApiKey ";
+    public static final String BEARER_HEADER_PREFIX = "Bearer ";
+
     public static final String DEVICE_API_ENTRY_POINT = "/api/v1/**";
     public static final String FORM_BASED_LOGIN_ENTRY_POINT = "/api/auth/login";
     public static final String PUBLIC_LOGIN_ENTRY_POINT = "/api/auth/login/public";
@@ -116,6 +120,8 @@ public class ThingsboardSecurityConfiguration {
     private JwtAuthenticationProvider jwtAuthenticationProvider;
     @Autowired
     private RefreshTokenAuthenticationProvider refreshTokenAuthenticationProvider;
+    @Autowired
+    private ApiKeyAuthenticationProvider apiKeyAuthenticationProvider;
 
     @Autowired(required = false)
     OAuth2Configuration oauth2Configuration;
@@ -124,6 +130,10 @@ public class ThingsboardSecurityConfiguration {
     @Qualifier("jwtHeaderTokenExtractor")
     private TokenExtractor jwtHeaderTokenExtractor;
 
+    @Autowired
+    @Qualifier("apiKeyHeaderTokenExtractor")
+    private TokenExtractor apiKeyHeaderTokenExtractor;
+
     @Autowired
     private AuthenticationManager authenticationManager;
 
@@ -139,7 +149,7 @@ public class ThingsboardSecurityConfiguration {
     }
 
     @Bean
-    protected FilterRegistrationBean<ShallowEtagHeaderFilter> buildEtagFilter() throws Exception {
+    protected FilterRegistrationBean<ShallowEtagHeaderFilter> buildEtagFilter() {
         ShallowEtagHeaderFilter etagFilter = new ShallowEtagHeaderFilter();
         etagFilter.setWriteWeakETag(true);
         FilterRegistrationBean<ShallowEtagHeaderFilter> filterRegistrationBean
@@ -150,25 +160,22 @@ public class ThingsboardSecurityConfiguration {
     }
 
     @Bean
-    protected RestLoginProcessingFilter buildRestLoginProcessingFilter() throws Exception {
+    protected RestLoginProcessingFilter buildRestLoginProcessingFilter() {
         RestLoginProcessingFilter filter = new RestLoginProcessingFilter(FORM_BASED_LOGIN_ENTRY_POINT, successHandler, failureHandler);
         filter.setAuthenticationManager(this.authenticationManager);
         return filter;
     }
 
     @Bean
-    protected RestPublicLoginProcessingFilter buildRestPublicLoginProcessingFilter() throws Exception {
+    protected RestPublicLoginProcessingFilter buildRestPublicLoginProcessingFilter() {
         RestPublicLoginProcessingFilter filter = new RestPublicLoginProcessingFilter(PUBLIC_LOGIN_ENTRY_POINT, successHandler, failureHandler);
         filter.setAuthenticationManager(this.authenticationManager);
         return filter;
     }
 
-    protected JwtTokenAuthenticationProcessingFilter buildJwtTokenAuthenticationProcessingFilter() throws Exception {
+    @Bean
-        List<String> pathsToSkip = new ArrayList<>(Arrays.asList(NON_TOKEN_BASED_AUTH_ENTRY_POINTS));
+    protected JwtTokenAuthenticationProcessingFilter buildJwtTokenAuthenticationProcessingFilter() {
-        pathsToSkip.addAll(Arrays.asList(WS_ENTRY_POINT, TOKEN_REFRESH_ENTRY_POINT, FORM_BASED_LOGIN_ENTRY_POINT,
+        SkipPathRequestMatcher matcher = buildSkipPathRequestMatcher();
-                PUBLIC_LOGIN_ENTRY_POINT, DEVICE_API_ENTRY_POINT, MAIL_OAUTH2_PROCESSING_ENTRY_POINT,
-                DEVICE_CONNECTIVITY_CERTIFICATE_DOWNLOAD_ENTRY_POINT));
-        SkipPathRequestMatcher matcher = new SkipPathRequestMatcher(pathsToSkip, TOKEN_BASED_AUTH_ENTRY_POINT);
         JwtTokenAuthenticationProcessingFilter filter
                 = new JwtTokenAuthenticationProcessingFilter(failureHandler, jwtHeaderTokenExtractor, matcher);
         filter.setAuthenticationManager(this.authenticationManager);
@@ -176,7 +183,30 @@ public class ThingsboardSecurityConfiguration {
     }
 
     @Bean
-    protected RefreshTokenProcessingFilter buildRefreshTokenProcessingFilter() throws Exception {
+    protected ApiKeyTokenAuthenticationProcessingFilter buildApiKeyTokenAuthenticationProcessingFilter() {
+        SkipPathRequestMatcher matcher = buildSkipPathRequestMatcher();
+        ApiKeyTokenAuthenticationProcessingFilter filter =
+                new ApiKeyTokenAuthenticationProcessingFilter(failureHandler, apiKeyHeaderTokenExtractor, matcher);
+        filter.setAuthenticationManager(this.authenticationManager);
+        return filter;
+    }
+
+    private SkipPathRequestMatcher buildSkipPathRequestMatcher() {
+        List<String> pathsToSkip = Stream.concat(
+                Arrays.stream(NON_TOKEN_BASED_AUTH_ENTRY_POINTS),
+                Stream.of(
+                        WS_ENTRY_POINT,
+                        TOKEN_REFRESH_ENTRY_POINT,
+                        FORM_BASED_LOGIN_ENTRY_POINT,
+                        PUBLIC_LOGIN_ENTRY_POINT,
+                        DEVICE_API_ENTRY_POINT,
+                        MAIL_OAUTH2_PROCESSING_ENTRY_POINT,
+                        DEVICE_CONNECTIVITY_CERTIFICATE_DOWNLOAD_ENTRY_POINT)).toList();
+        return new SkipPathRequestMatcher(pathsToSkip, TOKEN_BASED_AUTH_ENTRY_POINT);
+    }
+
+    @Bean
+    protected RefreshTokenProcessingFilter buildRefreshTokenProcessingFilter() {
         RefreshTokenProcessingFilter filter = new RefreshTokenProcessingFilter(TOKEN_REFRESH_ENTRY_POINT, successHandler, failureHandler);
         filter.setAuthenticationManager(this.authenticationManager);
         return filter;
@@ -187,6 +217,7 @@ public class ThingsboardSecurityConfiguration {
         return new ProviderManager(List.of(
                 restAuthenticationProvider,
                 jwtAuthenticationProvider,
+                apiKeyAuthenticationProvider,
                 refreshTokenAuthenticationProvider
         ));
     }
@@ -233,6 +264,7 @@ public class ThingsboardSecurityConfiguration {
                 .addFilterBefore(buildRestLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterBefore(buildRestPublicLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterBefore(buildJwtTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
+                .addFilterBefore(buildApiKeyTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterBefore(buildRefreshTokenProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterBefore(payloadSizeFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterAfter(rateLimitProcessingFilter, UsernamePasswordAuthenticationFilter.class)

application/src/main/java/org/thingsboard/server/controller/ApiKeyController.java

@@ -0,0 +1,154 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.ApiKeyId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.data.pat.ApiKey;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
+import org.thingsboard.server.config.annotations.ApiOperation;
+import org.thingsboard.server.dao.pat.ApiKeyService;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
+
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.thingsboard.server.controller.ControllerConstants.API_KEY_ID_PARAM_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.API_KEY_TEXT_SEARCH_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.AVAILABLE_FOR_ANY_AUTHORIZED_USER;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_DATA_PARAMETERS;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_NUMBER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.PAGE_SIZE_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_ORDER_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.SORT_PROPERTY_DESCRIPTION;
+import static org.thingsboard.server.controller.ControllerConstants.USER_ID_PARAM_DESCRIPTION;
+
+@RestController
+@TbCoreComponent
+@Slf4j
+@RequestMapping("/api")
+@RequiredArgsConstructor
+public class ApiKeyController extends BaseController {
+
+    private final ApiKeyService apiKeyService;
+
+    @ApiOperation(value = "Save API key for user (saveApiKey)",
+            notes = "Creates an API key for the given user and returns the token ONCE as 'ApiKey <value>'." + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN', 'CUSTOMER_USER')")
+    @PostMapping(value = "/apiKey")
+    public ApiKey saveApiKey(
+            @Parameter(description = "A JSON value representing the Api Key token.")
+            @RequestBody @Valid ApiKeyInfo apiKeyInfo) throws ThingsboardException {
+        User user = checkUserId(apiKeyInfo.getUserId(), Operation.WRITE);
+        apiKeyInfo.setTenantId(user.getTenantId());
+        checkEntity(apiKeyInfo.getId(), apiKeyInfo, Resource.API_KEY);
+        return checkNotNull(apiKeyService.saveApiKey(apiKeyInfo.getTenantId(), apiKeyInfo));
+    }
+
+    @ApiOperation(value = "Get User Api Keys (getUserApiKeys)",
+            notes = "Returns a page of api keys owned by user. " +
+                    PAGE_DATA_PARAMETERS + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN', 'CUSTOMER_USER')")
+    @GetMapping(value = "/apiKeys/{userId}")
+    public PageData<ApiKeyInfo> getUserApiKeys(
+            @Parameter(description = USER_ID_PARAM_DESCRIPTION)
+            @PathVariable("userId") String userIdStr,
+            @Parameter(description = PAGE_SIZE_DESCRIPTION, required = true)
+            @RequestParam int pageSize,
+            @Parameter(description = PAGE_NUMBER_DESCRIPTION, required = true)
+            @RequestParam int page,
+            @Parameter(description = API_KEY_TEXT_SEARCH_DESCRIPTION)
+            @RequestParam(required = false) String textSearch,
+            @Parameter(description = SORT_PROPERTY_DESCRIPTION, schema = @Schema(allowableValues = {"createdTime", "expirationTime", "description", "enabled"}))
+            @RequestParam(required = false) String sortProperty,
+            @Parameter(description = SORT_ORDER_DESCRIPTION, schema = @Schema(allowableValues = {"ASC", "DESC"}))
+            @RequestParam(required = false) String sortOrder) throws ThingsboardException {
+        SecurityUser securityUser = getCurrentUser();
+        PageLink pageLink = createPageLink(pageSize, page, textSearch, sortProperty, sortOrder);
+        UserId userId = new UserId(toUUID(userIdStr));
+        accessControlService.checkPermission(securityUser, Resource.API_KEY, Operation.READ);
+        User user = checkUserId(userId, Operation.READ);
+        return apiKeyService.findApiKeysByUserId(user.getTenantId(), userId, pageLink);
+    }
+
+    @ApiOperation(value = "Update API key Description",
+            notes = "Updates the description of the existing API key by apiKeyId. " +
+                    "Only the description can be updated. " +
+                    "Referencing a non-existing ApiKey Id will cause a 'Not Found' error." + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN', 'CUSTOMER_USER')")
+    @PutMapping("/apiKey/{id}/description")
+    public ApiKeyInfo updateApiKeyDescription(
+            @Parameter(description = API_KEY_ID_PARAM_DESCRIPTION, required = true)
+            @PathVariable UUID id,
+            @Parameter(description = "New description for the API key", example = "Description")
+            @RequestBody Optional<String> description) throws Exception {
+        ApiKeyId apiKeyId = new ApiKeyId(id);
+        ApiKey apiKey = checkApiKeyId(apiKeyId, Operation.WRITE);
+        checkUserId(apiKey.getUserId(), Operation.WRITE);
+        apiKey.setDescription(description.orElse(null));
+        return apiKeyService.saveApiKey(apiKey.getTenantId(), apiKey);
+    }
+
+    @ApiOperation(value = "Enable or disable API key (enableApiKey)",
+            notes = "Updates api key with enabled = true/false. " + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN', 'CUSTOMER_USER')")
+    @PutMapping(value = "/apiKey/{id}/enabled/{enabledValue}")
+    public ApiKeyInfo enableApiKey(
+            @Parameter(description = "Unique identifier of the API key to enable/disable", required = true)
+            @PathVariable UUID id,
+            @Parameter(description = "Enabled or disabled api key", required = true)
+            @PathVariable(value = "enabledValue") Boolean enabledValue) throws ThingsboardException {
+        ApiKeyId apiKeyId = new ApiKeyId(id);
+        ApiKey apiKey = checkApiKeyId(apiKeyId, Operation.WRITE);
+        checkUserId(apiKey.getUserId(), Operation.WRITE);
+        apiKey.setEnabled(enabledValue);
+        return apiKeyService.saveApiKey(apiKey.getTenantId(), apiKey);
+    }
+
+    @ApiOperation(value = "Delete API key by ID (deleteApiKey)",
+            notes = "Deletes the API key. Referencing non-existing ApiKey Id will cause an error." + AVAILABLE_FOR_ANY_AUTHORIZED_USER)
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN', 'CUSTOMER_USER')")
+    @DeleteMapping(value = "/apiKey/{id}")
+    public void deleteApiKey(@PathVariable UUID id) throws ThingsboardException {
+        ApiKeyId apiKeyId = new ApiKeyId(id);
+        ApiKey apiKey = checkApiKeyId(apiKeyId, Operation.DELETE);
+        checkUserId(apiKey.getUserId(), Operation.WRITE);
+        apiKeyService.deleteApiKey(apiKey.getTenantId(), apiKey, false);
+    }
+
+}

application/src/main/java/org/thingsboard/server/controller/BaseController.java

@@ -80,6 +80,7 @@ import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.id.AiModelId;
 import org.thingsboard.server.common.data.id.AlarmCommentId;
 import org.thingsboard.server.common.data.id.AlarmId;
+import org.thingsboard.server.common.data.id.ApiKeyId;
 import org.thingsboard.server.common.data.id.AssetId;
 import org.thingsboard.server.common.data.id.AssetProfileId;
 import org.thingsboard.server.common.data.id.CalculatedFieldId;
@@ -118,6 +119,7 @@ import org.thingsboard.server.common.data.oauth2.OAuth2Client;
 import org.thingsboard.server.common.data.page.PageLink;
 import org.thingsboard.server.common.data.page.SortOrder;
 import org.thingsboard.server.common.data.page.TimePageLink;
+import org.thingsboard.server.common.data.pat.ApiKey;
 import org.thingsboard.server.common.data.plugin.ComponentDescriptor;
 import org.thingsboard.server.common.data.plugin.ComponentType;
 import org.thingsboard.server.common.data.query.EntityDataSortOrder;
@@ -158,6 +160,7 @@ import org.thingsboard.server.dao.notification.NotificationTargetService;
 import org.thingsboard.server.dao.oauth2.OAuth2ClientService;
 import org.thingsboard.server.dao.oauth2.OAuth2ConfigTemplateService;
 import org.thingsboard.server.dao.ota.OtaPackageService;
+import org.thingsboard.server.dao.pat.ApiKeyService;
 import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.relation.RelationService;
 import org.thingsboard.server.dao.resource.ResourceService;
@@ -221,8 +224,6 @@ import static org.thingsboard.server.dao.service.Validator.validateId;
 @TbCoreComponent
 public abstract class BaseController {
 
-    protected static final String DASHBOARD_ID = "dashboardId";
-
     protected static final String HOME_DASHBOARD_ID = "homeDashboardId";
     protected static final String HOME_DASHBOARD_HIDE_TOOLBAR = "homeDashboardHideToolbar";
 
@@ -389,6 +390,9 @@ public abstract class BaseController {
     @Autowired
     protected TbAiModelService tbAiModelService;
 
+    @Autowired
+    protected ApiKeyService apiKeyService;
+
     @Value("${server.log_controller_error_stack_trace}")
     @Getter
     private boolean logControllerErrorStackTrace;
@@ -648,6 +652,7 @@ public abstract class BaseController {
                 case MOBILE_APP_BUNDLE -> checkMobileAppBundleId(new MobileAppBundleId(entityId.getId()), operation);
                 case CALCULATED_FIELD -> checkCalculatedFieldId(new CalculatedFieldId(entityId.getId()), operation);
                 case AI_MODEL -> checkAiModelId(new AiModelId(entityId.getId()), operation);
+                case API_KEY -> checkApiKeyId(new ApiKeyId(entityId.getId()), operation);
                 default -> (HasId<? extends EntityId>) checkEntityId(entityId, entitiesService::findEntityByTenantIdAndId, operation);
             };
         } catch (Exception e) {
@@ -657,7 +662,7 @@ public abstract class BaseController {
 
     protected <E extends HasId<I> & HasTenantId, I extends EntityId> E checkEntityId(I entityId, ThrowingBiFunction<TenantId, I, E> findingFunction, Operation operation) throws ThingsboardException {
         try {
-            validateId((UUIDBased) entityId, "Invalid entity id");
+            validateId((UUIDBased) entityId, id -> "Invalid entity id");
             SecurityUser user = getCurrentUser();
             E entity = findingFunction.apply(user.getTenantId(), entityId);
             checkNotNull(entity, entityId.getEntityType().getNormalName() + " with id [" + entityId + "] is not found");
@@ -855,12 +860,16 @@ public abstract class BaseController {
         return checkEntityId(settingsId, (tenantId, id) -> aiModelService.findAiModelByTenantIdAndId(tenantId, id).orElse(null), operation);
     }
 
+    ApiKey checkApiKeyId(ApiKeyId apiKeyId, Operation operation) throws ThingsboardException {
+        return checkEntityId(apiKeyId, apiKeyService::findApiKeyById, operation);
+    }
+
     protected <I extends EntityId> I emptyId(EntityType entityType) {
         return (I) EntityIdFactory.getByTypeAndUuid(entityType, ModelConstants.NULL_UUID);
     }
 
     public static Exception toException(Throwable error) {
-        return error != null ? (Exception.class.isInstance(error) ? (Exception) error : new Exception(error)) : null;
+        return error != null ? (error instanceof Exception ? (Exception) error : new Exception(error)) : null;
     }
 
     protected <E extends HasName & HasId<? extends EntityId>> void logEntityAction(SecurityUser user, EntityType entityType, E savedEntity, ActionType actionType) {
@@ -939,7 +948,7 @@ public abstract class BaseController {
     }
 
     private CalculatedField checkCalculatedFieldId(CalculatedFieldId calculatedFieldId, Operation operation) throws ThingsboardException {
-        validateId(calculatedFieldId, "Invalid entity id");
+        validateId(calculatedFieldId, id -> "Invalid entity id");
         SecurityUser user = getCurrentUser();
         CalculatedField cf = calculatedFieldService.findById(user.getTenantId(), calculatedFieldId);
         checkNotNull(cf, calculatedFieldId.getEntityType().getNormalName() + " with id [" + calculatedFieldId + "] is not found");

application/src/main/java/org/thingsboard/server/controller/ControllerConstants.java

@@ -64,6 +64,7 @@ public class ControllerConstants {
     protected static final String WIDGET_TYPE_ID_PARAM_DESCRIPTION = "A string value representing the widget type id. For example, '784f394c-42b6-435a-983c-b7beff2784f9'";
     protected static final String VC_REQUEST_ID_PARAM_DESCRIPTION = "A string value representing the version control request id. For example, '784f394c-42b6-435a-983c-b7beff2784f9'";
     protected static final String RESOURCE_ID_PARAM_DESCRIPTION = "A string value representing the resource id. For example, '784f394c-42b6-435a-983c-b7beff2784f9'";
+    protected static final String API_KEY_ID_PARAM_DESCRIPTION = "A string value representing the api key id. For example, '784f394c-42b6-435a-983c-b7beff2784f9'";
     protected static final String SYSTEM_AUTHORITY_PARAGRAPH = "\n\nAvailable for users with 'SYS_ADMIN' authority.";
     protected static final String SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH = "\n\nAvailable for users with 'SYS_ADMIN' or 'TENANT_ADMIN' authority.";
     protected static final String TENANT_AUTHORITY_PARAGRAPH = "\n\nAvailable for users with 'TENANT_ADMIN' authority.";
@@ -91,6 +92,7 @@ public class ControllerConstants {
     protected static final String RULE_CHAIN_TEXT_SEARCH_DESCRIPTION = "The case insensitive 'substring' filter based on the rule chain name.";
     protected static final String DEVICE_PROFILE_TEXT_SEARCH_DESCRIPTION = "The case insensitive 'substring' filter based on the device profile name.";
     protected static final String AI_MODEL_TEXT_SEARCH_DESCRIPTION = "The case insensitive 'substring' filter based on the AI model name, provider and model ID.";
+    protected static final String API_KEY_TEXT_SEARCH_DESCRIPTION = "The case insensitive 'substring' filter based on the description.";
 
     protected static final String ASSET_PROFILE_TEXT_SEARCH_DESCRIPTION = "The case insensitive 'substring' filter based on the asset profile name.";
     protected static final String CUSTOMER_TEXT_SEARCH_DESCRIPTION = "The case insensitive 'substring' filter based on the customer title.";

application/src/main/java/org/thingsboard/server/controller/QrCodeSettingsController.java

