designing an api for iot device management

im working on a system to manage a fleet of IoT devices, think sensors, smart meters, etc. we need an API to provision new devices, update their firmware, monitor their status, and collect data. given the scale, potentially millions of devices, and the need for reliable communication, im leaning towards a RESTful API, but the intermittent connectivity of some devices is making me think about alternatives or additions like WebSockets or even MQTT for certain operations. what are your thoughts on the best API patterns for this kind of scenario. how do you handle device authentication and authorization at scale.