As @pranasziaukas suggested using tags.
Which I could use because my devices already set and get their tags to report back statistics of how they are doing at their purpose.
Would it be better for this allow list of several hundred characters to be a tag?
It makes it slightly more difficult on my end because I have to handle getting the tag and failing to get the tag via the api. As my devices have to support full functionality in offline mode, I then also have to handle caching a allow list to the local file system, and deciding when to invalidate that cache.
However, unless I am misunderstanding things the benefit of putting this allow list in a tag is that the state poll from the supervisor won’t pull the list every 15 minutes and the only way the device will only pull the list when it requests the tag from the api.
Are their any other benefits? Because for my current list length of a couple hundred characters, I am still planning on doing this the easy way with an application variable that will always be present if set.