@@ -31,15 +31,12 @@ import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RestController;
 import org.thingsboard.common.util.JacksonUtil;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
-import org.thingsboard.server.common.data.id.MobileAppBundleId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.mobile.app.MobileApp;
-import org.thingsboard.server.common.data.mobile.qrCodeSettings.QrCodeSettings;
 import org.thingsboard.server.common.data.mobile.app.StoreInfo;
-import org.thingsboard.server.common.data.oauth2.PlatformType;
+import org.thingsboard.server.common.data.mobile.qrCodeSettings.QrCodeSettings;
 import org.thingsboard.server.common.data.security.model.JwtPair;
 import org.thingsboard.server.config.annotations.ApiOperation;
-import org.thingsboard.server.dao.mobile.MobileAppService;
 import org.thingsboard.server.dao.mobile.QrCodeSettingService;
 import org.thingsboard.server.queue.util.TbCoreComponent;
 import org.thingsboard.server.service.mobile.secret.MobileAppSecretService;

application/src/main/java/org/thingsboard/server/exception/ThingsboardErrorResponseHandler.java

@@ -32,6 +32,7 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.lang.Nullable;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.CredentialsExpiredException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.AuthenticationException;
@@ -137,23 +138,22 @@ public class ThingsboardErrorResponseHandler extends ResponseEntityExceptionHand
             try {
                 response.setContentType(MediaType.APPLICATION_JSON_VALUE);
 
-                if (exception instanceof ThingsboardException) {
+                if (exception instanceof ThingsboardException thingsboardException) {
-                    ThingsboardException thingsboardException = (ThingsboardException) exception;
                     if (thingsboardException.getErrorCode() == ThingsboardErrorCode.SUBSCRIPTION_VIOLATION) {
-                        handleSubscriptionException((ThingsboardException) exception, response);
+                        handleSubscriptionException(thingsboardException, response);
                     } else if (thingsboardException.getErrorCode() == ThingsboardErrorCode.DATABASE) {
                         handleDatabaseException(thingsboardException.getCause(), response);
                     } else {
-                        handleThingsboardException((ThingsboardException) exception, response);
+                        handleThingsboardException(thingsboardException, response);
                     }
-                } else if (exception instanceof TbRateLimitsException) {
+                } else if (exception instanceof TbRateLimitsException rateLimitsException) {
-                    handleRateLimitException(response, (TbRateLimitsException) exception);
+                    handleRateLimitException(response, rateLimitsException);
                 } else if (exception instanceof AccessDeniedException) {
                     handleAccessDeniedException(response);
-                } else if (exception instanceof AuthenticationException) {
+                } else if (exception instanceof AuthenticationException authenticationException) {
-                    handleAuthenticationException((AuthenticationException) exception, response);
+                    handleAuthenticationException(authenticationException, response);
-                } else if (exception instanceof MaxPayloadSizeExceededException) {
+                } else if (exception instanceof MaxPayloadSizeExceededException maxPayloadSizeExceededException) {
-                    handleMaxPayloadSizeExceededException(response, (MaxPayloadSizeExceededException) exception);
+                    handleMaxPayloadSizeExceededException(response, maxPayloadSizeExceededException);
                 } else if (exception instanceof DataAccessException e) {
                     handleDatabaseException(e, response);
                 } else {
@@ -238,13 +238,13 @@ public class ThingsboardErrorResponseHandler extends ResponseEntityExceptionHand
             JacksonUtil.writeValue(response.getWriter(), ThingsboardErrorResponse.of("Token has expired", ThingsboardErrorCode.JWT_TOKEN_EXPIRED, HttpStatus.UNAUTHORIZED));
         } else if (authenticationException instanceof AuthMethodNotSupportedException) {
             JacksonUtil.writeValue(response.getWriter(), ThingsboardErrorResponse.of(authenticationException.getMessage(), ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
-        } else if (authenticationException instanceof UserPasswordExpiredException) {
+        } else if (authenticationException instanceof UserPasswordExpiredException expiredException) {
-            UserPasswordExpiredException expiredException = (UserPasswordExpiredException) authenticationException;
             String resetToken = expiredException.getResetToken();
             JacksonUtil.writeValue(response.getWriter(), ThingsboardCredentialsExpiredResponse.of(expiredException.getMessage(), resetToken));
-        } else if (authenticationException instanceof UserPasswordNotValidException) {
+        } else if (authenticationException instanceof UserPasswordNotValidException expiredException) {
-            UserPasswordNotValidException expiredException = (UserPasswordNotValidException) authenticationException;
             JacksonUtil.writeValue(response.getWriter(), ThingsboardCredentialsViolationResponse.of(expiredException.getMessage()));
+        } else if (authenticationException instanceof CredentialsExpiredException credentialsExpiredException) {
+            JacksonUtil.writeValue(response.getWriter(), ThingsboardCredentialsViolationResponse.of(credentialsExpiredException.getMessage(), ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
         } else {
             JacksonUtil.writeValue(response.getWriter(), ThingsboardErrorResponse.of("Authentication failed", ThingsboardErrorCode.AUTHENTICATION, HttpStatus.UNAUTHORIZED));
         }

application/src/main/java/org/thingsboard/server/service/cf/AbstractCalculatedFieldProcessingService.java

@@ -15,24 +15,39 @@
  */
 package org.thingsboard.server.service.cf;
 
+import com.google.common.util.concurrent.FutureCallback;
 import com.google.common.util.concurrent.Futures;
 import com.google.common.util.concurrent.ListenableFuture;
 import com.google.common.util.concurrent.ListeningExecutorService;
 import com.google.common.util.concurrent.MoreExecutors;
+import com.google.common.util.concurrent.SettableFuture;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonParser;
 import jakarta.annotation.PostConstruct;
 import jakarta.annotation.PreDestroy;
 import lombok.Data;
 import lombok.extern.slf4j.Slf4j;
+import org.thingsboard.common.util.DonAsynchron;
 import org.thingsboard.common.util.ThingsBoardExecutors;
+import org.thingsboard.rule.engine.api.AttributesSaveRequest;
+import org.thingsboard.rule.engine.api.AttributesSaveRequest.Strategy;
+import org.thingsboard.rule.engine.api.TimeseriesSaveRequest;
+import org.thingsboard.server.common.adaptor.JsonConverter;
+import org.thingsboard.server.common.data.AttributeScope;
 import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
+import org.thingsboard.server.common.data.cf.configuration.AttributesImmediateOutputStrategy;
+import org.thingsboard.server.common.data.cf.configuration.OutputStrategy;
+import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.RelationPathQueryDynamicSourceConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesImmediateOutputStrategy;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggFunction;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggMetric;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.RelatedEntitiesAggregationCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.single.EntityAggregationCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.single.interval.AggInterval;
+import org.thingsboard.server.common.data.id.CalculatedFieldId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.kv.Aggregation;
@@ -40,12 +55,14 @@ import org.thingsboard.server.common.data.kv.AttributeKvEntry;
 import org.thingsboard.server.common.data.kv.BaseAttributeKvEntry;
 import org.thingsboard.server.common.data.kv.BaseReadTsKvQuery;
 import org.thingsboard.server.common.data.kv.BasicTsKvEntry;
+import org.thingsboard.server.common.data.kv.KvEntry;
 import org.thingsboard.server.common.data.kv.ReadTsKvQuery;
 import org.thingsboard.server.common.data.kv.TsKvEntry;
 import org.thingsboard.server.common.data.relation.EntityRelation;
 import org.thingsboard.server.common.data.relation.EntityRelationPathQuery;
 import org.thingsboard.server.common.data.relation.RelationPathLevel;
 import org.thingsboard.server.common.data.tenant.profile.DefaultTenantProfileConfiguration;
+import org.thingsboard.server.common.msg.queue.TbCallback;
 import org.thingsboard.server.dao.attributes.AttributesService;
 import org.thingsboard.server.dao.relation.RelationService;
 import org.thingsboard.server.dao.timeseries.TimeseriesService;
@@ -54,11 +71,13 @@ import org.thingsboard.server.service.cf.ctx.state.ArgumentEntry;
 import org.thingsboard.server.service.cf.ctx.state.CalculatedFieldCtx;
 import org.thingsboard.server.service.cf.ctx.state.SingleValueArgumentEntry;
 import org.thingsboard.server.service.cf.ctx.state.aggregation.single.AggIntervalEntry;
+import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService;
 
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ExecutionException;
@@ -70,6 +89,8 @@ import static org.thingsboard.server.common.data.cf.CalculatedFieldType.PROPAGAT
 import static org.thingsboard.server.common.data.cf.configuration.PropagationCalculatedFieldConfiguration.PROPAGATION_CONFIG_ARGUMENT;
 import static org.thingsboard.server.common.data.cf.configuration.geofencing.EntityCoordinates.ENTITY_ID_LATITUDE_ARGUMENT_KEY;
 import static org.thingsboard.server.common.data.cf.configuration.geofencing.EntityCoordinates.ENTITY_ID_LONGITUDE_ARGUMENT_KEY;
+import static org.thingsboard.server.dao.util.KvUtils.filterChangedAttr;
+import static org.thingsboard.server.dao.util.KvUtils.toTsKvEntryList;
 import static org.thingsboard.server.utils.CalculatedFieldArgumentUtils.createDefaultAttributeEntry;
 import static org.thingsboard.server.utils.CalculatedFieldArgumentUtils.createDefaultKvEntry;
 import static org.thingsboard.server.utils.CalculatedFieldArgumentUtils.transformAggMetricArgument;
@@ -83,6 +104,7 @@ public abstract class AbstractCalculatedFieldProcessingService {
 
     protected final AttributesService attributesService;
     protected final TimeseriesService timeseriesService;
+    protected final TelemetrySubscriptionService tsSubService;
     protected final ApiLimitService apiLimitService;
     protected final RelationService relationService;
     protected final OwnerService ownerService;
@@ -370,4 +392,108 @@ public abstract class AbstractCalculatedFieldProcessingService {
         return new BaseReadTsKvQuery(argument.getRefEntityKey().getKey(), startTs, endTs, 0, limit, Aggregation.NONE);
     }
 
+    protected void saveTelemetryResult(TenantId tenantId, EntityId entityId, TelemetryCalculatedFieldResult cfResult, List<CalculatedFieldId> cfIds, TbCallback callback) {
+        OutputType type = cfResult.getType();
+        JsonElement jsonResult = JsonParser.parseString(Objects.requireNonNull(cfResult.stringValue()));
+
+        log.trace("[{}][{}] Saving CF result: {}", tenantId, entityId, jsonResult);
+
+        SettableFuture<Void> future = SettableFuture.create();
+        switch (type) {
+            case ATTRIBUTES -> saveAttributes(tenantId, entityId, jsonResult, cfResult.getOutputStrategy(), cfResult.getScope(), cfIds, future);
+            case TIME_SERIES -> saveTimeSeries(tenantId, entityId, jsonResult, cfResult.getOutputStrategy(), cfIds, System.currentTimeMillis(), future);
+        }
+
+        Futures.addCallback(future, new FutureCallback<>() {
+            @Override
+            public void onSuccess(Void v) {
+                callback.onSuccess();
+                log.debug("[{}][{}] Saved CF result: {}", tenantId, entityId, cfResult);
+            }
+
+            @Override
+            public void onFailure(Throwable t) {
+                callback.onFailure(t);
+                log.error("[{}][{}] Failed to save CF result {}", tenantId, entityId, cfResult, t);
+            }
+        }, MoreExecutors.directExecutor());
+    }
+
+    private void saveAttributes(TenantId tenantId, EntityId entityId, JsonElement jsonResult, OutputStrategy outputStrategy, AttributeScope scope, List<CalculatedFieldId> cfIds, SettableFuture<Void> future) {
+        if (!(outputStrategy instanceof AttributesImmediateOutputStrategy attOutputStrategy)) {
+            future.setException(new IllegalArgumentException("Only AttributeImmediateOutputStrategy is supported."));
+        } else {
+            AttributesSaveRequest.Strategy strategy = new Strategy(attOutputStrategy.isSaveAttribute(), attOutputStrategy.isSendWsUpdate(), attOutputStrategy.isProcessCfs());
+            List<AttributeKvEntry> newAttributes = JsonConverter.convertToAttributes(jsonResult);
+
+            if (!attOutputStrategy.isUpdateAttributesOnlyOnValueChange()) {
+                saveAttributesInternal(tenantId, entityId, scope, cfIds, newAttributes, strategy, future);
+                return;
+            }
+
+            List<String> keys = newAttributes.stream().map(KvEntry::getKey).collect(Collectors.toList());
+            ListenableFuture<List<AttributeKvEntry>> findFuture = attributesService.find(tenantId, entityId, scope, keys);
+
+            DonAsynchron.withCallback(findFuture,
+                    existingAttributes -> {
+                        List<AttributeKvEntry> changed = filterChangedAttr(existingAttributes, newAttributes);
+                        if (changed.isEmpty()) {
+                            future.set(null);
+                            return;
+                        }
+                        saveAttributesInternal(tenantId, entityId, scope, cfIds, changed, strategy, future);
+                    },
+                    future::setException,
+                    MoreExecutors.directExecutor());
+        }
+    }
+
+    private void saveAttributesInternal(TenantId tenantId, EntityId entityId,
+                                        AttributeScope scope,
+                                        List<CalculatedFieldId> cfIds,
+                                        List<AttributeKvEntry> entries,
+                                        AttributesSaveRequest.Strategy strategy,
+                                        SettableFuture<Void> future) {
+        tsSubService.saveAttributes(AttributesSaveRequest.builder()
+                .tenantId(tenantId)
+                .entityId(entityId)
+                .scope(scope)
+                .entries(entries)
+                .strategy(strategy)
+                .previousCalculatedFieldIds(cfIds)
+                .future(future)
+                .build());
+    }
+
+    private void saveTimeSeries(TenantId tenantId, EntityId entityId, JsonElement jsonResult, OutputStrategy outputStrategy, List<CalculatedFieldId> cfIds, long ts, SettableFuture<Void> future) {
+        if (!(outputStrategy instanceof TimeSeriesImmediateOutputStrategy tsOutputStrategy)) {
+            future.setException(new IllegalArgumentException("Only TimeSeriesImmediateOutputStrategy is supported."));
+        } else {
+            TimeseriesSaveRequest.Strategy strategy = new TimeseriesSaveRequest.Strategy(tsOutputStrategy.isSaveTimeSeries(), tsOutputStrategy.isSaveLatest(), tsOutputStrategy.isSendWsUpdate(), tsOutputStrategy.isProcessCfs());
+            saveTimeSeriesInternal(tenantId, entityId, jsonResult, tsOutputStrategy.getTtl(), cfIds, ts, strategy, future);
+        }
+    }
+
+    private void saveTimeSeriesInternal(TenantId tenantId, EntityId entityId, JsonElement jsonResult, Long ttl, List<CalculatedFieldId> cfIds, long ts, TimeseriesSaveRequest.Strategy strategy, SettableFuture<Void> future) {
+        Map<Long, List<KvEntry>> tsKvMap = JsonConverter.convertToTelemetry(jsonResult, ts);
+        if (tsKvMap.isEmpty()) {
+            future.set(null);
+            return;
+        }
+        List<TsKvEntry> tsEntries = toTsKvEntryList(tsKvMap);
+        TimeseriesSaveRequest.Builder builder = TimeseriesSaveRequest.builder()
+                .tenantId(tenantId)
+                .entityId(entityId)
+                .entries(tsEntries)
+                .strategy(strategy)
+                .future(future);
+        if (ttl != null) {
+            builder.ttl(ttl);
+        }
+        if (cfIds != null && !cfIds.isEmpty()) {
+            builder.previousCalculatedFieldIds(cfIds);
+        }
+        tsSubService.saveTimeseries(builder.build());
+    }
+
 }

application/src/main/java/org/thingsboard/server/service/cf/CalculatedFieldProcessingService.java

@@ -41,9 +41,9 @@ public interface CalculatedFieldProcessingService {
 
     Map<String, ArgumentEntry> fetchArgsFromDb(TenantId tenantId, EntityId entityId, Map<String, Argument> arguments);
 
-    ArgumentEntry fetchMetricDuringInterval(TenantId tenantId, EntityId entityId, String argKey, AggMetric metric, AggIntervalEntry interval);
+    void processResult(TenantId tenantId, EntityId entityId, CalculatedFieldResult result, List<CalculatedFieldId> cfIds, TbCallback callback);
 
-    void pushMsgToRuleEngine(TenantId tenantId, EntityId entityId, CalculatedFieldResult result, List<CalculatedFieldId> cfIds, TbCallback callback);
+    ArgumentEntry fetchMetricDuringInterval(TenantId tenantId, EntityId entityId, String argKey, AggMetric metric, AggIntervalEntry interval);
 
     void pushMsgToLinks(CalculatedFieldTelemetryMsg msg, List<CalculatedFieldEntityCtxId> linkedCalculatedFields, TbCallback callback);
 

application/src/main/java/org/thingsboard/server/service/cf/DefaultCalculatedFieldProcessingService.java

@@ -17,6 +17,7 @@ package org.thingsboard.server.service.cf;
 
 import com.google.common.util.concurrent.ListenableFuture;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.function.TriConsumer;
 import org.springframework.stereotype.Service;
 import org.thingsboard.server.actors.calculatedField.CalculatedFieldTelemetryMsg;
 import org.thingsboard.server.actors.calculatedField.MultipleTbCallback;
@@ -50,6 +51,7 @@ import org.thingsboard.server.service.cf.ctx.CalculatedFieldEntityCtxId;
 import org.thingsboard.server.service.cf.ctx.state.ArgumentEntry;
 import org.thingsboard.server.service.cf.ctx.state.CalculatedFieldCtx;
 import org.thingsboard.server.service.cf.ctx.state.aggregation.single.AggIntervalEntry;
+import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -76,8 +78,9 @@ public class DefaultCalculatedFieldProcessingService extends AbstractCalculatedF
                                                    RelationService relationService,
                                                    OwnerService ownerService,
                                                    TbClusterService clusterService,
+                                                   TelemetrySubscriptionService tsSubService,
                                                    PartitionService partitionService) {
-        super(attributesService, timeseriesService, apiLimitService, relationService, ownerService);
+        super(attributesService, timeseriesService, tsSubService, apiLimitService, relationService, ownerService);
         this.clusterService = clusterService;
         this.partitionService = partitionService;
     }
@@ -133,27 +136,57 @@ public class DefaultCalculatedFieldProcessingService extends AbstractCalculatedF
         return super.fetchMetricDuringInterval(tenantId, entityId, argKey, metric, interval);
     }
 
-    @Override
+    public void processResult(TenantId tenantId, EntityId entityId, CalculatedFieldResult result, List<CalculatedFieldId> cfIds, TbCallback callback) {
-    public void pushMsgToRuleEngine(TenantId tenantId, EntityId entityId, CalculatedFieldResult result, List<CalculatedFieldId> cfIds, TbCallback callback) {
+        if (result instanceof AlarmCalculatedFieldResult) {
-        if (!(result instanceof PropagationCalculatedFieldResult propagationCalculatedFieldResult)) {
+            sendMsgToRuleEngine(tenantId, entityId, callback, result.toTbMsg(entityId, cfIds));
-            TbMsg msg = result.toTbMsg(entityId, cfIds);
+            return;
-            sendMsgToRuleEngine(tenantId, entityId, callback, msg);
+        }
+        TelemetryCalculatedFieldResult telemetryResult = result instanceof TelemetryCalculatedFieldResult telemetryRes
+                ? telemetryRes : ((PropagationCalculatedFieldResult) result).getResult();
+        switch (telemetryResult.getOutputStrategy().getType()) {
+            case IMMEDIATE -> processImmediately(tenantId, entityId, result, cfIds, callback);
+            case RULE_CHAIN -> pushMsgToRuleEngine(tenantId, entityId, result, cfIds, callback);
+        }
+    }
+
+    private void processImmediately(TenantId tenantId, EntityId entityId, CalculatedFieldResult result, List<CalculatedFieldId> cfIds, TbCallback callback) {
+        if (result instanceof TelemetryCalculatedFieldResult telemetryResult) {
+            saveTelemetryResult(tenantId, entityId, telemetryResult, cfIds, callback);
+            return;
+        }
+        if (result instanceof PropagationCalculatedFieldResult propagationResult) {
+            handlePropagationResults(propagationResult, callback,
+                    (entity, res, cb) -> saveTelemetryResult(tenantId, entityId, res, cfIds, cb));
             return;
         }
-        List<EntityId> propagationEntityIds = propagationCalculatedFieldResult.getPropagationEntityIds();
+        callback.onSuccess();
+    }
+
+    private void pushMsgToRuleEngine(TenantId tenantId, EntityId entityId, CalculatedFieldResult result, List<CalculatedFieldId> cfIds, TbCallback callback) {
+        if (result instanceof PropagationCalculatedFieldResult propagationResult) {
+            handlePropagationResults(propagationResult, callback,
+                    (entity, res, cb) -> sendMsgToRuleEngine(tenantId, entityId, cb, res.toTbMsg(entity, cfIds)));
+            return;
+        }
+
+        sendMsgToRuleEngine(tenantId, entityId, callback, result.toTbMsg(entityId, cfIds));
+    }
+
+    private void handlePropagationResults(PropagationCalculatedFieldResult propagationResult, TbCallback callback,
+                                          TriConsumer<EntityId, TelemetryCalculatedFieldResult, TbCallback> telemetryResultHandler) {
+        List<EntityId> propagationEntityIds = propagationResult.getPropagationEntityIds();
         if (propagationEntityIds.isEmpty()) {
             callback.onSuccess();
+            return;
         }
         if (propagationEntityIds.size() == 1) {
             EntityId propagationEntityId = propagationEntityIds.get(0);
-            TbMsg msg = result.toTbMsg(propagationEntityId, cfIds);
+            telemetryResultHandler.accept(propagationEntityId, propagationResult.getResult(), callback);
-            sendMsgToRuleEngine(tenantId, propagationEntityId, callback, msg);
             return;
         }
         MultipleTbCallback multipleTbCallback = new MultipleTbCallback(propagationEntityIds.size(), callback);
         for (var propagationEntityId : propagationEntityIds) {
-            TbMsg msg = result.toTbMsg(propagationEntityId, cfIds);
+            telemetryResultHandler.accept(propagationEntityId, propagationResult.getResult(), multipleTbCallback);
-            sendMsgToRuleEngine(tenantId, propagationEntityId, multipleTbCallback, msg);
         }
     }
 

application/src/main/java/org/thingsboard/server/service/cf/TelemetryCalculatedFieldResult.java

