> ## Documentation Index
> Fetch the complete documentation index at: https://usenaive.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Devices

> A Tower is a first-class device — claim it once, and it manages companies and projects, wakes agents, and can be reached from anywhere over an opt-in public link.

A **device** is a Naïve Tower: a box that runs the region on hardware you own. A
device is a first-class entity in the control plane — it is claimed by an owner,
bound to a company, and can host the runtime for **multiple companies and
projects** managed from the same box.

<Info>
  Everything here is self-hosted (Tower). In the cloud these routes are inert — the
  cloud runs the same region without a physical device.
</Info>

## Lifecycle

1. **Announce** — on first boot the box announces its claim code, public key, and
   device-token hash ([`POST /v1/devices/announce`](/docs/api-reference/devices/announce)).
2. **Claim** — the owner signs in / registers and binds the box to their company,
   completing KYC + kit selection ([`POST /v1/devices/claim/{code}`](/docs/api-reference/devices/claim)).
   The **registration lock** means a box is claimed once.
3. **Attest & provision** — the box records a TPM quote
   ([attest](/docs/api-reference/devices/self-attest)) and provisions its operator +
   runtime tokens ([provision](/docs/api-reference/devices/self-provision)).
4. **Run** — the box holds one outbound relay
   ([`GET /v1/devices/self/events`](/docs/api-reference/devices/self-events)) to
   receive wakes and manage its companies/projects.

See [claim & provisioning](/docs/self-hosting/claim-and-provisioning) for the deep
dive on what runs on the box.

## Waking box-resident agents

Inbound events (email, SMS, a hook POST, a Loop tick) are routed by the [trigger
router](/docs/architecture/event-router). When the bound agent lives on a box, the
event is relayed over the box's outbound SSE as a `trigger.wake`; the box runs
the agent locally and acks the delivery
([`/v1/devices/self/deliveries/{id}/ack`](/docs/api-reference/devices/self-deliveries-ack)).
Sensitive payloads are sealed to the device's encryption key before they leave
the cloud.

## Reaching a box from anywhere

By default a box opens **no inbound ports** — it only reaches out. Turn on the
opt-in **public link** and a `{slug}.tower.usenaive.ai` URL reaches the box
panel/API over the box's outbound tunnel via the Naïve edge relay. See
[the public link](/docs/self-hosting/public-link) and the
[tunnel API](/docs/api-reference/devices/tunnel).

## Revoking a device

Revoking a device is the kill switch: it flips the device to `revoked`, deletes
its runtime tokens (the egress gateway stops resolving them), and disables its
public link.

```bash theme={"theme":"css-variables"}
curl -X POST https://api.usenaive.ai/v1/devices/{id}/revoke \
  -H "Authorization: Bearer nv_sk_live_..."
```

See [Revoke](/docs/api-reference/devices/revoke) and the
[security model](/docs/self-hosting/security-model).