Each device is addressed by its PSN — its product serial number. A client can talk to the official cloud or point the device at your own broker; with TLS on, device and broker authenticate each other with certificates.
Every topic starts with device/<psn>/ and falls into two families: end-user commands and telemetry pushes. A request goes to request; the device publishes its reply to the matching response, correlated by a shared id.