@@ -19,6 +19,7 @@ import com.fasterxml.jackson.databind.JsonNode;
 import lombok.Builder;
 import lombok.Data;
 import org.thingsboard.server.common.data.AttributeScope;
+import org.thingsboard.server.common.data.cf.configuration.OutputStrategy;
 import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.id.CalculatedFieldId;
 import org.thingsboard.server.common.data.id.EntityId;
@@ -37,6 +38,7 @@ public final class TelemetryCalculatedFieldResult implements CalculatedFieldResu
 
     private final OutputType type;
     private final AttributeScope scope;
+    private final OutputStrategy outputStrategy;
     private final JsonNode result;
 
     public static final TelemetryCalculatedFieldResult EMPTY = TelemetryCalculatedFieldResult.builder().result(null).build();

application/src/main/java/org/thingsboard/server/service/cf/ctx/state/ScriptCalculatedFieldState.java

@@ -52,6 +52,7 @@ public class ScriptCalculatedFieldState extends BaseCalculatedFieldState {
         Output output = ctx.getOutput();
         return Futures.transform(resultFuture,
                 result -> TelemetryCalculatedFieldResult.builder()
+                        .outputStrategy(output.getStrategy())
                         .type(output.getType())
                         .scope(output.getScope())
                         .result(JacksonUtil.valueToTree(result))

application/src/main/java/org/thingsboard/server/service/cf/ctx/state/SimpleCalculatedFieldState.java

@@ -56,6 +56,7 @@ public class SimpleCalculatedFieldState extends BaseCalculatedFieldState {
         JsonNode outputResult = createResultJson(ctx.isUseLatestTs(), output.getName(), result);
 
         return Futures.immediateFuture(TelemetryCalculatedFieldResult.builder()
+                .outputStrategy(output.getStrategy())
                 .type(output.getType())
                 .scope(output.getScope())
                 .result(outputResult)

application/src/main/java/org/thingsboard/server/service/cf/ctx/state/aggregation/RelatedEntitiesAggregationCalculatedFieldState.java

@@ -174,6 +174,7 @@ public class RelatedEntitiesAggregationCalculatedFieldState extends BaseCalculat
             lastMetricsEvalTs = System.currentTimeMillis();
             scheduleReevaluation();
             return Futures.immediateFuture(TelemetryCalculatedFieldResult.builder()
+                    .outputStrategy(output.getStrategy())
                     .type(output.getType())
                     .scope(output.getScope())
                     .result(toSimpleResult(ctx.isUseLatestTs(), aggResult))

application/src/main/java/org/thingsboard/server/service/cf/ctx/state/aggregation/single/EntityAggregationCalculatedFieldState.java

@@ -105,6 +105,7 @@ public class EntityAggregationCalculatedFieldState extends BaseCalculatedFieldSt
             return Futures.immediateFuture(TelemetryCalculatedFieldResult.EMPTY);
         }
         return Futures.immediateFuture(TelemetryCalculatedFieldResult.builder()
+                .outputStrategy(output.getStrategy())
                 .type(output.getType())
                 .scope(output.getScope())
                 .result(result)

application/src/main/java/org/thingsboard/server/service/cf/ctx/state/geofencing/GeofencingCalculatedFieldState.java

@@ -130,6 +130,7 @@ public class GeofencingCalculatedFieldState extends BaseCalculatedFieldState {
 
         OutputType outputType = ctx.getOutput().getType();
         var result = TelemetryCalculatedFieldResult.builder()
+                .outputStrategy(ctx.getOutput().getStrategy())
                 .type(outputType)
                 .scope(ctx.getOutput().getScope())
                 .result(toResultNode(outputType, valuesNode))

application/src/main/java/org/thingsboard/server/service/cf/ctx/state/propagation/PropagationCalculatedFieldState.java

@@ -85,6 +85,7 @@ public class PropagationCalculatedFieldState extends ScriptCalculatedFieldState
         Output output = ctx.getOutput();
         TelemetryCalculatedFieldResult.TelemetryCalculatedFieldResultBuilder telemetryCfBuilder =
                 TelemetryCalculatedFieldResult.builder()
+                        .outputStrategy(output.getStrategy())
                         .type(output.getType())
                         .scope(output.getScope());
         ObjectNode valuesNode = JacksonUtil.newObjectNode();

application/src/main/java/org/thingsboard/server/service/entitiy/EntityStateSourcingListener.java

@@ -110,7 +110,7 @@ public class EntityStateSourcingListener {
             case ASSET -> {
                 onAssetUpdate(event.getEntity(), event.getOldEntity());
             }
-            case ASSET_PROFILE, ENTITY_VIEW, NOTIFICATION_RULE -> {
+            case ASSET_PROFILE, ENTITY_VIEW, NOTIFICATION_RULE, USER -> {
                 tbClusterService.broadcastEntityStateChangeEvent(tenantId, entityId, lifecycleEvent);
             }
             case RULE_CHAIN -> {
@@ -178,7 +178,7 @@ public class EntityStateSourcingListener {
                 Asset asset = (Asset) event.getEntity();
                 tbClusterService.onAssetDeleted(tenantId, asset, null);
             }
-            case ASSET_PROFILE, ENTITY_VIEW, CUSTOMER, EDGE, NOTIFICATION_RULE -> {
+            case ASSET_PROFILE, ENTITY_VIEW, CUSTOMER, EDGE, NOTIFICATION_RULE, USER -> {
                 tbClusterService.broadcastEntityStateChangeEvent(tenantId, entityId, ComponentLifecycleEvent.DELETED);
             }
             case NOTIFICATION_REQUEST -> {
@@ -234,10 +234,12 @@ public class EntityStateSourcingListener {
         log.trace("[{}] ActionEntityEvent called: {}", tenantId, event);
         switch (event.getActionType()) {
             case CREDENTIALS_UPDATED -> {
-                if (EntityType.DEVICE.equals(event.getEntityId().getEntityType()) &&
+                if (event.getEntityId().getEntityType() == EntityType.DEVICE && event.getEntity() instanceof DeviceCredentials deviceCredentials) {
-                    event.getEntity() instanceof DeviceCredentials deviceCredentials) {
                     tbClusterService.pushMsgToCore(new DeviceCredentialsUpdateNotificationMsg(tenantId,
                             (DeviceId) event.getEntityId(), deviceCredentials), null);
+                } else if (event.getEntityId().getEntityType() == EntityType.USER) {
+                    tbClusterService.broadcastEntityStateChangeEvent(event.getTenantId(), event.getEntityId(), ComponentLifecycleEvent.UPDATED);
+
                 }
             }
             case ASSIGNED_TO_TENANT -> {

application/src/main/java/org/thingsboard/server/service/entitiy/alarm/DefaultTbAlarmCommentService.java

@@ -30,6 +30,8 @@ import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.dao.alarm.AlarmCommentService;
 import org.thingsboard.server.service.entitiy.AbstractTbEntityService;
 
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.COMMENT_DELETED;
+
 @Service
 @AllArgsConstructor
 public class DefaultTbAlarmCommentService extends AbstractTbEntityService implements TbAlarmCommentService {
@@ -59,9 +61,10 @@ public class DefaultTbAlarmCommentService extends AbstractTbEntityService implem
         if (alarmComment.getType() == AlarmCommentType.OTHER) {
             alarmComment.setType(AlarmCommentType.SYSTEM);
             alarmComment.setUserId(null);
-            alarmComment.setComment(JacksonUtil.newObjectNode().put("text",
+            alarmComment.setComment(JacksonUtil.newObjectNode()
-                    String.format("User %s deleted his comment",
+                    .put("text", String.format(COMMENT_DELETED.getText(), user.getTitle()))
-                            (user.getFirstName() == null || user.getLastName() == null) ? user.getName() : user.getFirstName() + " " + user.getLastName())));
+                    .put("subtype", COMMENT_DELETED.name())
+                    .put("userName", user.getTitle()));
             AlarmComment savedAlarmComment = checkNotNull(alarmCommentService.saveAlarmComment(alarm.getTenantId(), alarmComment));
             logEntityActionService.logEntityAction(alarm.getTenantId(), alarm.getId(), alarm, alarm.getCustomerId(), ActionType.DELETED_COMMENT, user, savedAlarmComment);
         } else {

application/src/main/java/org/thingsboard/server/service/entitiy/alarm/DefaultTbAlarmService.java

@@ -27,6 +27,7 @@ import org.thingsboard.server.common.data.alarm.Alarm;
 import org.thingsboard.server.common.data.alarm.AlarmApiCallResult;
 import org.thingsboard.server.common.data.alarm.AlarmAssignee;
 import org.thingsboard.server.common.data.alarm.AlarmComment;
+import org.thingsboard.server.common.data.alarm.AlarmCommentSubType;
 import org.thingsboard.server.common.data.alarm.AlarmCommentType;
 import org.thingsboard.server.common.data.alarm.AlarmCreateOrUpdateActiveRequest;
 import org.thingsboard.server.common.data.alarm.AlarmInfo;
@@ -39,9 +40,17 @@ import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.UserId;
 import org.thingsboard.server.service.entitiy.AbstractTbEntityService;
 
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.UUID;
 
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.ACKED_BY_USER;
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.ASSIGNED_TO_USER;
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.CLEARED_BY_USER;
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.UNASSIGNED_BY_USER;
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.UNASSIGNED_FROM_DELETED_USER;
+
 @Service
 @AllArgsConstructor
 @Slf4j
@@ -102,8 +111,7 @@ public class DefaultTbAlarmService extends AbstractTbEntityService implements Tb
         }
         AlarmInfo alarmInfo = result.getAlarm();
         if (result.isModified()) {
-            String systemComment = String.format("Alarm was acknowledged by user %s", user.getTitle());
+            addSystemAlarmComment(alarmInfo, user, ACKED_BY_USER,"userName", user.getTitle());
-            addSystemAlarmComment(alarmInfo, user, "ACK", systemComment);
             logEntityActionService.logEntityAction(alarm.getTenantId(), alarm.getOriginator(), alarmInfo,
                     alarmInfo.getCustomerId(), ActionType.ALARM_ACK, user);
         } else {
@@ -125,8 +133,7 @@ public class DefaultTbAlarmService extends AbstractTbEntityService implements Tb
         }
         AlarmInfo alarmInfo = result.getAlarm();
         if (result.isCleared()) {
-            String systemComment = String.format("Alarm was cleared by user %s", user.getTitle());
+            addSystemAlarmComment(alarmInfo, user, CLEARED_BY_USER, "userName", user.getTitle());
-            addSystemAlarmComment(alarmInfo, user, "CLEAR", systemComment);
             logEntityActionService.logEntityAction(alarm.getTenantId(), alarm.getOriginator(), alarmInfo,
                     alarmInfo.getCustomerId(), ActionType.ALARM_CLEAR, user);
         } else {
@@ -144,8 +151,7 @@ public class DefaultTbAlarmService extends AbstractTbEntityService implements Tb
         AlarmInfo alarmInfo = result.getAlarm();
         if (result.isModified()) {
             AlarmAssignee assignee = alarmInfo.getAssignee();
-            String systemComment = String.format("Alarm was assigned by user %s to user %s", user.getTitle(), assignee.getTitle());
+            addSystemAlarmComment(alarmInfo, user, ASSIGNED_TO_USER, "userName", user.getTitle(), "assigneeName", assignee.getTitle());
-            addSystemAlarmComment(alarmInfo, user, "ASSIGN", systemComment, assignee.getId());
             logEntityActionService.logEntityAction(alarm.getTenantId(), alarm.getOriginator(), alarmInfo,
                     alarmInfo.getCustomerId(), ActionType.ALARM_ASSIGNED, user);
         } else {
@@ -162,8 +168,7 @@ public class DefaultTbAlarmService extends AbstractTbEntityService implements Tb
         }
         AlarmInfo alarmInfo = result.getAlarm();
         if (result.isModified()) {
-            String systemComment = String.format("Alarm was unassigned by user %s", user.getTitle());
+            addSystemAlarmComment(alarmInfo, user, UNASSIGNED_BY_USER, "userName", user.getTitle());
-            addSystemAlarmComment(alarmInfo, user, "ASSIGN", systemComment);
             logEntityActionService.logEntityAction(alarm.getTenantId(), alarm.getOriginator(), alarmInfo,
                     alarmInfo.getCustomerId(), ActionType.ALARM_UNASSIGNED, user);
         } else {
@@ -182,8 +187,7 @@ public class DefaultTbAlarmService extends AbstractTbEntityService implements Tb
                 continue;
             }
             if (result.isModified()) {
-                String comment = String.format("Alarm was unassigned because user %s - was deleted", userTitle);
+                addSystemAlarmComment(result.getAlarm(), null, UNASSIGNED_FROM_DELETED_USER, "userName", userTitle);
-                addSystemAlarmComment(result.getAlarm(), null, "ASSIGN", comment);
                 logEntityActionService.logEntityAction(result.getAlarm().getTenantId(), result.getAlarm().getOriginator(), result.getAlarm(), result.getAlarm().getCustomerId(), ActionType.ALARM_UNASSIGNED, null);
             }
         }
@@ -214,20 +218,24 @@ public class DefaultTbAlarmService extends AbstractTbEntityService implements Tb
         return ts > 0 ? ts : System.currentTimeMillis();
     }
 
-    private void addSystemAlarmComment(Alarm alarm, User user, String subType, String commentText) {
+    private void addSystemAlarmComment(Alarm alarm, User user, AlarmCommentSubType subType, String param, String value) {
-        addSystemAlarmComment(alarm, user, subType, commentText, null);
+        Map<String, String> params = new LinkedHashMap<>(1);
+        params.put(param, value);
+        addSystemAlarmComment(alarm, user, subType, params);
+    }
+
+    private void addSystemAlarmComment(Alarm alarm, User user, AlarmCommentSubType subType, String param, String value, String param2, String value2) {
+        Map<String, String> params = new LinkedHashMap<>(2);
+        params.put(param, value);
+        params.put(param2, value2);
+        addSystemAlarmComment(alarm, user, subType, params);
     }
 
-    private void addSystemAlarmComment(Alarm alarm, User user, String subType, String commentText, UserId assigneeId) {
+    private void addSystemAlarmComment(Alarm alarm, User user, AlarmCommentSubType subType, Map<String, String> params) {
         ObjectNode commentNode = JacksonUtil.newObjectNode();
-        commentNode.put("text", commentText)
+        commentNode.put("text", String.format(subType.getText(), params.values().toArray()))
-                .put("subtype", subType);
+                .put("subtype", subType.name());
-        if (user != null) {
+        params.forEach(commentNode::put);
-            commentNode.put("userId", user.getId().getId().toString());
-        }
-        if (assigneeId != null) {
-            commentNode.put("assigneeId", assigneeId.getId().toString());
-        }
         AlarmComment alarmComment = AlarmComment.builder()
                 .alarmId(alarm.getId())
                 .type(AlarmCommentType.SYSTEM)

application/src/main/java/org/thingsboard/server/service/queue/DefaultTbClusterService.java

@@ -611,7 +611,8 @@ public class DefaultTbClusterService implements TbClusterService {
                 EntityType.ASSET_PROFILE,
                 EntityType.JOB,
                 EntityType.TB_RESOURCE,
-                EntityType.CUSTOMER)
+                EntityType.CUSTOMER,
+                EntityType.USER)
                 || (entityType == EntityType.ASSET && msg.getEvent() == ComponentLifecycleEvent.UPDATED)
                 || (entityType == EntityType.DEVICE && msg.getEvent() == ComponentLifecycleEvent.UPDATED)
         ) {
@@ -626,11 +627,14 @@ public class DefaultTbClusterService implements TbClusterService {
             // No need to push notifications twice
             tbRuleEngineServices.removeAll(tbCoreServices);
         }
-        for (String serviceId : tbRuleEngineServices) {
+        boolean toRuleEngine = entityType != EntityType.USER;
-            TopicPartitionInfo tpi = topicService.getNotificationsTopic(ServiceType.TB_RULE_ENGINE, serviceId);
+        if (toRuleEngine) {
-            ToRuleEngineNotificationMsg toRuleEngineMsg = ToRuleEngineNotificationMsg.newBuilder().setComponentLifecycle(componentLifecycleMsgProto).build();
+            for (String serviceId : tbRuleEngineServices) {
-            toRuleEngineProducer.send(tpi, new TbProtoQueueMsg<>(msg.getEntityId().getId(), toRuleEngineMsg), null);
+                TopicPartitionInfo tpi = topicService.getNotificationsTopic(ServiceType.TB_RULE_ENGINE, serviceId);
-            toRuleEngineNfs.incrementAndGet();
+                ToRuleEngineNotificationMsg toRuleEngineMsg = ToRuleEngineNotificationMsg.newBuilder().setComponentLifecycle(componentLifecycleMsgProto).build();
+                toRuleEngineProducer.send(tpi, new TbProtoQueueMsg<>(msg.getEntityId().getId(), toRuleEngineMsg), null);
+                toRuleEngineNfs.incrementAndGet();
+            }
         }
     }
 

application/src/main/java/org/thingsboard/server/service/security/auth/DefaultTokenOutdatingService.java

@@ -49,21 +49,22 @@ public class DefaultTokenOutdatingService implements TokenOutdatingService {
 
     @Override
     public boolean isOutdated(String token, UserId userId) {
-        Claims claims = tokenFactory.parseTokenClaims(token).getBody();
+        Claims claims = tokenFactory.parseTokenClaims(token).getPayload();
         long issueTime = claims.getIssuedAt().getTime();
         String sessionId = claims.get("sessionId", String.class);
-        if (isTokenOutdated(issueTime, userId.toString())){
+        if (isTokenOutdated(issueTime, userId.toString())) {
-             return true;
+            return true;
         } else {
-             return sessionId != null && isTokenOutdated(issueTime, sessionId);
+            return sessionId != null && isTokenOutdated(issueTime, sessionId);
         }
     }
 
     private Boolean isTokenOutdated(long issueTime, String sessionId) {
-        return Optional.ofNullable(cache.get(sessionId)).map(outdatageTime -> isTokenOutdated(issueTime, outdatageTime.get())).orElse(false);
+        return Optional.ofNullable(cache.get(sessionId)).map(outdatedTime -> isTokenOutdated(issueTime, outdatedTime.get())).orElse(false);
     }
 
     private boolean isTokenOutdated(long issueTime, Long outdatageTime) {
         return MILLISECONDS.toSeconds(issueTime) < MILLISECONDS.toSeconds(outdatageTime);
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/extractor/JwtHeaderTokenExtractor.java → application/src/main/java/org/thingsboard/server/service/security/auth/extractor/AbstractHeaderTokenExtractor.java

@@ -13,32 +13,36 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.thingsboard.server.service.security.auth.jwt.extractor;
+package org.thingsboard.server.service.security.auth.extractor;
 
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.stereotype.Component;
 import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.config.ThingsboardSecurityConfiguration;
 
-@Component(value="jwtHeaderTokenExtractor")
+public abstract class AbstractHeaderTokenExtractor implements TokenExtractor {
-public class JwtHeaderTokenExtractor implements TokenExtractor {
+
-    public static final String HEADER_PREFIX = "Bearer ";
+    private final String headerPrefix;
+
+    protected AbstractHeaderTokenExtractor(String headerPrefix) {
+        this.headerPrefix = headerPrefix;
+    }
 
     @Override
     public String extract(HttpServletRequest request) {
-        String header = request.getHeader(ThingsboardSecurityConfiguration.JWT_TOKEN_HEADER_PARAM);
+        String header = request.getHeader(ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER);
         if (StringUtils.isBlank(header)) {
-            header = request.getHeader(ThingsboardSecurityConfiguration.JWT_TOKEN_HEADER_PARAM_V2);
+            header = request.getHeader(ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER_V2);
             if (StringUtils.isBlank(header)) {
                 throw new AuthenticationServiceException("Authorization header cannot be blank!");
             }
         }
 
