Device groups
A rollout targets a group, not a single device. A group is a named set of devices in your fleet; you create the group once and then aim updates at it, which keeps the targeting decision separate from - and reviewable before - the act of rolling out.
Static groups
A static group is an explicit set of devices you name when you create it. You give the group a name and a list of device names; the platform resolves those names to the devices in your fleet and records the membership.
Resolution is deliberate and visible:
- Names that don't match a device in your fleet are reported back as unknown rather than silently dropped, so a typo never quietly shrinks your target set.
- Decommissioned devices are not eligible. A retired device can never be added as a member, and an existing member that is later decommissioned drops out of the rollout-eligible count - including one would leave a wave waiting forever on a box that will never heartbeat again.
- A group's reported member count reflects its live, rollout-eligible devices - the same set a rollout to that group would actually touch.
group "edge-cameras-eu"
├─ cam-berlin-01
├─ cam-berlin-02
└─ cam-munich-07
Because membership is explicit, a static group is exactly auditable: the set that will receive an update is the set you can see, and group creation is recorded as an audit event like every other state change.
Adding devices to an existing group
On Devices, select one or more rollout-eligible devices, choose the existing group, then select Add to group. This operation is additive: the selected devices join the group and its existing members remain unchanged. Adding a device that is already a member is safe and does not create a duplicate.
Automation can use the same explicit operation:
POST /api/v1/groups/{group-id}/members
Content-Type: application/json
{"devices":["edge-04","edge-05"]}
Unknown and decommissioned device names are returned in unknown_devices instead
of being silently ignored. Every membership addition is written to the tenant
audit trail.
Changing membership also changes the group's target-policy digest. A signed release authorized for the previous membership must be published again against the new digest before it can start. A rollout that has already started keeps its original static device snapshot.
Choosing a target
Once a group exists, a rollout points at it and the platform partitions its members into waves (in stable name order). The first wave receives its assignments on the next heartbeat; later waves proceed as gates clear. Group membership is resolved against current devices at rollout time, so decommissioned devices are excluded even if they were named when the group was first built.
Selecting members by capability
Group membership is the explicit list you provide. Use the hardware facts and tags shown on the Devices page to select the matching members, then review the resolved list before authorizing a release. See Capability selectors for the facts available to operators.