# MQTT ingest (third party gateways)

Prime RMS Core embeds an MQTT broker. Any gateway or IoT device that speaks MQTT can send data
without the Prime Gate Agent.

| Transport | Endpoint | Notes |
|---|---|---|
| MQTT over WebSocket (TLS) | `wss://rms.primerp.ai/mqtt` | works everywhere, rides on 443 |
| MQTT over TLS | `mqtts://rms.primerp.ai:8883` | LAN / VPN now, public after the firewall forward |
| MQTT plain | `mqtt://<core-host>:1883` | docker network and app-01 loopback only |

**Authentication:** username = any label (the gateway name is a good choice), password = the gateway
token from enrollment (`POST /api/v1/gateways/enroll` with a code from the console).

**Topics (fixed, per connection):**

- publish `prime/v1/telemetry` with `{"samples":[{"key":"grid.v_l1","value":231.2,"ts":1790500000,"quality":192}]}`
  (`ts` in seconds or milliseconds, optional; unknown keys are auto registered as points)
- publish `prime/v1/events` with `{"events":[{"type":"alarm","key":"env.smoke","severity":"critical","message":"Smoke detected"}]}`
- publish `prime/v1/heartbeat` with `{"agentVersion":"vendor-x 1.0","uplinkOk":true}`
- subscribe `prime/v1/commands` to receive `{"commands":[{"id","key","action","params"}]}`; answer on
  `prime/v1/commands/result` with `{"id":"...","ok":true,"result":{"readback":1}}`

A gateway can only publish on its own connection and only ever receives its own commands. Sparkplug B
payloads are on the roadmap; JSON as above is the supported format today.