-        if (header.length() < HEADER_PREFIX.length()) {
+        if (header.length() < headerPrefix.length()) {
             throw new AuthenticationServiceException("Invalid authorization header size.");
         }
 
-        return header.substring(HEADER_PREFIX.length(), header.length());
+        return header.substring(headerPrefix.length());
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/extractor/ApiKeyHeaderTokenExtractor.java

@@ -0,0 +1,29 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.extractor;
+
+import org.springframework.stereotype.Component;
+
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.API_KEY_HEADER_PREFIX;
+
+@Component(value = "apiKeyHeaderTokenExtractor")
+public class ApiKeyHeaderTokenExtractor extends AbstractHeaderTokenExtractor {
+
+    public ApiKeyHeaderTokenExtractor() {
+        super(API_KEY_HEADER_PREFIX);
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/security/auth/extractor/JwtHeaderTokenExtractor.java

@@ -0,0 +1,29 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.extractor;
+
+import org.springframework.stereotype.Component;
+
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.BEARER_HEADER_PREFIX;
+
+@Component(value = "jwtHeaderTokenExtractor")
+public class JwtHeaderTokenExtractor extends AbstractHeaderTokenExtractor {
+
+    public JwtHeaderTokenExtractor() {
+        super(BEARER_HEADER_PREFIX);
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/extractor/JwtQueryTokenExtractor.java → application/src/main/java/org/thingsboard/server/service/security/auth/extractor/JwtQueryTokenExtractor.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.thingsboard.server.service.security.auth.jwt.extractor;
+package org.thingsboard.server.service.security.auth.extractor;
 
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.security.authentication.AuthenticationServiceException;
@@ -21,7 +21,7 @@ import org.springframework.stereotype.Component;
 import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.config.ThingsboardSecurityConfiguration;
 
-@Component(value="jwtQueryTokenExtractor")
+@Component(value = "jwtQueryTokenExtractor")
 public class JwtQueryTokenExtractor implements TokenExtractor {
 
     @Override
@@ -39,4 +39,5 @@ public class JwtQueryTokenExtractor implements TokenExtractor {
 
         return token;
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/extractor/TokenExtractor.java → application/src/main/java/org/thingsboard/server/service/security/auth/extractor/TokenExtractor.java

@@ -13,10 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.thingsboard.server.service.security.auth.jwt.extractor;
+package org.thingsboard.server.service.security.auth.extractor;
 
 import jakarta.servlet.http.HttpServletRequest;
 
 public interface TokenExtractor {
+
     String extract(HttpServletRequest request);
-}
+
+}

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/JwtAuthenticationProvider.java

@@ -39,7 +39,7 @@ public class JwtAuthenticationProvider implements AuthenticationProvider {
     @Override
     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
         RawAccessJwtToken rawAccessToken = (RawAccessJwtToken) authentication.getCredentials();
-        SecurityUser securityUser = authenticate(rawAccessToken.getToken());
+        SecurityUser securityUser = authenticate(rawAccessToken.token());
         return new JwtAuthenticationToken(securityUser);
     }
 
@@ -58,4 +58,5 @@ public class JwtAuthenticationProvider implements AuthenticationProvider {
     public boolean supports(Class<?> authentication) {
         return (JwtAuthenticationToken.class.isAssignableFrom(authentication));
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/JwtTokenAuthenticationProcessingFilter.java

@@ -28,12 +28,17 @@ import org.springframework.security.web.authentication.AbstractAuthenticationPro
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.thingsboard.server.service.security.auth.JwtAuthenticationToken;
-import org.thingsboard.server.service.security.auth.jwt.extractor.TokenExtractor;
+import org.thingsboard.server.service.security.auth.extractor.TokenExtractor;
 import org.thingsboard.server.service.security.model.token.RawAccessJwtToken;
 
 import java.io.IOException;
 
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER;
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER_V2;
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.BEARER_HEADER_PREFIX;
+
 public class JwtTokenAuthenticationProcessingFilter extends AbstractAuthenticationProcessingFilter {
+
     private final AuthenticationFailureHandler failureHandler;
     private final TokenExtractor tokenExtractor;
 
@@ -46,8 +51,7 @@ public class JwtTokenAuthenticationProcessingFilter extends AbstractAuthenticati
     }
 
     @Override
-    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
+    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
-            throws AuthenticationException, IOException, ServletException {
         RawAccessJwtToken token = new RawAccessJwtToken(tokenExtractor.extract(request));
         return getAuthenticationManager().authenticate(new JwtAuthenticationToken(token));
     }
@@ -61,10 +65,27 @@ public class JwtTokenAuthenticationProcessingFilter extends AbstractAuthenticati
         chain.doFilter(request, response);
     }
 
+    @Override
+    protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
+        if (!super.requiresAuthentication(request, response)) {
+            return false;
+        }
+        String header = request.getHeader(AUTHORIZATION_HEADER);
+        if (header == null) {
+            header = request.getHeader(AUTHORIZATION_HEADER_V2);
+        }
+        if (header == null) {
+            // If there is NO auth header at all, let the JWT filter try to attempt Authentication and failure in the process.
+            return true;
+        }
+        return header.startsWith(BEARER_HEADER_PREFIX);
+    }
+
     @Override
     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                               AuthenticationException failed) throws IOException, ServletException {
         SecurityContextHolder.clearContext();
         failureHandler.onAuthenticationFailure(request, response, failed);
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/RefreshTokenAuthenticationProvider.java

@@ -28,28 +28,29 @@ import org.springframework.stereotype.Component;
 import org.springframework.util.Assert;
 import org.thingsboard.server.common.data.Customer;
 import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.UserAuthDetails;
 import org.thingsboard.server.common.data.id.CustomerId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.UserId;
 import org.thingsboard.server.common.data.security.Authority;
-import org.thingsboard.server.common.data.security.UserCredentials;
 import org.thingsboard.server.dao.customer.CustomerService;
-import org.thingsboard.server.dao.user.UserService;
 import org.thingsboard.server.service.security.auth.RefreshAuthenticationToken;
 import org.thingsboard.server.service.security.auth.TokenOutdatingService;
 import org.thingsboard.server.service.security.model.SecurityUser;
 import org.thingsboard.server.service.security.model.UserPrincipal;
 import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
 import org.thingsboard.server.service.security.model.token.RawAccessJwtToken;
+import org.thingsboard.server.service.user.cache.UserAuthDetailsCache;
 
 import java.util.UUID;
 
 @Component
 @RequiredArgsConstructor
 public class RefreshTokenAuthenticationProvider implements AuthenticationProvider {
+
     private final JwtTokenFactory tokenFactory;
-    private final UserService userService;
+    private final UserAuthDetailsCache userAuthDetailsCache;
     private final CustomerService customerService;
     private final TokenOutdatingService tokenOutdatingService;
 
@@ -57,7 +58,7 @@ public class RefreshTokenAuthenticationProvider implements AuthenticationProvide
     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
         Assert.notNull(authentication, "No authentication data provided");
         RawAccessJwtToken rawAccessToken = (RawAccessJwtToken) authentication.getCredentials();
-        SecurityUser unsafeUser = tokenFactory.parseRefreshToken(rawAccessToken.getToken());
+        SecurityUser unsafeUser = tokenFactory.parseRefreshToken(rawAccessToken.token());
         UserPrincipal principal = unsafeUser.getUserPrincipal();
 
         SecurityUser securityUser;
@@ -67,7 +68,7 @@ public class RefreshTokenAuthenticationProvider implements AuthenticationProvide
             securityUser = authenticateByPublicId(principal.getValue());
         }
         securityUser.setSessionId(unsafeUser.getSessionId());
-        if (tokenOutdatingService.isOutdated(rawAccessToken.getToken(), securityUser.getId())) {
+        if (tokenOutdatingService.isOutdated(rawAccessToken.token(), securityUser.getId())) {
             throw new CredentialsExpiredException("Token is outdated");
         }
 
@@ -75,27 +76,21 @@ public class RefreshTokenAuthenticationProvider implements AuthenticationProvide
     }
 
     private SecurityUser authenticateByUserId(UserId userId) {
-        TenantId systemId = TenantId.SYS_TENANT_ID;
+        UserAuthDetails userAuthDetails = userAuthDetailsCache.getUserAuthDetails(TenantId.SYS_TENANT_ID, userId);
-        User user = userService.findUserById(systemId, userId);
+        if (userAuthDetails == null) {
-        if (user == null) {
+            throw new UsernameNotFoundException("User with credentials not found");
-            throw new UsernameNotFoundException("User not found by refresh token");
         }
-
+        if (!userAuthDetails.credentialsEnabled()) {
-        UserCredentials userCredentials = userService.findUserCredentialsByUserId(systemId, user.getId());
-        if (userCredentials == null) {
-            throw new UsernameNotFoundException("User credentials not found");
-        }
-
-        if (!userCredentials.isEnabled()) {
             throw new DisabledException("User is not active");
         }
 
-        if (user.getAuthority() == null) throw new InsufficientAuthenticationException("User has no authority assigned");
+        User user = userAuthDetails.user();
+        if (user.getAuthority() == null) {
+            throw new InsufficientAuthenticationException("User has no authority assigned");
+        }
 
         UserPrincipal userPrincipal = new UserPrincipal(UserPrincipal.Type.USER_NAME, user.getEmail());
-        SecurityUser securityUser = new SecurityUser(user, userCredentials.isEnabled(), userPrincipal);
+        return new SecurityUser(user, true, userPrincipal);
-
-        return securityUser;
     }
 
     private SecurityUser authenticateByPublicId(String publicId) {
@@ -125,13 +120,12 @@ public class RefreshTokenAuthenticationProvider implements AuthenticationProvide
 
         UserPrincipal userPrincipal = new UserPrincipal(UserPrincipal.Type.PUBLIC_ID, publicId);
 
-        SecurityUser securityUser = new SecurityUser(user, true, userPrincipal);
+        return new SecurityUser(user, true, userPrincipal);
-
-        return securityUser;
     }
 
     @Override
     public boolean supports(Class<?> authentication) {
         return (RefreshAuthenticationToken.class.isAssignableFrom(authentication));
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/RefreshTokenProcessingFilter.java

@@ -51,11 +51,10 @@ public class RefreshTokenProcessingFilter extends AbstractAuthenticationProcessi
     }
 
     @Override
-    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
+    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
-            throws AuthenticationException, IOException, ServletException {
         if (!HttpMethod.POST.name().equals(request.getMethod())) {
-            if(log.isDebugEnabled()) {
+            if (log.isDebugEnabled()) {
-                log.debug("Authentication method not supported. Request method: " + request.getMethod());
+                log.debug("Authentication method not supported. Request method: {}", request.getMethod());
             }
             throw new AuthMethodNotSupportedException("Authentication method not supported");
         }
@@ -67,11 +66,11 @@ public class RefreshTokenProcessingFilter extends AbstractAuthenticationProcessi
             throw new AuthenticationServiceException("Invalid refresh token request payload");
         }
 
-        if (StringUtils.isBlank(refreshTokenRequest.getRefreshToken())) {
+        if (refreshTokenRequest == null || StringUtils.isBlank(refreshTokenRequest.refreshToken())) {
             throw new AuthenticationServiceException("Refresh token is not provided");
         }
 
-        RawAccessJwtToken token = new RawAccessJwtToken(refreshTokenRequest.getRefreshToken());
+        RawAccessJwtToken token = new RawAccessJwtToken(refreshTokenRequest.refreshToken());
 
         return this.getAuthenticationManager().authenticate(new RefreshAuthenticationToken(token));
     }
@@ -88,4 +87,5 @@ public class RefreshTokenProcessingFilter extends AbstractAuthenticationProcessi
         SecurityContextHolder.clearContext();
         failureHandler.onAuthenticationFailure(request, response, failed);
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/RefreshTokenRequest.java

@@ -18,15 +18,11 @@ package org.thingsboard.server.service.security.auth.jwt;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
-public class RefreshTokenRequest {
+public record RefreshTokenRequest(String refreshToken) {
-    private String refreshToken;
 
     @JsonCreator
     public RefreshTokenRequest(@JsonProperty("refreshToken") String refreshToken) {
         this.refreshToken = refreshToken;
     }
 
-    public String getRefreshToken() {
-        return refreshToken;
-    }
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/SkipPathRequestMatcher.java

@@ -25,12 +25,13 @@ import java.util.List;
 import java.util.stream.Collectors;
 
 public class SkipPathRequestMatcher implements RequestMatcher {
-    private OrRequestMatcher matchers;
+
-    private RequestMatcher processingMatcher;
+    private final OrRequestMatcher matchers;
+    private final RequestMatcher processingMatcher;
 
     public SkipPathRequestMatcher(List<String> pathsToSkip, String processingPath) {
         Assert.notNull(pathsToSkip, "List of paths to skip is required.");
-        List<RequestMatcher> m = pathsToSkip.stream().map(path -> new AntPathRequestMatcher(path)).collect(Collectors.toList());
+        List<RequestMatcher> m = pathsToSkip.stream().map(AntPathRequestMatcher::new).collect(Collectors.toList());
         matchers = new OrRequestMatcher(m);
         processingMatcher = new AntPathRequestMatcher(processingPath);
     }
@@ -40,6 +41,7 @@ public class SkipPathRequestMatcher implements RequestMatcher {
         if (matchers.matches(request)) {
             return false;
         }
-        return processingMatcher.matches(request) ? true : false;
+        return processingMatcher.matches(request);
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/settings/DefaultJwtSettingsValidator.java

@@ -66,7 +66,7 @@ public class DefaultJwtSettingsValidator implements JwtSettingsValidator {
             throw new DataValidationException("JWT token signing key should be a Base64 encoded string representing at least 512 bits of data!");
         }
 
-        System.arraycopy(decodedKey, 0, RandomUtils.nextBytes(decodedKey.length), 0, decodedKey.length); //secure memory
+        System.arraycopy(decodedKey, 0, RandomUtils.secure().randomBytes(decodedKey.length), 0, decodedKey.length); // secure memory
     }
 
 }

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/settings/InstallJwtSettingsValidator.java

@@ -22,9 +22,8 @@ import org.springframework.stereotype.Component;
 import org.thingsboard.server.common.data.security.model.JwtSettings;
 
 /**
- * During Install or upgrade the validation is suppressed to keep existing data
+ * During Install or upgrade, the validation is suppressed to keep existing data
  * */
-
 @Primary
 @Profile("install")
 @Component

application/src/main/java/org/thingsboard/server/service/security/auth/jwt/settings/JwtSettingsValidator.java

@@ -20,4 +20,5 @@ import org.thingsboard.server.common.data.security.model.JwtSettings;
 public interface JwtSettingsValidator {
 
     void validate(JwtSettings jwtSettings);
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/pat/ApiKeyAuthenticationProvider.java

@@ -0,0 +1,86 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.pat;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.CredentialsExpiredException;
+import org.springframework.security.authentication.DisabledException;
+import org.springframework.security.authentication.InsufficientAuthenticationException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Component;
+import org.thingsboard.server.common.data.StringUtils;
+import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.UserAuthDetails;
+import org.thingsboard.server.common.data.pat.ApiKey;
+import org.thingsboard.server.dao.pat.ApiKeyService;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.model.UserPrincipal;
+import org.thingsboard.server.service.security.model.token.RawApiKey;
+import org.thingsboard.server.service.user.cache.UserAuthDetailsCache;
+
+@Component
+@RequiredArgsConstructor
+public class ApiKeyAuthenticationProvider implements org.springframework.security.authentication.AuthenticationProvider {
+
+    private final ApiKeyService apiKeyService;
+    private final UserAuthDetailsCache userAuthDetailsCache;
+
+    @Override
+    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+        RawApiKey rawApiKey = (RawApiKey) authentication.getCredentials();
+        SecurityUser securityUser = authenticate(rawApiKey.apiKey());
+        return new ApiKeyAuthenticationToken(securityUser);
+    }
+
+    @Override
+    public boolean supports(Class<?> authentication) {
+        return ApiKeyAuthenticationToken.class.isAssignableFrom(authentication);
+    }
+
+    private SecurityUser authenticate(String key) {
+        if (StringUtils.isEmpty(key)) {
+            throw new BadCredentialsException("Empty API key");
+        }
+        ApiKey apiKey = apiKeyService.findApiKeyByValue(key);
+        if (apiKey == null) {
+            throw new BadCredentialsException("User not found for the provided API key");
+        }
+        if (!apiKey.isEnabled()) {
+            throw new DisabledException("API key auth is not active");
+        }
+        if (apiKey.getExpirationTime() != 0 && apiKey.getExpirationTime() < System.currentTimeMillis()) {
+            throw new CredentialsExpiredException("API key is expired");
+        }
+        UserAuthDetails userAuthDetails = userAuthDetailsCache.getUserAuthDetails(apiKey.getTenantId(), apiKey.getUserId());
+        if (userAuthDetails == null) {
+            throw new UsernameNotFoundException("User with credentials not found");
+        }
+        if (!userAuthDetails.credentialsEnabled()) {
+            throw new DisabledException("User is not active");
+        }
+
+        User user = userAuthDetails.user();
+        if (user.getAuthority() == null) {
+            throw new InsufficientAuthenticationException("User has no authority assigned");
+        }
+        UserPrincipal userPrincipal = new UserPrincipal(UserPrincipal.Type.USER_NAME, user.getEmail());
+        return new SecurityUser(user, true, userPrincipal);
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/security/auth/pat/ApiKeyAuthenticationToken.java

@@ -0,0 +1,61 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.pat;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.thingsboard.server.service.security.model.SecurityUser;
+import org.thingsboard.server.service.security.model.token.RawApiKey;
+
+import java.io.Serial;
+
+public class ApiKeyAuthenticationToken extends AbstractAuthenticationToken {
+
+    @Serial
+    private static final long serialVersionUID = 2978710889397403536L;
+
+    private RawApiKey rawApiKey;
+    private SecurityUser securityUser;
+
+    public ApiKeyAuthenticationToken(RawApiKey rawApiKey) {
+        super(null);
+        this.rawApiKey = rawApiKey;
+        setAuthenticated(false);
+    }
+
+    public ApiKeyAuthenticationToken(SecurityUser securityUser) {
+        super(securityUser.getAuthorities());
+        this.eraseCredentials();
+        this.securityUser = securityUser;
+        super.setAuthenticated(true);
+    }
+
+    @Override
+    public Object getCredentials() {
+        return rawApiKey;
+    }
+
+    @Override
+    public Object getPrincipal() {
+        return this.securityUser;
+    }
+
+    @Override
+    public void eraseCredentials() {
+        super.eraseCredentials();
+        this.rawApiKey = null;
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/security/auth/pat/ApiKeyTokenAuthenticationProcessingFilter.java

@@ -0,0 +1,87 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.pat;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.thingsboard.server.service.security.auth.extractor.TokenExtractor;
+import org.thingsboard.server.service.security.model.token.RawApiKey;
+
+import java.io.IOException;
+
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.API_KEY_HEADER_PREFIX;
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER;
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER_V2;
+
+public class ApiKeyTokenAuthenticationProcessingFilter extends AbstractAuthenticationProcessingFilter {
+
+    private final AuthenticationFailureHandler failureHandler;
+    private final TokenExtractor tokenExtractor;
+
+    @Autowired
+    public ApiKeyTokenAuthenticationProcessingFilter(AuthenticationFailureHandler failureHandler,
+                                                     @Qualifier("apiKeyHeaderTokenExtractor") TokenExtractor tokenExtractor, RequestMatcher matcher) {
+        super(matcher);
+        this.failureHandler = failureHandler;
+        this.tokenExtractor = tokenExtractor;
+    }
+
+    @Override
+    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
+        RawApiKey rawApiKey = new RawApiKey(tokenExtractor.extract(request));
+        return getAuthenticationManager().authenticate(new ApiKeyAuthenticationToken(rawApiKey));
+    }
+
+    @Override
+    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
+                                            Authentication authResult) throws IOException, ServletException {
+        SecurityContext context = SecurityContextHolder.createEmptyContext();
+        context.setAuthentication(authResult);
+        SecurityContextHolder.setContext(context);
+        chain.doFilter(request, response);
+    }
+
+    @Override
+    protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
+        if (!super.requiresAuthentication(request, response)) {
+            return false;
+        }
+        String header = request.getHeader(AUTHORIZATION_HEADER);
+        if (header == null) {
+            header = request.getHeader(AUTHORIZATION_HEADER_V2);
+        }
+        return header != null && header.startsWith(API_KEY_HEADER_PREFIX);
+    }
+
+    @Override
+    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
+                                              AuthenticationException failed) throws IOException, ServletException {
+        SecurityContextHolder.clearContext();
+        failureHandler.onAuthenticationFailure(request, response, failed);
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAwareAuthenticationFailureHandler.java

@@ -15,7 +15,6 @@
  */
 package org.thingsboard.server.service.security.auth.rest;
 
-import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -24,8 +23,6 @@ import org.springframework.security.web.authentication.AuthenticationFailureHand
 import org.springframework.stereotype.Component;
 import org.thingsboard.server.exception.ThingsboardErrorResponseHandler;
 
