LMv1 fails with Set-LMDeviceGroup but Bearer works for same user

[aggie87]

LMv1 fails on Set-LMDeviceGroup; Bearer works (same user)

Symptom

• Connect-LMAccount with LMv1 (Access ID/Key)
• Get-LMDeviceGroup → OK
• Set-LMDeviceGroup (PATCH, ?opType=replace) → Authentication failed
• Same user + roles with Bearer → Set-LMDeviceGroup OK

Reproduce Issue

# LMv1 session
Get-LMDeviceGroup -Filter 'fullPath -eq "Locations/Example/Group"'   # works

Set-LMDeviceGroup -Id '<id>' -NewName '<name>' -ParentGroupId <parentId> `
  -Properties @{ prop1 = 'value1'; prop2 = 'value2' } -Confirm:$false
# → Authentication failed

# Same account via Bearer → same Set-LMDeviceGroup succeeds

Likely area

Private/New-LMHeader.ps1 — LMv1 signs PATCH + epoch + body + path; GET has no body. Bearer skips signing. Suspect signature/body mismatch on device-group PATCH.

[stevevillardi]

I am trying to reproduce your issue but both LMv1 and BearerToken seem to work for me just fine? Are you positive that LMv1 is attached to the same user/role?

[INFO]: Connected to LM portal using account (xxx@logicmonitor.com via LMv1 Token) with assigned roles: readonly,lm-admin - (110 devices | 8 websites).

PS /Users> Set-LMDeviceGroup -id 15443 -NewName Applications -ParentGroupId 15440 -Properties @{test="value1"} -Debug

DEBUG: ============ LogicMonitor API Debug Info ==============
DEBUG: Command: Set-LMDeviceGroup | Method: PATCH | Timestamp: 2026-07-17 11:36:41.999
DEBUG: Parameters: Id: 15443 | NewName: Applications | ParentGroupId: 15440 | Properties: {test} | Debug: True
DEBUG: Endpoint: /santaba/rest/device/groups/15443?opType=replace
DEBUG: Portal: lmstevenvillardi.logicmonitor.com
DEBUG: Headers: X-Version: 3 | Content-Type: application/json | Authorization: LMv1 xxxxxxxx... | User-Agent: Logic.Monitor-PowerShell-Module
DEBUG: Request Payload:
DEBUG:     {
DEBUG:       "name": "Applications",
DEBUG:       "customProperties": [
DEBUG:         {
DEBUG:           "name": "test",
DEBUG:           "value": "value1"
DEBUG:         }
DEBUG:       ],
DEBUG:       "parentId": 15440
DEBUG:     }
DEBUG: ========================================================

id    name         description disableAlerting fullPath                 appliesTo
--    ----         ----------- --------------- --------                 ---------
15443 Applications             False           Development/Applications

==============================================================

[INFO]: Connected to LM portal using account (xxx@logicmonitor.com via Bearer Token) with assigned roles: readonly,lm-admin - (110 devices | 8 websites).

PS /Users> Set-LMDeviceGroup -id 15443 -NewName Applications -ParentGroupId 15440 -Properties @{test="value1"} -Debug

DEBUG: ============ LogicMonitor API Debug Info ==============
DEBUG: Command: Set-LMDeviceGroup | Method: PATCH | Timestamp: 2026-07-17 11:36:57.424
DEBUG: Parameters: Id: 15443 | NewName: Applications | ParentGroupId: 15440 | Properties: {test} | Debug: True
DEBUG: Endpoint: /santaba/rest/device/groups/15443?opType=replace
DEBUG: Portal: lmstevenvillardi.logicmonitor.com
DEBUG: Headers: X-Version: 3 | Content-Type: application/json | Authorization: Bearer lmb_xxxxxx... | User-Agent: Logic.Monitor-PowerShell-Module
DEBUG: Request Payload:
DEBUG:     {
DEBUG:       "name": "Applications",
DEBUG:       "customProperties": [
DEBUG:         {
DEBUG:           "name": "test",
DEBUG:           "value": "value1"
DEBUG:         }
DEBUG:       ],
DEBUG:       "parentId": 15440
DEBUG:     }
DEBUG: ========================================================

id    name         description disableAlerting fullPath                 appliesTo
--    ----         ----------- --------------- --------                 ---------
15443 Applications             False           Development/Applications

[aggie87]

When i use Connect-LMAccount -CachedAccountName xxxx, where xxxx is the LMv1 Token and Bearer Token account names, I was referencing this info to determine both the account and the token being used, is that correct? Below is the obfuscated results from getting the 2 different accounts which is why i am thinking permissions aren't the issue.

[INFO]: Connected to LM portal xxx using account (accountNameHere via LMv1 Token) with assigned roles: RoleNameHere - (xxx devices | xxx websites).
[INFO]: Connected to LM portal xxx using account (accountNameHere via Bearer Token) with assigned roles: RoleNameHere - (xxx devices | xxx websites).

[aggie87]

looks like the -NewName and the value of a couple of -Properties contained an en-dash in the strings. AI says this may be the issue for what it's worth...LOL

++++++++++++++++++++

That points at an LMv1 signature mismatch, not LogicMonitor rejecting en-dashes.

En-dash (–, U+2013) is multi-byte UTF-8; a normal hyphen (-) is ASCII. LMv1 signs PATCH + epoch + body + path. If the bytes used for the HMAC aren’t exactly the bytes sent (PowerShell ConvertTo-Json escaping vs what Invoke-RestMethod puts on the wire, encoding, etc.), the portal returns Authentication failed. Bearer never signs the body, so the same en-dash works.

So: not RBAC, and not “LM forbids en-dash.” It’s almost certainly body encoding / signing in the Logic.Monitor client path