Just to follow up on this:
1) That your back-end application will be making this call, which will have access to the owner CIK (Portal CIK in this case) and the Vendor Token.
2) All devices are used in one portal in the portals subdomain, and a different user app is in place which takes care of users and how they add and interact with device data.
To query to get a CIK for a device, there are two approaches.
1) Use the Portal CIK (owner CIK) that you put all devices into and call the list RPC and then call info on each to get each individual one's CIK (the key option using the info command). This will allow you to find the CIK you are looking for but you will need to make sure the Unique identifiers are put into meta info for the device client and/or make the alias of the client the unique identifier. Making the alias the unique identifier will make for quicker look-up, since you could skip the listing call and just call the info command using the alias.
2) The Vendor Fleet Management API calls for the provision system provide another approach that may be more of what you are looking for.
In this case, you will need to use the Vendor Token for the vendor provision calls
The first would be to make a call to get the client rid for your device using your model and serial number (unique id). You must use your vendor token for authorization to make this call.
Once you have the RID, you then call the info RPC detailed above, it will need the Portal CIK (owner CIK) to make that call or a higher level owner CIK.
If you need an entire list of serial numbers and their RIDs, you can use this call.