-import java.io.IOException;
-
 @Component(value = "defaultAuthenticationFailureHandler")
 public class RestAwareAuthenticationFailureHandler implements AuthenticationFailureHandler {
 
@@ -37,8 +34,8 @@ public class RestAwareAuthenticationFailureHandler implements AuthenticationFail
     }
 
     @Override
-    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
+    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) {
-                                        AuthenticationException e) throws IOException, ServletException {
         errorResponseHandler.handle(e, response);
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAwareAuthenticationSuccessHandler.java

@@ -73,7 +73,7 @@ public class RestAwareAuthenticationSuccessHandler implements AuthenticationSucc
                 .flatMap(settings -> Optional.ofNullable(settings.getTotalAllowedTimeForVerification())
                         .filter(time -> time > 0))
                 .orElse((int) TimeUnit.MINUTES.toSeconds(30));
-        tokenPair.setToken(tokenFactory.createMfaToken(securityUser, scope, preVerificationTokenLifetime).getToken());
+        tokenPair.setToken(tokenFactory.createMfaToken(securityUser, scope, preVerificationTokenLifetime).token());
         tokenPair.setRefreshToken(null);
         tokenPair.setScope(scope);
         return tokenPair;
@@ -93,4 +93,5 @@ public class RestAwareAuthenticationSuccessHandler implements AuthenticationSucc
 
         session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/exception/JwtExpiredTokenException.java

@@ -17,7 +17,11 @@ package org.thingsboard.server.service.security.exception;
 
 import org.springframework.security.core.AuthenticationException;
 
+import java.io.Serial;
+
 public class JwtExpiredTokenException extends AuthenticationException {
+
+    @Serial
     private static final long serialVersionUID = -5959543783324224864L;
 
     private String token;
@@ -34,4 +38,5 @@ public class JwtExpiredTokenException extends AuthenticationException {
     public String token() {
         return this.token;
     }
+
 }

application/src/main/java/org/thingsboard/server/service/security/model/token/AccessJwtToken.java

@@ -17,15 +17,6 @@ package org.thingsboard.server.service.security.model.token;
 
 import org.thingsboard.server.common.data.security.model.JwtToken;
 
-public final class AccessJwtToken implements JwtToken {
+public record AccessJwtToken(String token) implements JwtToken {
-    private final String rawToken;
-
-    public AccessJwtToken(String rawToken) {
-        this.rawToken = rawToken;
-    }
-
-    public String getToken() {
-        return this.rawToken;
-    }
 
 }

application/src/main/java/org/thingsboard/server/service/security/model/token/JwtTokenFactory.java

@@ -235,7 +235,7 @@ public class JwtTokenFactory {
         securityUser.setSessionId(UUID.randomUUID().toString());
         JwtToken accessToken = createAccessJwtToken(securityUser);
         JwtToken refreshToken = createRefreshToken(securityUser);
-        return new JwtPair(accessToken.getToken(), refreshToken.getToken());
+        return new JwtPair(accessToken.token(), refreshToken.token());
     }
 
     private SecretKey getSecretKey(boolean forceReload) {

application/src/main/java/org/thingsboard/server/service/security/model/token/OAuth2AppTokenFactory.java

@@ -20,9 +20,9 @@ import io.jsonwebtoken.ExpiredJwtException;
 import io.jsonwebtoken.Jws;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.MalformedJwtException;
-import io.jsonwebtoken.SignatureException;
 import io.jsonwebtoken.UnsupportedJwtException;
 import io.jsonwebtoken.security.Keys;
+import io.jsonwebtoken.security.SignatureException;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Component;
 import org.thingsboard.server.common.data.StringUtils;
@@ -43,8 +43,7 @@ public class OAuth2AppTokenFactory {
         Jws<Claims> jwsClaims;
         try {
             jwsClaims = Jwts.parser().verifyWith(Keys.hmacShaKeyFor(Base64.getDecoder().decode(appSecret))).build().parseSignedClaims(appToken);
-        }
+        } catch (UnsupportedJwtException | MalformedJwtException | IllegalArgumentException | SignatureException ex) {
-        catch (UnsupportedJwtException | MalformedJwtException | IllegalArgumentException | SignatureException ex) {
             throw new IllegalArgumentException("Invalid Application token: ", ex);
         } catch (ExpiredJwtException expiredEx) {
             throw new IllegalArgumentException("Application token expired", expiredEx);

application/src/main/java/org/thingsboard/server/service/security/model/token/RawAccessJwtToken.java

@@ -19,18 +19,6 @@ import org.thingsboard.server.common.data.security.model.JwtToken;
 
 import java.io.Serializable;
 
-public class RawAccessJwtToken implements JwtToken, Serializable {
+public record RawAccessJwtToken(String token) implements JwtToken, Serializable {
 
-    private static final long serialVersionUID = -797397445703066079L;
-
-    private String token;
-
-    public RawAccessJwtToken(String token) {
-        this.token = token;
-    }
-
-    @Override
-    public String getToken() {
-        return token;
-    }
 }

application/src/main/java/org/thingsboard/server/service/security/model/token/RawApiKey.java

@@ -0,0 +1,18 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.model.token;
+
+public record RawApiKey(String apiKey) {}

application/src/main/java/org/thingsboard/server/service/security/permission/CustomerUserPermissions.java

@@ -21,10 +21,12 @@ import org.thingsboard.server.common.data.HasCustomerId;
 import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.TbResourceInfo;
 import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.id.ApiKeyId;
 import org.thingsboard.server.common.data.id.DashboardId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.TbResourceId;
 import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
 import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.service.security.model.SecurityUser;
 
@@ -48,6 +50,7 @@ public class CustomerUserPermissions extends AbstractPermissions {
         put(Resource.ASSET_PROFILE, profilePermissionChecker);
         put(Resource.TB_RESOURCE, customerResourcePermissionChecker);
         put(Resource.MOBILE_APP_SETTINGS, new PermissionChecker.GenericPermissionChecker(Operation.READ));
+        put(Resource.API_KEY, apiKeysPermissionChecker);
     }
 
     private static final PermissionChecker customerAlarmPermissionChecker = new PermissionChecker() {
@@ -202,4 +205,19 @@ public class CustomerUserPermissions extends AbstractPermissions {
             return user.getTenantId().equals(entity.getTenantId());
         }
     };
+
+    private static final PermissionChecker apiKeysPermissionChecker = new PermissionChecker<ApiKeyId, ApiKeyInfo>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation) {
+            return true;
+        }
+
+        @Override
+        @SuppressWarnings("unchecked")
+        public boolean hasPermission(SecurityUser user, Operation operation, ApiKeyId entityId, ApiKeyInfo entity) {
+            return user.getTenantId().equals(entity.getTenantId());
+        }
+    };
+
 }

application/src/main/java/org/thingsboard/server/service/security/permission/DefaultAccessControlService.java

@@ -70,7 +70,7 @@ public class DefaultAccessControlService implements AccessControlService {
             permissionDenied();
         }
         Optional<PermissionChecker> permissionChecker = permissions.getPermissionChecker(resource);
-        if (!permissionChecker.isPresent()) {
+        if (permissionChecker.isEmpty()) {
             permissionDenied();
         }
         return permissionChecker.get();

application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java

@@ -53,7 +53,8 @@ public enum Resource {
             EntityType.NOTIFICATION_REQUEST, EntityType.NOTIFICATION_RULE),
     MOBILE_APP_SETTINGS,
     JOB(EntityType.JOB),
-    AI_MODEL(EntityType.AI_MODEL);
+    AI_MODEL(EntityType.AI_MODEL),
+    API_KEY(EntityType.API_KEY);
 
     private final Set<EntityType> entityTypes;
 

application/src/main/java/org/thingsboard/server/service/security/permission/SysAdminPermissions.java

@@ -18,8 +18,10 @@ package org.thingsboard.server.service.security.permission;
 import org.springframework.stereotype.Component;
 import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.id.ApiKeyId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
 import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.service.security.model.SecurityUser;
 
@@ -45,6 +47,7 @@ public class SysAdminPermissions extends AbstractPermissions {
         put(Resource.QUEUE, systemEntityPermissionChecker);
         put(Resource.NOTIFICATION, systemEntityPermissionChecker);
         put(Resource.MOBILE_APP_SETTINGS, PermissionChecker.allowAllPermissionChecker);
+        put(Resource.API_KEY, PermissionChecker.allowAllPermissionChecker);
     }
 
     private static final PermissionChecker systemEntityPermissionChecker = new PermissionChecker() {
@@ -71,4 +74,13 @@ public class SysAdminPermissions extends AbstractPermissions {
 
     };
 
+    private static final PermissionChecker<ApiKeyId, ApiKeyInfo> apiKeysPermissionChecker = new PermissionChecker<>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation) {
+            return true;
+        }
+
+    };
+
 }

application/src/main/java/org/thingsboard/server/service/security/permission/TenantAdminPermissions.java

@@ -20,8 +20,10 @@ import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.User;
 import org.thingsboard.server.common.data.ai.AiModel;
 import org.thingsboard.server.common.data.id.AiModelId;
+import org.thingsboard.server.common.data.id.ApiKeyId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
 import org.thingsboard.server.common.data.security.Authority;
 import org.thingsboard.server.service.security.model.SecurityUser;
 
@@ -59,6 +61,7 @@ public class TenantAdminPermissions extends AbstractPermissions {
         put(Resource.MOBILE_APP_BUNDLE, tenantEntityPermissionChecker);
         put(Resource.JOB, tenantEntityPermissionChecker);
         put(Resource.AI_MODEL, aiModelPermissionChecker);
+        put(Resource.API_KEY, apiKeysPermissionChecker);
     }
 
     public static final PermissionChecker tenantEntityPermissionChecker = new PermissionChecker() {
@@ -163,4 +166,18 @@ public class TenantAdminPermissions extends AbstractPermissions {
 
     };
 
+    private static final PermissionChecker<ApiKeyId, ApiKeyInfo> apiKeysPermissionChecker = new PermissionChecker<>() {
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation) {
+            return true;
+        }
+
+        @Override
+        public boolean hasPermission(SecurityUser user, Operation operation, ApiKeyId entityId, ApiKeyInfo entity) {
+            return user.getTenantId().equals(entity.getTenantId());
+        }
+
+    };
+
 }

application/src/main/java/org/thingsboard/server/service/telemetry/DefaultAlarmSubscriptionService.java

@@ -61,6 +61,8 @@ import org.thingsboard.server.service.subscription.TbSubscriptionUtils;
 
 import java.util.Collection;
 
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.SEVERITY_CHANGED;
+
 /**
  * Created by ashvayka on 27.03.18.
  */
@@ -251,8 +253,11 @@ public class DefaultAlarmSubscriptionService extends AbstractSubscriptionService
                 AlarmComment.AlarmCommentBuilder alarmComment = AlarmComment.builder()
                         .alarmId(alarm.getId())
                         .type(AlarmCommentType.SYSTEM)
-                        .comment(JacksonUtil.newObjectNode().put("text",
+                        .comment(JacksonUtil.newObjectNode()
-                                String.format("Alarm severity was updated from %s to %s", result.getOldSeverity(), alarm.getSeverity())));
+                                .put("text", String.format(SEVERITY_CHANGED.getText(), result.getOldSeverity(), alarm.getSeverity()))
+                                .put("subtype", SEVERITY_CHANGED.name())
+                                .put("oldSeverity", result.getOldSeverity().name())
+                                .put("newSeverity", alarm.getSeverity().name()));
                 if (request != null && request.getUserId() != null) {
                     alarmComment.userId(request.getUserId());
                 }

application/src/main/java/org/thingsboard/server/service/ttl/ApiKeysCleanUpService.java

@@ -0,0 +1,56 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.ttl;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import org.thingsboard.server.dao.pat.ApiKeyDao;
+import org.thingsboard.server.queue.discovery.PartitionService;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+
+@Slf4j
+@Service
+@TbCoreComponent
+@ConditionalOnExpression("${sql.ttl.api_keys.enabled:true} && ${sql.ttl.api_keys.ttl:0} > 0")
+public class ApiKeysCleanUpService extends AbstractCleanUpService {
+
+    public static final String RANDOM_DELAY_INTERVAL_MS_EXPRESSION =
+            "#{T(org.apache.commons.lang3.RandomUtils).nextLong(0, ${sql.ttl.api_keys.checking_interval_ms})}";
+
+    private final ApiKeyDao apiKeyDao;
+
+    public ApiKeysCleanUpService(PartitionService partitionService, ApiKeyDao apiKeyDao) {
+        super(partitionService);
+        this.apiKeyDao = apiKeyDao;
+    }
+
+    @Scheduled(
+            initialDelayString = RANDOM_DELAY_INTERVAL_MS_EXPRESSION,
+            fixedDelayString = "${sql.ttl.api_keys.checking_interval_ms:86400000}"
+    )
+    public void cleanUp() {
+        long threshold = System.currentTimeMillis();
+        if (isSystemTenantPartitionMine()) {
+            int deleted = apiKeyDao.deleteAllByExpirationTimeBefore(threshold);
+            if (deleted > 0) {
+                log.info("API key cleanup removed {} keys (thresholdTs={})", deleted, threshold);
+            }
+        }
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/user/cache/DefaultUserAuthDetailsCache.java

@@ -0,0 +1,78 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.user.cache;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import jakarta.annotation.PostConstruct;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Service;
+import org.thingsboard.server.common.data.EntityType;
+import org.thingsboard.server.common.data.UserAuthDetails;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.msg.plugin.ComponentLifecycleMsg;
+import org.thingsboard.server.dao.user.UserService;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+
+import java.util.concurrent.TimeUnit;
+
+@Slf4j
+@Service
+@TbCoreComponent
+@RequiredArgsConstructor
+public class DefaultUserAuthDetailsCache implements UserAuthDetailsCache {
+
+    private final UserService userService;
+
+    @Value("${cache.userAuthDetails.maxSize:1000}")
+    private int cacheMaxSize;
+    @Value("${cache.userAuthDetails.timeToLiveInMinutes:30}")
+    private int cacheValueTtl;
+    private Cache<UserId, UserAuthDetails> cache;
+
+    @PostConstruct
+    private void init() {
+        cache = Caffeine.newBuilder()
+                .maximumSize(cacheMaxSize)
+                .expireAfterAccess(cacheValueTtl, TimeUnit.MINUTES)
+                .build();
+    }
+
+    @EventListener(ComponentLifecycleMsg.class)
+    public void onComponentLifecycleEvent(ComponentLifecycleMsg event) {
+        if (event.getEntityId() != null) {
+            if (event.getEntityId().getEntityType() == EntityType.USER) {
+                evict(new UserId(event.getEntityId().getId()));
+            }
+        }
+    }
+
+    @Override
+    public UserAuthDetails getUserAuthDetails(TenantId tenantId, UserId userId) {
+        log.trace("Retrieving user with enabled credentials status for id {} for tenant {} from cache", userId, tenantId);
+        return cache.get(userId, id -> userService.findUserAuthDetailsByUserId(tenantId, id));
+    }
+
+    public void evict(UserId userId) {
+        cache.invalidate(userId);
+        log.trace("Evicted record for user {} from cache", userId);
+    }
+
+}

application/src/main/java/org/thingsboard/server/service/user/cache/UserAuthDetailsCache.java

@@ -0,0 +1,26 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.user.cache;
+
+import org.thingsboard.server.common.data.UserAuthDetails;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+
+public interface UserAuthDetailsCache {
+
+    UserAuthDetails getUserAuthDetails(TenantId tenantId, UserId userId);
+
+}

application/src/main/resources/thingsboard.yml

@@ -151,6 +151,12 @@ security:
     tokenSigningKey: "${JWT_TOKEN_SIGNING_KEY:thingsboardDefaultSigningKey}" # Base64 encoded
   # Enable/disable access to Tenant Administrators JWT token by System Administrator or Customer Users JWT token by Tenant Administrator
   user_token_access_enabled: "${SECURITY_USER_TOKEN_ACCESS_ENABLED:true}"
+  # API key parameters
+  api_key:
+    # Prefix for the auto-generated API key. For example, tb_Ood4dQMxWvMH-76z3E_Cv0mZaBWT0Clk3hRSO0P_jNQ
+    value_prefix: "${SECURITY_API_KEY_VALUE_PREFIX:tb_}"
+    # Length of the auto-generated API key. Max is 255
+    value_bytes_size: "${SECURITY_API_KEY_VALUE_PREFIX:64}"
   # Enable/disable case-sensitive username login
   user_login_case_sensitive: "${SECURITY_USER_LOGIN_CASE_SENSITIVE:true}"
   claim:
@@ -430,6 +436,9 @@ sql:
       enabled: "${SQL_TTL_NOTIFICATIONS_ENABLED:true}" # Enable/disable TTL (Time To Live) for notification center records
       ttl: "${SQL_TTL_NOTIFICATIONS_SECS:2592000}" # Default value - 30 days
       checking_interval_ms: "${SQL_TTL_NOTIFICATIONS_CHECKING_INTERVAL_MS:86400000}" # Default value - 1 day
+    api_keys:
+      enabled: "${SQL_TTL_API_KEYS_ENABLED:true}" # Enable/disable TTL (Time To Live) for expired api keys records
+      checking_interval_ms: "${SQL_TTL_API_KEYS_CHECKING_INTERVAL_MS:86400000}" # Default value - 1 day
   relations:
     max_level: "${SQL_RELATIONS_MAX_LEVEL:50}" # This value has to be reasonably small to prevent infinite recursion as early as possible
     pool_size: "${SQL_RELATIONS_POOL_SIZE:4}" # This value has to be reasonably small to prevent the relation query from blocking all other DB calls
@@ -670,6 +679,9 @@ cache:
     aiModel:
       timeToLiveInMinutes: "${CACHE_SPECS_AI_MODEL_TTL:1440}" # AI model cache TTL
       maxSize: "${CACHE_SPECS_AI_MODEL_MAX_SIZE:10000}" # 0 means the cache is disabled
+    apiKeys:
+      timeToLiveInMinutes: "${CACHE_SPECS_API_KEYS_TTL:1440}" # API keys cache TTL
+      maxSize: "${CACHE_SPECS_API_KEYS_MAX_SIZE:10000}" # 0 means the cache is disabled
 
   # Deliberately placed outside the 'specs' group above
   notificationRules:
@@ -690,6 +702,9 @@ cache:
   tbResourceData:
     timeToLiveInMinutes: "${CACHE_SPECS_RESOURCE_DATA_TTL:10080}" # TB resource data cache TTL
     maxSize: "${CACHE_SPECS_RESOURCE_DATA_MAX_SIZE:100000}" # 0 means the cache is disabled
+  userAuthDetails:
+    timeToLiveInMinutes: "${CACHE_SPECS_USER_AUTH_DETAILS_TTL:120}" # User auth details cache TTL
+    maxSize: "${CACHE_SPECS_USER_AUTH_DETAILS_MAX_SIZE:200000}" # 0 means the cache is disabled
 
 # Spring data parameters
 spring.data.redis.repositories.enabled: false # Disable this because it is not required.

application/src/test/java/org/thingsboard/server/cf/CalculatedFieldCurrentOwnerTest.java

@@ -26,10 +26,9 @@ import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
 import org.thingsboard.server.common.data.cf.configuration.CurrentOwnerDynamicSourceConfiguration;
-import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.id.AssetProfileId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.controller.AbstractControllerTest;
@@ -175,9 +174,8 @@ public class CalculatedFieldCurrentOwnerTest extends AbstractControllerTest {
 
         config.setExpression("a + 100");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("result");
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
 
         config.setOutput(output);

application/src/test/java/org/thingsboard/server/cf/CalculatedFieldIntegrationTest.java

@@ -33,14 +33,15 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
+import org.thingsboard.server.common.data.cf.configuration.AttributesOutput;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
-import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.PropagationCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.RelationPathQueryDynamicSourceConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.ScriptCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesImmediateOutputStrategy;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.cf.configuration.geofencing.EntityCoordinates;
 import org.thingsboard.server.common.data.cf.configuration.geofencing.GeofencingCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.geofencing.ZoneGroupConfiguration;
@@ -93,13 +94,11 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("T", argument));
         config.setExpression("(T * 9/5) + 32");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("fahrenheitTemp");
-        output.setType(OutputType.TIME_SERIES);
         config.setOutput(output);
 
         calculatedField.setConfiguration(config);
-        calculatedField.setVersion(1L);
 
         CalculatedField savedCalculatedField = doPost("/api/calculatedField", calculatedField, CalculatedField.class);
 
@@ -121,10 +120,12 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
                     assertThat(fahrenheitTemp.get("fahrenheitTemp").get(0).get("value").asText()).isEqualTo("86.0");
                 });
 
-        Output savedOutput = savedCalculatedField.getConfiguration().getOutput();
+        AttributesOutput newOutput = new AttributesOutput();
-        savedOutput.setType(OutputType.ATTRIBUTES);
+        newOutput.setScope(AttributeScope.SERVER_SCOPE);
-        savedOutput.setScope(AttributeScope.SERVER_SCOPE);
+        newOutput.setName("temperatureF");
-        savedOutput.setName("temperatureF");
+        config.setOutput(newOutput);
+        savedCalculatedField.setConfiguration(config);
+
         savedCalculatedField = doPost("/api/calculatedField", savedCalculatedField, CalculatedField.class);
 
         await().alias("update CF output -> perform calculation with updated output").atMost(TIMEOUT, TimeUnit.SECONDS)
@@ -179,9 +180,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("T", argument));
         config.setExpression("(T * 9/5) + 32");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("fahrenheitTemp");
-        output.setType(OutputType.TIME_SERIES);
         config.setOutput(output);
 
         calculatedField.setConfiguration(config);
@@ -228,9 +228,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("T", argument));
         config.setExpression("(T * 9/5) + 32");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("fahrenheitTemp");
-        output.setType(OutputType.TIME_SERIES);
         config.setOutput(output);
 
         calculatedField.setConfiguration(config);
@@ -292,9 +291,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
 
         config.setExpression("x + y");
 
-        Output output = new Output();
+        AttributesOutput output = new AttributesOutput();
         output.setName("z");
-        output.setType(OutputType.ATTRIBUTES);
         output.setScope(AttributeScope.SERVER_SCOPE);
 
         config.setOutput(output);
@@ -449,9 +447,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("T", argument));
         config.setExpression("(T * 9/0) + 32");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("fahrenheitTemp");
-        output.setType(OutputType.TIME_SERIES);
         config.setOutput(output);
 
         calculatedField.setConfiguration(config);
@@ -499,9 +496,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("T", argument));
         config.setExpression("(T * 9/5) + 32");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("fahrenheitTemp");
-        output.setType(OutputType.TIME_SERIES);
         config.setOutput(output);
 
         config.setUseLatestTs(true);
@@ -549,9 +545,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("a", argument1, "b", argument2));
         config.setExpression("a + b");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("c");
-        output.setType(OutputType.TIME_SERIES);
         config.setOutput(output);
 
         config.setUseLatestTs(true);
@@ -603,9 +598,7 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("T", argument));
         config.setExpression("return {\"ts\": ctx.latestTs, \"values\": {\"fahrenheitTemp\": (T * 1.8) + 32}};");
 
-        Output output = new Output();
+        config.setOutput(new TimeSeriesOutput());
-        output.setType(OutputType.TIME_SERIES);
-        config.setOutput(output);
 
         calculatedField.setConfiguration(config);
 
@@ -639,9 +632,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("m", argument));
         config.setExpression("m + 1");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("m1");
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
         config.setOutput(output);
 
@@ -714,8 +706,7 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         cfg.setZoneGroups(Map.of("allowedZones", allowedZonesGroup, "restrictedZones", restrictedZonesGroup));
 
         // Output to server attributes
-        Output out = new Output();
+        AttributesOutput out = new AttributesOutput();
-        out.setType(OutputType.ATTRIBUTES);
         out.setScope(AttributeScope.SERVER_SCOPE);
         cfg.setOutput(out);
 
@@ -825,8 +816,7 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         cfg.setZoneGroups(Map.of("allowedZones", allowedZonesGroup, "restrictedZones", restrictedZonesGroup));
 
         // Output to server attributes
-        Output out = new Output();
+        AttributesOutput out = new AttributesOutput();
-        out.setType(OutputType.ATTRIBUTES);
         out.setScope(AttributeScope.SERVER_SCOPE);
         cfg.setOutput(out);
 
@@ -923,8 +913,7 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         cfg.setZoneGroups(Map.of("allowedZones", allowedZonesGroup));
 
         // Server attributes output
-        Output out = new Output();
+        AttributesOutput out = new AttributesOutput();
-        out.setType(OutputType.ATTRIBUTES);
         out.setScope(AttributeScope.SERVER_SCOPE);
         cfg.setOutput(out);
 
@@ -1034,8 +1023,7 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
 
         cfg.setExpression("{\"testResult\": t * 2}");
 
-        Output output = new Output();
+        AttributesOutput output = new AttributesOutput();
-        output.setType(OutputType.ATTRIBUTES);
         output.setScope(AttributeScope.SERVER_SCOPE);
         cfg.setOutput(output);
 
@@ -1111,9 +1099,7 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         arg.setRefEntityKey(new ReferencedEntityKey("temperature", ArgumentType.TS_LATEST, null));
         cfg.setArguments(Map.of("temperatureComputed", arg));
 
-        Output output = new Output();
+        cfg.setOutput(new TimeSeriesOutput());
-        output.setType(OutputType.TIME_SERIES);
-        cfg.setOutput(output);
 
         cf.setConfiguration(cfg);
 
@@ -1181,9 +1167,8 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
         config.setArguments(Map.of("a", argumentA, "b", argumentB));
         config.setExpression("a + b");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("c");
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
         config.setOutput(output);
 
@@ -1210,6 +1195,48 @@ public class CalculatedFieldIntegrationTest extends CalculatedFieldControllerTes
                 });
     }
 
+    @Test
+    public void testSimpleCalculatedFieldWhenSkipRuleEngineOutputProcessing() throws Exception {
+        Device testDevice = createDevice("Test device", "1234567890");
+
+        postTelemetry(testDevice.getId(), "{\"temperature\":24.5}");
+
+        CalculatedField calculatedField = new CalculatedField();
+        calculatedField.setEntityId(testDevice.getId());
+        calculatedField.setType(CalculatedFieldType.SIMPLE);
+        calculatedField.setName("C to F");
+        calculatedField.setDebugSettings(DebugSettings.all());
+
+        SimpleCalculatedFieldConfiguration config = new SimpleCalculatedFieldConfiguration();
+
+        Argument argument = new Argument();
+        ReferencedEntityKey refEntityKey = new ReferencedEntityKey("temperature", ArgumentType.TS_LATEST, null);
+        argument.setRefEntityKey(refEntityKey);
+        config.setArguments(Map.of("T", argument));
+        config.setExpression("(T * 9/5) + 32");
+
+        TimeSeriesOutput output = new TimeSeriesOutput();
+        output.setName("fahrenheitTemp");
+        output.setDecimalsByDefault(1);
+        output.setStrategy(new TimeSeriesImmediateOutputStrategy(1000L, true, true, true, true));
+
+        config.setOutput(output);
+
+        config.setUseLatestTs(true);
+
+        calculatedField.setConfiguration(config);
+
+        CalculatedField savedCalculatedField = doPost("/api/calculatedField", calculatedField, CalculatedField.class);
+
+        await().alias("create CF -> perform initial calculation").atMost(TIMEOUT, TimeUnit.SECONDS)
+                .pollInterval(POLL_INTERVAL, TimeUnit.SECONDS)
+                .untilAsserted(() -> {
+                    ObjectNode fahrenheitTemp = getLatestTelemetry(testDevice.getId(), "fahrenheitTemp");
+                    assertThat(fahrenheitTemp).isNotNull();
+                    assertThat(fahrenheitTemp.get("fahrenheitTemp").get(0).get("value").asText()).isEqualTo("76.1");
+                });
+    }
+
     private ObjectNode getLatestTelemetry(EntityId entityId, String... keys) throws Exception {
         return doGetAsync("/api/plugins/telemetry/" + entityId.getEntityType() + "/" + entityId.getId() + "/values/timeseries?keys=" + String.join(",", keys), ObjectNode.class);
     }

application/src/test/java/org/thingsboard/server/cf/EntityAggregationCalculatedFieldTest.java

@@ -29,8 +29,8 @@ import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
 import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggFunction;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggKeyInput;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggMetric;
@@ -209,8 +209,7 @@ public class EntityAggregationCalculatedFieldTest extends AbstractControllerTest
         consumption.setDefaultValue(9999L);
         aggMetrics.put("consumption", consumption);
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
 
         return createAggCf("Consumption per minute", entityId,

application/src/test/java/org/thingsboard/server/cf/RelatedEntitiesAggregationCalculatedFieldTest.java

@@ -32,9 +32,10 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
+import org.thingsboard.server.common.data.cf.configuration.AttributesOutput;
 import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggFunction;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggFunctionInput;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggKeyInput;
@@ -626,8 +627,7 @@ public class RelatedEntitiesAggregationCalculatedFieldTest extends AbstractContr
                 });
 
         var configuration = (RelatedEntitiesAggregationCalculatedFieldConfiguration) cf.getConfiguration();
-        Output output = new Output();
+        AttributesOutput output = new AttributesOutput();
-        output.setType(OutputType.ATTRIBUTES);
         output.setScope(AttributeScope.SERVER_SCOPE);
         configuration.setOutput(output);
         saveCalculatedField(cf);
@@ -702,8 +702,7 @@ public class RelatedEntitiesAggregationCalculatedFieldTest extends AbstractContr
         avgMetric.setInput(new AggKeyInput("temp"));
         aggMetrics.put("avgTemperature", avgMetric);
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
 
         return createAggCf("Average temperature", entityId,
@@ -739,8 +738,7 @@ public class RelatedEntitiesAggregationCalculatedFieldTest extends AbstractContr
         totalSpaces.setInput(new AggFunctionInput("return 1;"));
         aggMetrics.put("totalSpaces", totalSpaces);
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
 
         return createAggCf("Occupied spaces", entityId,
@@ -776,8 +774,7 @@ public class RelatedEntitiesAggregationCalculatedFieldTest extends AbstractContr
         totalSpaces.setInput(new AggFunctionInput("return 1;"));
         aggMetrics.put("totalSpaces", totalSpaces);
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(0);
 
         return createAggCf("Occupied spaces", entityId,

application/src/test/java/org/thingsboard/server/controller/AbstractWebTest.java

@@ -200,6 +200,8 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import static org.springframework.test.web.servlet.setup.MockMvcBuilders.webAppContextSetup;
 import static org.thingsboard.server.common.data.CacheConstants.CLAIM_DEVICES_CACHE;
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.API_KEY_HEADER_PREFIX;
+import static org.thingsboard.server.config.ThingsboardSecurityConfiguration.BEARER_HEADER_PREFIX;
 
 @Slf4j
 public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
@@ -245,6 +247,8 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
     protected String mobileToken;
     protected String username;
 
+    protected String apiKey;
+
     protected TenantId tenantId;
     protected TenantProfileId tenantProfileId;
     protected UserId tenantAdminUserId;
@@ -644,13 +648,27 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
 
     protected void setJwtToken(MockHttpServletRequestBuilder request) {
         if (this.token != null) {
-            request.header(ThingsboardSecurityConfiguration.JWT_TOKEN_HEADER_PARAM, "Bearer " + this.token);
+            request.header(ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER, BEARER_HEADER_PREFIX + this.token);
         }
         if (this.mobileToken != null) {
             request.header(UserController.MOBILE_TOKEN_HEADER, this.mobileToken);
         }
     }
 
+    protected void resetApiKey() {
+        this.apiKey = null;
+    }
+
+    protected void setApiKey(String apiKey) {
+        this.apiKey = apiKey;
+    }
+
+    protected void setApiKey(MockHttpServletRequestBuilder request) {
+        if (this.apiKey != null) {
+            request.header(ThingsboardSecurityConfiguration.AUTHORIZATION_HEADER, API_KEY_HEADER_PREFIX + this.apiKey);
+        }
+    }
+
     protected DeviceProfile createDeviceProfile(String name) {
         return createDeviceProfile(name, null);
     }
@@ -768,6 +786,12 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
         return mockMvc.perform(getRequest);
     }
 
+    protected ResultActions doGetWithApiKey(String urlTemplate, Object... urlVariables) throws Exception {
+        MockHttpServletRequestBuilder getRequest = get(urlTemplate, urlVariables);
+        setApiKey(getRequest);
+        return mockMvc.perform(getRequest);
+    }
+
     protected <T> T doGet(String urlTemplate, Class<T> responseClass, Object... urlVariables) throws Exception {
         return readResponse(doGet(urlTemplate, urlVariables).andExpect(status().isOk()), responseClass);
     }
@@ -791,6 +815,10 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
         return mockMvc.perform(asyncDispatch(mockMvc.perform(getRequest).andExpect(request().asyncStarted()).andReturn()));
     }
 
+    protected <T> T doGetWithApiKey(String urlTemplate, Class<T> responseClass, Object... urlVariables) throws Exception {
+        return readResponse(doGetWithApiKey(urlTemplate, urlVariables).andExpect(status().isOk()), responseClass);
+    }
+
     protected <T> T doGetTyped(String urlTemplate, TypeReference<T> responseType, Object... urlVariables) throws Exception {
         return readResponse(doGet(urlTemplate, urlVariables).andExpect(status().isOk()), responseType);
     }
@@ -870,6 +898,14 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
         }
     }
 
+    protected <T, R> R doPostWithApiKey(String urlTemplate, T content, Class<R> responseClass, String... params) {
+        try {
+            return readResponse(doPostWithApiKey(urlTemplate, content, params).andExpect(status().isOk()), responseClass);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
     protected <T, R> R doPostWithResponse(String urlTemplate, T content, Class<R> responseClass, String... params) throws Exception {
         return readResponse(doPost(urlTemplate, content, params).andExpect(status().isOk()), responseClass);
     }
@@ -937,6 +973,14 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
         return mockMvc.perform(postRequest);
     }
 
+    protected <T> ResultActions doPostWithApiKey(String urlTemplate, T content, String... params) throws Exception {
+        MockHttpServletRequestBuilder postRequest = post(urlTemplate, params);
+        setApiKey(postRequest);
+        String json = json(content);
+        postRequest.contentType(contentType).content(json);
+        return mockMvc.perform(postRequest);
+    }
+
     protected <T> ResultActions doPostAsync(String urlTemplate, T content, Long timeout, String... params) throws Exception {
         MockHttpServletRequestBuilder postRequest = post(urlTemplate, params);
         setJwtToken(postRequest);
@@ -963,6 +1007,13 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
         return mockMvc.perform(asyncDispatch(result));
     }
 
+    protected ResultActions doDeleteWithApiKey(String urlTemplate, String... params) throws Exception {
+        MockHttpServletRequestBuilder deleteRequest = delete(urlTemplate);
+        setApiKey(deleteRequest);
+        populateParams(deleteRequest, params);
+        return mockMvc.perform(deleteRequest);
+    }
+
     protected ResultActions doDeleteAsync(String urlTemplate, Long timeout, String... params) throws Exception {
         MockHttpServletRequestBuilder deleteRequest = delete(urlTemplate, params);
         setJwtToken(deleteRequest);
@@ -1358,12 +1409,12 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
 
     protected void postTelemetry(EntityId entityId, String payload) throws Exception {
         doPostAsync("/api/plugins/telemetry/" + entityId.getEntityType() + "/" + entityId.getId() +
-                    "/timeseries/" + DataConstants.SERVER_SCOPE, JacksonUtil.toJsonNode(payload), 30_000L).andExpect(status().isOk());
+                "/timeseries/" + DataConstants.SERVER_SCOPE, JacksonUtil.toJsonNode(payload), 30_000L).andExpect(status().isOk());
     }
 
     protected void postAttributes(EntityId entityId, AttributeScope scope, String payload) throws Exception {
         doPostAsync("/api/plugins/telemetry/" + entityId.getEntityType() + "/" + entityId.getId() +
-                    "/attributes/" + scope, JacksonUtil.toJsonNode(payload), 30_000L).andExpect(status().isOk());
+                "/attributes/" + scope, JacksonUtil.toJsonNode(payload), 30_000L).andExpect(status().isOk());
     }
 
     protected CalculatedField saveCalculatedField(CalculatedField calculatedField) {
@@ -1372,7 +1423,7 @@ public abstract class AbstractWebTest extends AbstractInMemoryStorageTest {
 
     protected PageData<CalculatedField> getCalculatedFields(EntityId entityId, CalculatedFieldType type, PageLink pageLink) throws Exception {
         return doGetTypedWithPageLink("/api/" + entityId.getEntityType() + "/" + entityId.getId() + "/calculatedFields" +
-                                      (type != null ? "?type=" + type.name() + "&" : "?"), new TypeReference<>() {}, pageLink);
+                (type != null ? "?type=" + type.name() + "&" : "?"), new TypeReference<>() {}, pageLink);
     }
 
     protected PageData<EventInfo> getDebugEvents(TenantId tenantId, EntityId entityId, int limit) throws Exception {

application/src/test/java/org/thingsboard/server/controller/AlarmCommentControllerTest.java

@@ -48,6 +48,7 @@ import java.util.List;
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.thingsboard.server.common.data.alarm.AlarmCommentSubType.COMMENT_DELETED;
 
 @Slf4j
 @ContextConfiguration(classes = {AlarmCommentControllerTest.Config.class})
@@ -207,8 +208,10 @@ public class AlarmCommentControllerTest extends AbstractControllerTest {
         AlarmComment expectedAlarmComment = AlarmComment.builder()
                 .alarmId(alarm.getId())
                 .type(AlarmCommentType.SYSTEM)
-                .comment(JacksonUtil.newObjectNode().put("text", String.format("User %s deleted his comment",
+                .comment(JacksonUtil.newObjectNode()
-                        CUSTOMER_USER_EMAIL)))
+                        .put("text", String.format(COMMENT_DELETED.getText(), CUSTOMER_USER_EMAIL))
+                        .put("subtype", COMMENT_DELETED.name())
+                        .put("userName", CUSTOMER_USER_EMAIL))
                 .build();
         testLogEntityActionEntityEqClass(alarm, alarm.getId(), tenantId, customerId, customerUserId, CUSTOMER_USER_EMAIL, ActionType.DELETED_COMMENT, 1, expectedAlarmComment);
     }
@@ -226,8 +229,10 @@ public class AlarmCommentControllerTest extends AbstractControllerTest {
         AlarmComment expectedAlarmComment = AlarmComment.builder()
                 .alarmId(alarm.getId())
                 .type(AlarmCommentType.SYSTEM)
-                .comment(JacksonUtil.newObjectNode().put("text", String.format("User %s deleted his comment",
+                .comment(JacksonUtil.newObjectNode()
-                        TENANT_ADMIN_EMAIL)))
+                        .put("text", String.format(COMMENT_DELETED.getText(), TENANT_ADMIN_EMAIL))
+                        .put("subtype", COMMENT_DELETED.name())
+                        .put("userName", TENANT_ADMIN_EMAIL))
                 .build();
         testLogEntityActionEntityEqClass(alarm, alarm.getId(), tenantId, customerId, tenantAdminUserId, TENANT_ADMIN_EMAIL, ActionType.DELETED_COMMENT, 1, expectedAlarmComment);
     }

application/src/test/java/org/thingsboard/server/controller/ApiKeyControllerTest.java

@@ -0,0 +1,144 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.data.pat.ApiKey;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
+import org.thingsboard.server.dao.service.DaoSqlTest;
+
+import java.util.UUID;
+
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@DaoSqlTest
+public class ApiKeyControllerTest extends AbstractControllerTest {
+
+    @Before
+    public void setUp() throws Exception {
+        loginTenantAdmin();
+    }
+
+    @Test
+    public void testSaveApiKey() throws Exception {
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo("New API key description", true);
+
+        doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+
+        PageData<ApiKeyInfo> pageData = doGetTypedWithPageLink("/api/apiKeys/" + tenantAdminUserId + "?", new TypeReference<>() {}, new PageLink(10, 0));
+        Assert.assertEquals(1, pageData.getData().size());
+
+        ApiKeyInfo savedApiKey = pageData.getData().get(0);
+        Assert.assertNotNull(savedApiKey);
+        Assert.assertEquals(apiKeyInfo.getDescription(), savedApiKey.getDescription());
+        Assert.assertEquals(apiKeyInfo.isEnabled(), savedApiKey.isEnabled());
+        Assert.assertEquals(tenantId, savedApiKey.getTenantId());
+        Assert.assertEquals(tenantAdminUser.getId(), savedApiKey.getUserId());
+
+        doDelete("/api/apiKey/" + savedApiKey.getId()).andExpect(status().isOk());
+    }
+
+    @Test
+    public void tesFindUserApiKeys() throws Exception {
+        PageData<ApiKeyInfo> pageData = doGetTypedWithPageLink("/api/apiKeys/" + tenantAdminUserId + "?", new TypeReference<>() {}, new PageLink(10, 0));
+        Assert.assertTrue(pageData.getData().isEmpty());
+
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo("Test API key description", true);
+        int expectedSize = 10;
+        for (int i = 0; i < expectedSize; i++) {
+            doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+        }
+
+        PageData<ApiKeyInfo> pageData2 = doGetTypedWithPageLink("/api/apiKeys/" + tenantAdminUserId + "?", new TypeReference<>() {}, new PageLink(10, 0));
+        Assert.assertEquals(expectedSize, pageData2.getData().size());
+
+        pageData2.getData().forEach(apiKey -> {
+            try {
+                doDelete("/api/apiKey/" + apiKey.getId()).andExpect(status().isOk());
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
+    }
+
+    @Test
+    public void testUpdateApiKeyDescription() throws Exception {
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo("Test API key description", true);
+        doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+
+        PageData<ApiKeyInfo> pageData = doGetTypedWithPageLink("/api/apiKeys/" + tenantAdminUserId + "?", new TypeReference<>() {}, new PageLink(10, 0));
+        Assert.assertEquals(1, pageData.getData().size());
+
+        ApiKeyInfo savedApiKey = pageData.getData().get(0);
+
+        String newDescription = "Updated API Key Description";
+
+        ApiKeyInfo updatedApiKeyInfo = doPut("/api/apiKey/" + savedApiKey.getId().getId() + "/description", newDescription, ApiKeyInfo.class);
+        Assert.assertNotNull(updatedApiKeyInfo);
+        Assert.assertEquals(newDescription, updatedApiKeyInfo.getDescription());
+
+        doDelete("/api/apiKey/" + savedApiKey.getId()).andExpect(status().isOk());
+    }
+
+    @Test
+    public void testEnableApiKey() throws Exception {
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo("Test API key description", true);
+        doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+
+        PageData<ApiKeyInfo> pageData = doGetTypedWithPageLink("/api/apiKeys/" + tenantAdminUserId + "?", new TypeReference<>() {}, new PageLink(10, 0));
+        Assert.assertEquals(1, pageData.getData().size());
+
+        ApiKeyInfo savedApiKey = pageData.getData().get(0);
+
+        ApiKeyInfo disabledApiKeyInfo = doPut("/api/apiKey/" + savedApiKey.getId().getId() + "/enabled/false", Boolean.FALSE, ApiKeyInfo.class);
+        Assert.assertNotNull(disabledApiKeyInfo);
+        Assert.assertFalse(disabledApiKeyInfo.isEnabled());
+
+        ApiKeyInfo enabledApiKeyInfo = doPut("/api/apiKey/" + savedApiKey.getId().getId() + "/enabled/true", Boolean.TRUE, ApiKeyInfo.class);
+        Assert.assertNotNull(enabledApiKeyInfo);
+        Assert.assertTrue(enabledApiKeyInfo.isEnabled());
+
+        doDelete("/api/apiKey/" + savedApiKey.getId()).andExpect(status().isOk());
+    }
+
+    @Test
+    public void testDeleteApiKey() throws Exception {
+        doDelete("/api/apiKey/" + UUID.randomUUID()).andExpect(status().isNotFound());
+
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo("Test API key description", false);
+        doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+
+        PageData<ApiKeyInfo> pageData = doGetTypedWithPageLink("/api/apiKeys/" + tenantAdminUserId + "?", new TypeReference<>() {}, new PageLink(10, 0));
+        Assert.assertEquals(1, pageData.getData().size());
+        ApiKeyInfo savedApiKey = pageData.getData().get(0);
+
+        doDelete("/api/apiKey/" + savedApiKey.getId().getId()).andExpect(status().isOk());
+    }
+
+    private ApiKeyInfo constructApiKeyInfo(String description, boolean enabled) {
+        ApiKeyInfo apiKeyInfo = new ApiKeyInfo();
+        apiKeyInfo.setDescription(description);
+        apiKeyInfo.setEnabled(enabled);
+        apiKeyInfo.setUserId(tenantAdminUserId);
+        return apiKeyInfo;
+    }
+
+}

application/src/test/java/org/thingsboard/server/controller/CalculatedFieldControllerTest.java

@@ -26,12 +26,11 @@ import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
-import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.PropagationCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.RelationPathQueryDynamicSourceConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggKeyInput;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.AggMetric;
 import org.thingsboard.server.common.data.cf.configuration.aggregation.single.EntityAggregationCalculatedFieldConfiguration;
@@ -286,13 +285,10 @@ public class CalculatedFieldControllerTest extends AbstractControllerTest {
         var zoneGroupConfiguration = new ZoneGroupConfiguration("perimeter", REPORT_TRANSITION_EVENTS_AND_PRESENCE_STATUS, false);
         zoneGroupConfiguration.setRefDynamicSourceConfiguration(refDynamicSourceConfiguration);
 
-        Output output = new Output();
-        output.setType(OutputType.TIME_SERIES);
-
         config.setEntityCoordinates(new EntityCoordinates("latitide", "longitude"));
         config.setZoneGroups(Map.of("safeArea", zoneGroupConfiguration));
         config.setScheduledUpdateEnabled(false);
-        config.setOutput(output);
+        config.setOutput(new TimeSeriesOutput());
 
         return config;
     }
@@ -310,10 +306,7 @@ public class CalculatedFieldControllerTest extends AbstractControllerTest {
 
         config.setApplyExpressionToResolvedArguments(false);
         config.setExpression(null);
-
+        config.setOutput(new TimeSeriesOutput());
-        Output output = new Output();
-        output.setType(OutputType.TIME_SERIES);
-        config.setOutput(output);
 
         Argument arg = new Argument();
         arg.setRefEntityKey(new ReferencedEntityKey("temperature", ArgumentType.TS_LATEST, null));
@@ -337,9 +330,7 @@ public class CalculatedFieldControllerTest extends AbstractControllerTest {
         config.setWatermark(new Watermark(TimeUnit.DAYS.toSeconds(1)));
         config.setInterval(new HourInterval("Europe/Kiev", TimeUnit.MINUTES.toSeconds(15)));
 
-        Output output = new Output();
+        config.setOutput(new TimeSeriesOutput());
-        output.setType(OutputType.TIME_SERIES);
-        config.setOutput(output);
 
         return config;
     }
@@ -356,9 +347,8 @@ public class CalculatedFieldControllerTest extends AbstractControllerTest {
 
         config.setExpression("T - (100 - H) / 5");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("output");
-        output.setType(OutputType.TIME_SERIES);
 
         config.setOutput(output);
 

application/src/test/java/org/thingsboard/server/edge/CalculatedFieldEdgeTest.java

@@ -26,10 +26,9 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
-import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.debug.DebugSettings;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.dao.service.DaoSqlTest;
@@ -224,9 +223,8 @@ public class CalculatedFieldEdgeTest extends AbstractEdgeTest {
 
         config.setExpression("(T * 9/5) + 32");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("fahrenheitTemp");
-        output.setType(OutputType.TIME_SERIES);
         output.setDecimalsByDefault(2);
         config.setOutput(output);
 

application/src/test/java/org/thingsboard/server/service/cf/ctx/state/GeofencingCalculatedFieldStateTest.java

@@ -29,8 +29,8 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.RelationPathQueryDynamicSourceConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.cf.configuration.geofencing.EntityCoordinates;
 import org.thingsboard.server.common.data.cf.configuration.geofencing.GeofencingCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.geofencing.GeofencingReportStrategy;
@@ -476,9 +476,7 @@ public class GeofencingCalculatedFieldStateTest {
 
         config.setZoneGroups(Map.of("allowedZones", allowedZonesGroup, "restrictedZones", restrictedZonesGroup));
 
-        Output output = new Output();
+        config.setOutput(new TimeSeriesOutput());
-        output.setType(OutputType.TIME_SERIES);
-        config.setOutput(output);
         return config;
     }
 

application/src/test/java/org/thingsboard/server/service/cf/ctx/state/PropagationCalculatedFieldStateTest.java

@@ -31,8 +31,8 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
+import org.thingsboard.server.common.data.cf.configuration.AttributesOutput;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
-import org.thingsboard.server.common.data.cf.configuration.Output;
 import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.PropagationCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
@@ -235,8 +235,7 @@ public class PropagationCalculatedFieldStateTest {
         config.setArguments(Map.of(TEMPERATURE_ARGUMENT_NAME, temperatureArg));
         config.setExpression("{" + TEST_RESULT_EXPRESSION_KEY + ": " + TEMPERATURE_ARGUMENT_NAME + " * 2}");
 
-        Output output = new Output();
+        AttributesOutput output = new AttributesOutput();
-        output.setType(OutputType.ATTRIBUTES);
         output.setScope(AttributeScope.SERVER_SCOPE);
         config.setOutput(output);
 

application/src/test/java/org/thingsboard/server/service/cf/ctx/state/ScriptCalculatedFieldStateTest.java

@@ -31,9 +31,9 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
+import org.thingsboard.server.common.data.cf.configuration.AttributesOutput;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.id.AssetId;
@@ -221,8 +221,7 @@ public class ScriptCalculatedFieldStateTest {
 
         config.setExpression("return {\"maxDeviceTemperature\": deviceTemperature.max(), \"assetHumidity\": assetHumidity / 2 }");
 
-        Output output = new Output();
+        AttributesOutput output = new AttributesOutput();
-        output.setType(OutputType.ATTRIBUTES);
         output.setScope(AttributeScope.SERVER_SCOPE);
 
         config.setOutput(output);

application/src/test/java/org/thingsboard/server/service/cf/ctx/state/SimpleCalculatedFieldStateTest.java

@@ -28,9 +28,9 @@ import org.thingsboard.server.common.data.cf.CalculatedField;
 import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
+import org.thingsboard.server.common.data.cf.configuration.AttributesOutput;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
 import org.thingsboard.server.common.data.id.AssetId;
@@ -263,9 +263,8 @@ public class SimpleCalculatedFieldStateTest {
 
         config.setExpression("key1 + key2 + key3");
 
-        Output output = new Output();
+        AttributesOutput output = new AttributesOutput();
         output.setName("output");
-        output.setType(OutputType.ATTRIBUTES);
         output.setScope(AttributeScope.SERVER_SCOPE);
         output.setDecimalsByDefault(0);
 

application/src/test/java/org/thingsboard/server/service/security/auth/JwtTokenFactoryTest.java

@@ -60,7 +60,7 @@ public class JwtTokenFactoryTest {
     public void beforeEach() {
         jwtSettings = new JwtSettings();
         jwtSettings.setTokenIssuer("tb");
-        jwtSettings.setTokenSigningKey(Base64.getEncoder().encodeToString(RandomStringUtils.randomAlphanumeric(64).getBytes(StandardCharsets.UTF_8)));
+        jwtSettings.setTokenSigningKey(Base64.getEncoder().encodeToString(RandomStringUtils.secure().nextAlphanumeric(64).getBytes(StandardCharsets.UTF_8)));
         jwtSettings.setTokenExpirationTime((int) TimeUnit.HOURS.toSeconds(2));
         jwtSettings.setRefreshTokenExpTime((int) TimeUnit.DAYS.toSeconds(7));
 
@@ -89,7 +89,7 @@ public class JwtTokenFactoryTest {
         AccessJwtToken accessToken = tokenFactory.createAccessJwtToken(securityUser);
         checkExpirationTime(accessToken, jwtSettings.getTokenExpirationTime());
 
-        SecurityUser parsedSecurityUser = tokenFactory.parseAccessJwtToken(accessToken.getToken());
+        SecurityUser parsedSecurityUser = tokenFactory.parseAccessJwtToken(accessToken.token());
         assertThat(parsedSecurityUser.getId()).isEqualTo(securityUser.getId());
         assertThat(parsedSecurityUser.getEmail()).isEqualTo(securityUser.getEmail());
         assertThat(parsedSecurityUser.getUserPrincipal()).matches(userPrincipal -> {
@@ -112,7 +112,7 @@ public class JwtTokenFactoryTest {
         JwtToken refreshToken = tokenFactory.createRefreshToken(securityUser);
         checkExpirationTime(refreshToken, jwtSettings.getRefreshTokenExpTime());
 
-        SecurityUser parsedSecurityUser = tokenFactory.parseRefreshToken(refreshToken.getToken());
+        SecurityUser parsedSecurityUser = tokenFactory.parseRefreshToken(refreshToken.token());
         assertThat(parsedSecurityUser.getId()).isEqualTo(securityUser.getId());
         assertThat(parsedSecurityUser.getUserPrincipal()).matches(userPrincipal -> {
             return userPrincipal.getType().equals(securityUser.getUserPrincipal().getType())
@@ -128,7 +128,7 @@ public class JwtTokenFactoryTest {
         JwtToken preVerificationToken = tokenFactory.createMfaToken(securityUser, Authority.PRE_VERIFICATION_TOKEN, tokenLifetime);
         checkExpirationTime(preVerificationToken, tokenLifetime);
 
-        SecurityUser parsedSecurityUser = tokenFactory.parseAccessJwtToken(preVerificationToken.getToken());
+        SecurityUser parsedSecurityUser = tokenFactory.parseAccessJwtToken(preVerificationToken.token());
         assertThat(parsedSecurityUser.getId()).isEqualTo(securityUser.getId());
         assertThat(parsedSecurityUser.getAuthority()).isEqualTo(Authority.PRE_VERIFICATION_TOKEN);
         assertThat(parsedSecurityUser.getTenantId()).isEqualTo(securityUser.getTenantId());
@@ -144,7 +144,7 @@ public class JwtTokenFactoryTest {
         SecurityUser securityUser = createSecurityUser();
         String sessionId = securityUser.getSessionId();
 
-        String accessToken = tokenFactory.createAccessJwtToken(securityUser).getToken();
+        String accessToken = tokenFactory.createAccessJwtToken(securityUser).token();
         securityUser = tokenFactory.parseAccessJwtToken(accessToken);
         assertThat(securityUser.getSessionId()).isNotNull().isEqualTo(sessionId);
 
@@ -158,7 +158,7 @@ public class JwtTokenFactoryTest {
         securityUser.setId(new UserId(UUID.randomUUID()));
         securityUser.setEmail("tenant@thingsboard.org");
         securityUser.setAuthority(Authority.TENANT_ADMIN);
-        securityUser.setTenantId(new TenantId(UUID.randomUUID()));
+        securityUser.setTenantId(TenantId.fromUUID(UUID.randomUUID()));
         securityUser.setEnabled(true);
         securityUser.setFirstName("A");
         securityUser.setLastName("B");
@@ -179,7 +179,7 @@ public class JwtTokenFactoryTest {
     }
 
     private void checkExpirationTime(JwtToken jwtToken, int tokenLifetime) {
-        Claims claims = tokenFactory.parseTokenClaims(jwtToken.getToken()).getPayload();
+        Claims claims = tokenFactory.parseTokenClaims(jwtToken.token()).getPayload();
         assertThat(claims.getExpiration()).matches(actualExpirationTime -> {
             Calendar expirationTime = Calendar.getInstance();
             expirationTime.setTime(new Date());

application/src/test/java/org/thingsboard/server/service/security/auth/TokenOutdatingTest.java

@@ -30,15 +30,14 @@ import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.UserAuthDetails;
 import org.thingsboard.server.common.data.id.UserId;
 import org.thingsboard.server.common.data.security.Authority;
-import org.thingsboard.server.common.data.security.UserCredentials;
 import org.thingsboard.server.common.data.security.event.UserCredentialsInvalidationEvent;
 import org.thingsboard.server.common.data.security.event.UserSessionInvalidationEvent;
 import org.thingsboard.server.common.data.security.model.JwtToken;
 import org.thingsboard.server.dao.customer.CustomerService;
 import org.thingsboard.server.dao.service.DaoSqlTest;
-import org.thingsboard.server.dao.user.UserService;
 import org.thingsboard.server.service.security.auth.jwt.JwtAuthenticationProvider;
 import org.thingsboard.server.service.security.auth.jwt.RefreshTokenAuthenticationProvider;
 import org.thingsboard.server.service.security.exception.JwtExpiredTokenException;
@@ -46,6 +45,7 @@ import org.thingsboard.server.service.security.model.SecurityUser;
 import org.thingsboard.server.service.security.model.UserPrincipal;
 import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
 import org.thingsboard.server.service.security.model.token.RawAccessJwtToken;
+import org.thingsboard.server.service.user.cache.UserAuthDetailsCache;
 
 import java.util.UUID;
 
@@ -91,20 +91,16 @@ public class TokenOutdatingTest {
         UserId userId = new UserId(UUID.randomUUID());
         securityUser = createMockSecurityUser(userId);
 
-        UserService userService = mock(UserService.class);
+        UserAuthDetailsCache userAuthDetailsCache = mock(UserAuthDetailsCache.class);
 
         User user = new User();
         user.setId(userId);
         user.setAuthority(Authority.TENANT_ADMIN);
         user.setEmail("email");
-        when(userService.findUserById(any(), eq(userId))).thenReturn(user);
+        when(userAuthDetailsCache.getUserAuthDetails(any(), eq(userId))).thenReturn(new UserAuthDetails(user, true));
-
-        UserCredentials userCredentials = new UserCredentials();
-        userCredentials.setEnabled(true);
-        when(userService.findUserCredentialsByUserId(any(), eq(userId))).thenReturn(userCredentials);
 
         accessTokenAuthenticationProvider = new JwtAuthenticationProvider(tokenFactory, tokenOutdatingService);
-        refreshTokenAuthenticationProvider = new RefreshTokenAuthenticationProvider(tokenFactory, userService, mock(CustomerService.class), tokenOutdatingService);
+        refreshTokenAuthenticationProvider = new RefreshTokenAuthenticationProvider(tokenFactory, userAuthDetailsCache, mock(CustomerService.class), tokenOutdatingService);
     }
 
     @Test
@@ -114,12 +110,12 @@ public class TokenOutdatingTest {
         // Token outdatage time is rounded to 1 sec. Need to wait before outdating so that outdatage time is strictly after token issue time
         SECONDS.sleep(1);
         eventPublisher.publishEvent(new UserCredentialsInvalidationEvent(securityUser.getId()));
-        assertTrue(tokenOutdatingService.isOutdated(jwtToken.getToken(), securityUser.getId()));
+        assertTrue(tokenOutdatingService.isOutdated(jwtToken.token(), securityUser.getId()));
 
         SECONDS.sleep(1);
 
         JwtToken newJwtToken = tokenFactory.createAccessJwtToken(securityUser);
-        assertFalse(tokenOutdatingService.isOutdated(newJwtToken.getToken(), securityUser.getId()));
+        assertFalse(tokenOutdatingService.isOutdated(newJwtToken.token(), securityUser.getId()));
     }
 
     @Test
@@ -229,7 +225,7 @@ public class TokenOutdatingTest {
 
 
     private RawAccessJwtToken getRawJwtToken(JwtToken token) {
-        return new RawAccessJwtToken(token.getToken());
+        return new RawAccessJwtToken(token.token());
     }
 
     private SecurityUser createMockSecurityUser(UserId userId) {
@@ -241,4 +237,5 @@ public class TokenOutdatingTest {
         securityUser.setSessionId(UUID.randomUUID().toString());
         return securityUser;
     }
+
 }

application/src/test/java/org/thingsboard/server/service/security/auth/pat/ApiKeyAuthenticationProviderTest.java

@@ -0,0 +1,112 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.pat;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.thingsboard.server.common.data.audit.ActionType;
+import org.thingsboard.server.common.data.edge.Edge;
+import org.thingsboard.server.common.data.pat.ApiKey;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
+import org.thingsboard.server.controller.AbstractControllerTest;
+import org.thingsboard.server.dao.service.DaoSqlTest;
+
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.thingsboard.server.dao.model.ModelConstants.NULL_UUID;
+
+@DaoSqlTest
+public class ApiKeyAuthenticationProviderTest extends AbstractControllerTest {
+
+    ApiKey savedApiKey;
+
+    @Before
+    public void setUp() throws Exception {
+        loginTenantAdmin();
+
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo();
+        savedApiKey = doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+        setApiKey(savedApiKey.getValue());
+    }
+
+    @After
+    public void cleanUp() throws Exception {
+        resetApiKey();
+        doDelete("/api/apiKey/" + savedApiKey.getId()).andExpect(status().isOk());
+    }
+
+    @Test
+    public void testSaveEdgeWithApiKey() throws Exception {
+        Edge edge = constructEdge("My edge", "default");
+
+        Mockito.reset(tbClusterService, auditLogService);
+
+        Edge savedEdge = doPostWithApiKey("/api/edge", edge, Edge.class);
+
+        Assert.assertNotNull(savedEdge);
+        Assert.assertNotNull(savedEdge.getId());
+        Assert.assertTrue(savedEdge.getCreatedTime() > 0);
+        Assert.assertEquals(tenantId, savedEdge.getTenantId());
+        Assert.assertNotNull(savedEdge.getCustomerId());
+        Assert.assertEquals(NULL_UUID, savedEdge.getCustomerId().getId());
+        Assert.assertEquals(edge.getName(), savedEdge.getName());
+
+        testNotifyEdgeStateChangeEventManyTimeMsgToEdgeServiceNever(savedEdge, savedEdge.getId(), savedEdge.getId(),
+                tenantId, tenantAdminUser.getCustomerId(), tenantAdminUser.getId(), tenantAdminUser.getEmail(),
+                ActionType.ADDED, 2);
+
+        savedEdge.setName("My new edge");
+        doPostWithApiKey("/api/edge", savedEdge, Edge.class);
+
+        Edge foundEdge = doGetWithApiKey("/api/edge/" + savedEdge.getId().getId().toString(), Edge.class);
+        Assert.assertEquals(foundEdge.getName(), savedEdge.getName());
+
+        testNotifyEdgeStateChangeEventManyTimeMsgToEdgeServiceNever(foundEdge, foundEdge.getId(), foundEdge.getId(),
+                tenantId, tenantAdminUser.getCustomerId(), tenantAdminUser.getId(), tenantAdminUser.getEmail(),
+                ActionType.UPDATED, 1);
+
+        doDeleteWithApiKey("/api/edge/" + savedEdge.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    public void testUnauthorizedWhenKeyDisabled() throws Exception {
+        ApiKeyInfo disabledApiKeyInfo = doPut("/api/apiKey/" + savedApiKey.getId().getId() + "/enabled/false", Boolean.FALSE, ApiKeyInfo.class);
+        Assert.assertFalse(disabledApiKeyInfo.isEnabled());
+        doGetWithApiKey("/api/admin/featuresInfo").andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    public void testUnauthorizedWhenKeyExpired() throws Exception {
+        ApiKeyInfo apiKeyInfo = constructApiKeyInfo();
+        apiKeyInfo.setExpirationTime(System.currentTimeMillis() - 1000);
+        ApiKey savedApiKeyWithBad = doPost("/api/apiKey", apiKeyInfo, ApiKey.class);
+        setApiKey(savedApiKeyWithBad.getValue());
+        doPost("/api/apiKey", savedApiKey, ApiKeyInfo.class);
+        doGetWithApiKey("/api/admin/featuresInfo").andExpect(status().isUnauthorized());
+    }
+
+    private ApiKeyInfo constructApiKeyInfo() {
+        ApiKeyInfo apiKeyInfo = new ApiKeyInfo();
+        apiKeyInfo.setDescription("New API key description");
+        apiKeyInfo.setEnabled(true);
+        apiKeyInfo.setUserId(tenantAdminUserId);
+        return apiKeyInfo;
+    }
+
+}

application/src/test/java/org/thingsboard/server/service/sync/ie/ExportImportServiceSqlTest.java

@@ -48,10 +48,9 @@ import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
-import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.device.data.DefaultDeviceTransportConfiguration;
 import org.thingsboard.server.common.data.device.data.DeviceData;
 import org.thingsboard.server.common.data.device.profile.DefaultDeviceProfileConfiguration;
@@ -627,9 +626,8 @@ public class ExportImportServiceSqlTest extends AbstractControllerTest {
 
         config.setExpression("T - (100 - H) / 5");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("output");
-        output.setType(OutputType.TIME_SERIES);
 
         config.setOutput(output);
 

application/src/test/java/org/thingsboard/server/service/sync/vc/VersionControlTest.java

@@ -52,10 +52,9 @@ import org.thingsboard.server.common.data.cf.CalculatedFieldType;
 import org.thingsboard.server.common.data.cf.configuration.Argument;
 import org.thingsboard.server.common.data.cf.configuration.ArgumentType;
 import org.thingsboard.server.common.data.cf.configuration.CalculatedFieldConfiguration;
-import org.thingsboard.server.common.data.cf.configuration.Output;
-import org.thingsboard.server.common.data.cf.configuration.OutputType;
 import org.thingsboard.server.common.data.cf.configuration.ReferencedEntityKey;
 import org.thingsboard.server.common.data.cf.configuration.SimpleCalculatedFieldConfiguration;
+import org.thingsboard.server.common.data.cf.configuration.TimeSeriesOutput;
 import org.thingsboard.server.common.data.debug.DebugSettings;
 import org.thingsboard.server.common.data.device.data.DefaultDeviceTransportConfiguration;
 import org.thingsboard.server.common.data.device.data.DeviceData;
@@ -1147,9 +1146,8 @@ public class VersionControlTest extends AbstractControllerTest {
 
         config.setExpression("T - (100 - H) / 5");
 
-        Output output = new Output();
+        TimeSeriesOutput output = new TimeSeriesOutput();
         output.setName("output");
-        output.setType(OutputType.TIME_SERIES);
 
         config.setOutput(output);
 

common/dao-api/src/main/java/org/thingsboard/server/dao/pat/ApiKeyService.java

@@ -0,0 +1,41 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.dao.pat;
+
+import org.thingsboard.server.common.data.id.ApiKeyId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.page.PageData;
+import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.data.pat.ApiKey;
+import org.thingsboard.server.common.data.pat.ApiKeyInfo;
+import org.thingsboard.server.dao.entity.EntityDaoService;
+
+public interface ApiKeyService extends EntityDaoService {
+
+    ApiKey saveApiKey(TenantId tenantId, ApiKeyInfo apiKey);
+
+    void deleteApiKey(TenantId tenantId, ApiKey apiKey, boolean force);
+
+    void deleteByUserId(TenantId tenantId, UserId userId);
+
+    ApiKey findApiKeyByValue(String value);
+
+    ApiKey findApiKeyById(TenantId tenantId, ApiKeyId apiKeyId);
+
+    PageData<ApiKeyInfo> findApiKeysByUserId(TenantId tenantId, UserId userId, PageLink pageLink);
+
+}

common/dao-api/src/main/java/org/thingsboard/server/dao/user/UserService.java

@@ -17,6 +17,7 @@ package org.thingsboard.server.dao.user;
 
 import com.google.common.util.concurrent.ListenableFuture;
 import org.thingsboard.server.common.data.User;
+import org.thingsboard.server.common.data.UserAuthDetails;
 import org.thingsboard.server.common.data.id.CustomerId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.TenantProfileId;
@@ -116,4 +117,7 @@ public interface UserService extends EntityDaoService {
     PageData<User> findUsersByFilter(TenantId tenantId, UsersFilter filter, PageLink pageLink);
 
     boolean matchesFilter(TenantId tenantId, SystemLevelUsersFilter filter, User user);
+
+    UserAuthDetails findUserAuthDetailsByUserId(TenantId tenantId, UserId userId);
+
 }

common/data/src/main/java/org/thingsboard/server/common/data/CacheConstants.java

@@ -40,6 +40,7 @@ public final class CacheConstants {
     public static final String SENT_NOTIFICATIONS_CACHE = "sentNotifications";
     public static final String TRENDZ_SETTINGS_CACHE = "trendzSettings";
     public static final String AI_MODEL_CACHE = "aiModel";
+    public static final String API_KEYS_CACHE = "apiKeys";
 
     public static final String ASSET_PROFILE_CACHE = "assetProfiles";
     public static final String ATTRIBUTES_CACHE = "attributes";

common/data/src/main/java/org/thingsboard/server/common/data/EntityType.java

@@ -17,6 +17,7 @@ package org.thingsboard.server.common.data;
 
 import lombok.Getter;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 
 import java.util.Arrays;
 import java.util.EnumSet;
@@ -70,14 +71,15 @@ public enum EntityType {
         public String getNormalName() {
             return "AI model";
         }
-    };
+    },
+    API_KEY(44);
 
     @Getter
     private final int protoNumber; // Corresponds to EntityTypeProto
     @Getter
     private final String tableName;
     @Getter
-    private final String normalName = StringUtils.capitalize(StringUtils.removeStart(name(), "TB_")
+    private final String normalName = StringUtils.capitalize(Strings.CS.removeStart(name(), "TB_")
             .toLowerCase().replaceAll("_", " "));
 
     public static final List<String> NORMAL_NAMES = EnumSet.allOf(EntityType.class).stream()

common/data/src/main/java/org/thingsboard/server/common/data/StringUtils.java

@@ -17,12 +17,14 @@ package org.thingsboard.server.common.data;
 
 import com.google.common.base.Splitter;
 import org.apache.commons.lang3.RandomStringUtils;
+import org.apache.commons.lang3.Strings;
 
 import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.List;
+import java.util.Objects;
 import java.util.function.Function;
 
 import static org.apache.commons.lang3.StringUtils.repeat;
@@ -131,7 +133,7 @@ public class StringUtils {
     }
 
     public static boolean endsWith(String str, String suffix) {
-        return org.apache.commons.lang3.StringUtils.endsWith(str, suffix);
+        return Strings.CS.endsWith(str, suffix);
     }
 
     public static boolean hasLength(String str) {
@@ -147,7 +149,7 @@ public class StringUtils {
     }
 
     public static String defaultString(String s, String defaultValue) {
-        return org.apache.commons.lang3.StringUtils.defaultString(s, defaultValue);
+        return Objects.toString(s, defaultValue);
     }
 
     public static boolean isNumeric(String str) {
@@ -155,7 +157,7 @@ public class StringUtils {
     }
 
     public static boolean equals(String str1, String str2) {
-        return org.apache.commons.lang3.StringUtils.equals(str1, str2);
+        return Strings.CS.equals(str1, str2);
     }
 
     public static boolean equalsAny(String string, String... otherStrings) {
@@ -199,7 +201,7 @@ public class StringUtils {
     }
 
     public static boolean contains(final CharSequence seq, final CharSequence searchSeq) {
-        return org.apache.commons.lang3.StringUtils.contains(seq, searchSeq);
+        return Strings.CS.contains(seq, searchSeq);
     }
 
     /**
@@ -210,23 +212,23 @@ public class StringUtils {
     }
 
     public static String randomNumeric(int length) {
-        return RandomStringUtils.randomNumeric(length);
+        return RandomStringUtils.secure().nextNumeric(length);
     }
 
     public static String random(int length) {
-        return RandomStringUtils.random(length);
+        return RandomStringUtils.secure().next(length);
     }
 
     public static String random(int length, String chars) {
-        return RandomStringUtils.random(length, chars);
+        return RandomStringUtils.secure().next(length, chars);
     }
 
     public static String randomAlphanumeric(int count) {
-        return RandomStringUtils.randomAlphanumeric(count);
+        return RandomStringUtils.secure().nextAlphanumeric(count);
     }
 
     public static String randomAlphabetic(int count) {
-        return RandomStringUtils.randomAlphabetic(count);
+        return RandomStringUtils.secure().nextAlphabetic(count);
     }
 
     public static String generateSafeToken(int length) {

common/data/src/main/java/org/thingsboard/server/common/data/UserAuthDetails.java

@@ -0,0 +1,18 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data;
+
+public record UserAuthDetails(User user, boolean credentialsEnabled) {}

common/data/src/main/java/org/thingsboard/server/common/data/alarm/AlarmCommentSubType.java

@@ -0,0 +1,36 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.alarm;
+
+import lombok.Getter;
+
+public enum AlarmCommentSubType {
+
+    ACKED_BY_USER("Alarm was acknowledged by user %s"),
+    CLEARED_BY_USER("Alarm was cleared by user %s"),
+    ASSIGNED_TO_USER("Alarm was assigned by user %s to user %s"),
+    UNASSIGNED_BY_USER("Alarm was unassigned by user %s"),
+    UNASSIGNED_FROM_DELETED_USER("Alarm was unassigned because user %s - was deleted"),
+    COMMENT_DELETED("User %s deleted his comment"),
+    SEVERITY_CHANGED("Alarm severity was updated from %s to %s");
+
+    @Getter
+    private final String text;
+
+    AlarmCommentSubType(String text) {
+        this.text = text;
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/AttributesImmediateOutputStrategy.java

@@ -0,0 +1,37 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@AllArgsConstructor
+@NoArgsConstructor
+public class AttributesImmediateOutputStrategy implements AttributesOutputStrategy {
+
+    private boolean updateAttributesOnlyOnValueChange;
+
+    private boolean saveAttribute;
+    private boolean sendWsUpdate;
+    private boolean processCfs;
+
+    @Override
+    public OutputStrategyType getType() {
+        return OutputStrategyType.IMMEDIATE;
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/AttributesOutput.java

@@ -0,0 +1,38 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import lombok.Data;
+import org.thingsboard.server.common.data.AttributeScope;
+
+@Data
+public class AttributesOutput implements Output {
+
+    private String name;
+    private AttributeScope scope;
+    private Integer decimalsByDefault;
+
+    private AttributesOutputStrategy strategy;
+
+    public AttributesOutput() {
+        this.strategy = new AttributesRuleChainOutputStrategy();
+    }
+
+    @Override
+    public OutputType getType() {
+        return OutputType.ATTRIBUTES;
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/AttributesOutputStrategy.java

@@ -0,0 +1,33 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonTypeInfo(
+        use = JsonTypeInfo.Id.NAME,
+        include = JsonTypeInfo.As.PROPERTY,
+        property = "type"
+)
+@JsonSubTypes({
+        @JsonSubTypes.Type(value = AttributesImmediateOutputStrategy.class, name = "IMMEDIATE"),
+        @JsonSubTypes.Type(value = AttributesRuleChainOutputStrategy.class, name = "RULE_CHAIN"),
+})
+public interface AttributesOutputStrategy extends OutputStrategy {
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/AttributesRuleChainOutputStrategy.java

@@ -0,0 +1,29 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class AttributesRuleChainOutputStrategy implements AttributesOutputStrategy {
+
+    @Override
+    public OutputStrategyType getType() {
+        return OutputStrategyType.RULE_CHAIN;
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/Output.java

@@ -15,17 +15,39 @@
  */
 package org.thingsboard.server.common.data.cf.configuration;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
-import lombok.Data;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import org.thingsboard.server.common.data.AttributeScope;
 
-@Data
+@JsonTypeInfo(
+        use = JsonTypeInfo.Id.NAME,
+        include = JsonTypeInfo.As.PROPERTY,
+        property = "type"
+)
+@JsonSubTypes({
+        @JsonSubTypes.Type(value = TimeSeriesOutput.class, name = "TIME_SERIES"),
+        @JsonSubTypes.Type(value = AttributesOutput.class, name = "ATTRIBUTES")
+})
 @JsonInclude(JsonInclude.Include.NON_NULL)
-public class Output {
+@JsonIgnoreProperties(ignoreUnknown = true)
+public interface Output {
 
-    private String name;
+    @JsonIgnore
-    private OutputType type;
+    OutputType getType();
-    private AttributeScope scope;
+
-    private Integer decimalsByDefault;
+    String getName();
+
+    OutputStrategy getStrategy();
+
+    default AttributeScope getScope() {
+        return null;
+    }
+
+    Integer getDecimalsByDefault();
+
+    void setDecimalsByDefault(Integer decimalsByDefault);
 
 }

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/OutputStrategy.java

@@ -0,0 +1,25 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
+public interface OutputStrategy {
+
+    @JsonIgnore
+    OutputStrategyType getType();
+
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/OutputStrategyType.java

@@ -0,0 +1,22 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+public enum OutputStrategyType {
+
+    IMMEDIATE, RULE_CHAIN
+
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/TimeSeriesImmediateOutputStrategy.java

@@ -0,0 +1,38 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@AllArgsConstructor
+@NoArgsConstructor
+public class TimeSeriesImmediateOutputStrategy implements TimeSeriesOutputStrategy {
+
+    private long ttl;
+
+    private boolean saveTimeSeries;
+    private boolean saveLatest;
+    private boolean sendWsUpdate;
+    private boolean processCfs;
+
+    @Override
+    public OutputStrategyType getType() {
+        return OutputStrategyType.IMMEDIATE;
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/TimeSeriesOutput.java

@@ -0,0 +1,37 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import lombok.Data;
+
+@Data
+public class TimeSeriesOutput implements Output {
+
+    private String name;
+    private Integer decimalsByDefault;
+
+    private TimeSeriesOutputStrategy strategy;
+
+    public TimeSeriesOutput() {
+        this.strategy = new TimeSeriesRuleChainOutputStrategy();
+    }
+
+    @Override
+    public OutputType getType() {
+        return OutputType.TIME_SERIES;
+    }
+
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/TimeSeriesOutputStrategy.java

@@ -0,0 +1,31 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+
+@JsonTypeInfo(
+        use = JsonTypeInfo.Id.NAME,
+        include = JsonTypeInfo.As.PROPERTY,
+        property = "type"
+)
+@JsonSubTypes({
+        @JsonSubTypes.Type(value = TimeSeriesImmediateOutputStrategy.class, name = "IMMEDIATE"),
+        @JsonSubTypes.Type(value = TimeSeriesRuleChainOutputStrategy.class, name = "RULE_CHAIN")
+})
+public interface TimeSeriesOutputStrategy extends OutputStrategy {
+}

common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/TimeSeriesRuleChainOutputStrategy.java

@@ -0,0 +1,29 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.cf.configuration;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class TimeSeriesRuleChainOutputStrategy implements TimeSeriesOutputStrategy {
+
+    @Override
+    public OutputStrategyType getType() {
+        return OutputStrategyType.RULE_CHAIN;
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/id/ApiKeyId.java

@@ -0,0 +1,46 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.id;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import org.thingsboard.server.common.data.EntityType;
+
+import java.io.Serial;
+import java.util.UUID;
+
+public class ApiKeyId extends UUIDBased implements EntityId {
+
+    @Serial
+    private static final long serialVersionUID = -273913539653684641L;
+
+    @JsonCreator
+    public ApiKeyId(@JsonProperty("id") UUID id) {
+        super(id);
+    }
+
+    public static ApiKeyId fromString(String secretId) {
+        return new ApiKeyId(UUID.fromString(secretId));
+    }
+
+    @Override
+    @Schema(requiredMode = Schema.RequiredMode.REQUIRED, description = "string", example = "API_KEY", allowableValues = "API_KEY")
+    public EntityType getEntityType() {
+        return EntityType.API_KEY;
+    }
+
+}

common/data/src/main/java/org/thingsboard/server/common/data/id/EntityIdFactory.java

@@ -83,6 +83,7 @@ public class EntityIdFactory {
             case JOB -> new JobId(uuid);
             case ADMIN_SETTINGS -> new AdminSettingsId(uuid);
             case AI_MODEL -> new AiModelId(uuid);
+            case API_KEY -> new ApiKeyId(uuid);
         };
     }
 

common/data/src/main/java/org/thingsboard/server/common/data/pat/ApiKey.java

@@ -0,0 +1,61 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.pat;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+import org.thingsboard.server.common.data.id.ApiKeyId;
+import org.thingsboard.server.common.data.validation.NoXss;
+
+import java.io.Serial;
+
+@Schema
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class ApiKey extends ApiKeyInfo {
+
+    @Serial
+    private static final long serialVersionUID = -2313196723950490263L;
+
+    @NoXss
+    @Schema(description = "Api key value", requiredMode = Schema.RequiredMode.REQUIRED)
+    private String value;
+
+    public ApiKey() {
+        super();
+    }
+
+    public ApiKey(ApiKeyId id) {
+        super(id);
+    }
+
+    public ApiKey(ApiKey apiKey) {
+        super(apiKey);
+        this.value = apiKey.getValue();
+    }
+
+    public ApiKey(ApiKeyInfo apiKeyInfo) {
+        super(apiKeyInfo);
+        this.value = null;
+    }
+
+    public ApiKey(ApiKeyInfo apiKeyInfo, String value) {
+        super(apiKeyInfo);
+        this.value = value;
+    }
+
+}

common/data/src/main/java/org/thingsboard/server/common/data/pat/ApiKeyInfo.java

@@ -0,0 +1,96 @@
+/**
+ * Copyright © 2016-2025 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.common.data.pat;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+import org.thingsboard.server.common.data.BaseData;
+import org.thingsboard.server.common.data.HasTenantId;
+import org.thingsboard.server.common.data.id.ApiKeyId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.id.UserId;
+import org.thingsboard.server.common.data.validation.Length;
+import org.thingsboard.server.common.data.validation.NoXss;
+
+import java.io.Serial;
+
+@Schema
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class ApiKeyInfo extends BaseData<ApiKeyId> implements HasTenantId {
+
+    @Serial
+    private static final long serialVersionUID = -2313196723950490263L;
+
+    @Schema(description = "JSON object with Tenant Id. Tenant Id of the api key cannot be changed.", accessMode = Schema.AccessMode.READ_ONLY)
+    private TenantId tenantId;
+
+    @Schema(description = "JSON object with User Id. User Id of the api key cannot be changed.")
+    private UserId userId;
+
+    @Schema(description = "Expiration time of the api key.")
+    private long expirationTime;
+
+    @NoXss
+    @NotBlank
+    @Length(fieldName = "description")
+    @Schema(description = "Api Key description.", example = "Api Key description")
+    private String description;
+
+    @Schema(description = "Enabled/disabled api key.", example = "true")
+    private boolean enabled;
+
+    @JsonProperty(access = JsonProperty.Access.READ_ONLY)
+    @Schema(description = "Indicates if the api key is expired based on current time. Returns false if expirationTime is 0 (no expiry).",
+            example = "false",
+            accessMode = Schema.AccessMode.READ_ONLY)
+    public boolean isExpired() {
+        if (expirationTime == 0) {
+            return false;
+        }
+        return System.currentTimeMillis() > expirationTime;
+    }
+
+    @Schema(description = "JSON object with the Api Key Id. " +
+            "Specify this field to update the Api Key. " +
+            "Referencing non-existing Api Key Id will cause error. " +
+            "Omit this field to create new Api Key.")
+    @Override
+    public ApiKeyId getId() {
+        return super.getId();
+    }
+
+    public ApiKeyInfo() {
+        super();
+    }
+
+    public ApiKeyInfo(ApiKeyId id) {
+        super(id);
+    }
+
+    public ApiKeyInfo(ApiKeyInfo apiKeyInfo) {
+        super(apiKeyInfo);
+        this.tenantId = apiKeyInfo.getTenantId();
+        this.userId = apiKeyInfo.getUserId();
+        this.expirationTime = apiKeyInfo.getExpirationTime();
+        this.enabled = apiKeyInfo.isEnabled();
+        this.description = apiKeyInfo.getDescription();
+    }
+
+}