PalGate Cloud

Not affiliated with PalGate

OpenApp is an independent product and is not associated with, endorsed by, sponsored by, or affiliated with PalGate or PAL Electronics Systems in any way. "PalGate" and "PAL Electronics Systems" are trademarks of their respective owners and are used here only to describe interoperability.

For any issues with this integration, contact OpenApp — not PalGate. PalGate cannot support problems caused by OpenApp, and contacting them about this integration may delay a resolution.

Not for electrically locking a means of egress.OpenApp is ingress-only software. Occupants must be able to exit without this integration, the cloud, or a phone. SeeLife safety and egress.

At a glance

• Product: PalGate
• Manufacturer: PAL Electronics Systems
• Similar open-source integrations:
  • Home Assistant has many gate/relay integrations; use the one that matches your hardware and/or protocol.

Coordination warning

Linking a PalGate account into an OpenApp organization delegates gate control to org operators. Coordinate with the gate owner and your organization’s policies before linking a personal phone. OpenApp probes whether the linked account is a gate administrator per device and surfaces warnings in the dashboard. See PalGate permissions and Linked Device for the full policy matrix.

Getting started

Dashboard (recommended)

1. In Integrations, create a new integration and choose provider type PalGate Cloud.
2. Enable Linked Device in the PalGate app for your phone on the target gate (gate administrator). Without this, QR linking fails with Secondary device not authorized. See Linked Device.
3. Follow the setup wizard: enter the PalGate device id (and optional name), then scan the QR code with the PalGate app under Linked devices → Link a device. The dashboard polls the server until linking completes and fills session token, phone number, and token type automatically. The wizard probes admin status on that device; non-admin accounts may require legal acknowledgment depending on org policy.
4. If you cannot use QR linking, use Enter credentials manually in the wizard to paste values (same fields as below).
5. For each gate you want in OpenApp, create a device on that integration. Set PalGate gate ID (stored as external_id) to the PalGate device id string the API expects (for example DEVICE or DEVICE:2 for a second output). Device metadata stores linked-account role probes and optional legal acknowledgment. From the wizard review step you can open Devices with device id/name prefilled via query params.
6. Trigger an OpenApp “open” action and confirm the gate opens.

Manual / API-only

1. Create an integration with provider type palgate_cloud and set the config and secrets fields in the table below (or via POST /integrations with config + secrets).
2. Continue from step 4 above.

Integration-setup API (device linking)

For custom clients or automation, the same linking flow the wizard uses is available over HTTP (same auth as integrations; X-Org must match the org):

• POST /api/v1/integration-setup/v1/sessions — body: { "flow": "palgate_cloud_device_link", "org_id": "<uuid>", "options": { "base_url": "..." } } (optional base_url). Returns session_id and a step payload with palgate_cloud_device_link.qr_payload (and linking metadata).
• POST /api/v1/integration-setup/v1/sessions/{session_id}/poll — call repeatedly (e.g. every 1–2s). Responses: awaiting_scan, succeeded (includes config + secrets for the integration), or failed. Sessions expire after a short TTL (~15 minutes).

Use the returned config and secrets on POST /integrations to create the integration.

Setup reference

Field	Type	Required	Description	Default	Example
base_url	string	optional	Base URL for the PalGate API.	https://api1.pal-es.com	https://api1.pal-es.com
session_token_hexSecrets Manager	string	required	Session token (hex) used to authenticate to PalGate Cloud.	—	0a1b2c3d4e5f...
phone_number	number	required	Phone number associated with the PalGate account.	—	15551234567
token_type	string	required	Token type string: sms, primary, or secondary.	—	primary

Policies

Policies restrict access on top of roles — they never grant it. Browse the policy catalog for arguments and examples. Expand a category below to see the policies that apply to this integration, then expand a policy for details.

Because this provider exposes a verifiable hardware admin, a verified admin can also become the device steward and set the Device tier, which binds every org and integration pointing at the same physical device. See Regaining control of shared devices.

Invitations

Guest invites — duration, uses, who may create them, and which doors they can cover.

19 policies

Invitation curfew

Blocks invitation-based opens during a forbidden time window (for example nights).

Admins and residents are never curfewed; existing invitations are evaluated live, not modified.

Learn more — Invitation curfew

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no hour restrictions on invitation-based access.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max invitation duration

Caps how long each invitation schedule slot may last.

Longer create or update requests are rejected, not shortened.

Learn more — Max invitation duration

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no policy cap on invitation slot length.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max share duration

Caps how long a short-term share (TTL invitation) may last.

Combined with max invitation duration as the stricter of the two. Longer create requests are rejected, not shortened.

Learn more — Max share duration

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

System default is 86400 (1 day) when unset. Org policy may raise the share cap up to 31536000 (365d).

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Default share uses

When the author omits a use count on a share, store this default.

The system default is 1 when this policy is not configured.

Learn more — Default share uses

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — omitted share max_uses stores 1.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max share uses

Ceiling on how many times a share may be used.

Unlimited shares require allow_unlimited on every applicable row and no invitation_max_uses.

Learn more — Max share uses

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no extra ceiling; unlimited shares remain forbidden.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max invitation uses

Requires a finite use count and rejects unlimited invitations or counts above the cap.

Learn more — Max invitation uses

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — unlimited-use invitations are allowed.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max invitation devices

Caps the number of unique guest browsers or app installations that may register an invitation.

Learn more — Max invitation devices

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — invitations may register any number of devices.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max active invitations per user

Caps how many enabled, unexpired invitations one person may have at once.

Learn more — Max active invitations per user

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no cap on how many invitations one person may keep active.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require invitation expiry

Forbids open-ended recurring invitations that never end.

Learn more — Require invitation expiry

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — never-ending recurring invitations are allowed.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Allowed entry kinds

Limits which portal types (door, gate, boom-gate) an invitation may grant.

Combination intersects allowed sets.

Learn more — Allowed entry kinds

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — any portal entry kind may be granted.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require invitation justification

Requires a non-empty creation justification when creating or updating an invitation.

Learn more — Require invitation justification

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — justification is optional.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max doors per invitation

Caps how many unique portals a single invitation may grant.

Learn more — Max doors per invitation

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no policy cap on portals per invitation.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Own-apartment doors only

Invitations may only grant doors the author can open as a resident of an allowed apartment.

Org/integration admins are exempt unless applies_to says otherwise. PalGate-only sites with no apartments fail for residents.

Learn more — Own-apartment doors only

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — invitations may grant any portal the author can otherwise share.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Prohibit master-door invitations

Rejects an invitation if any granted portal’s door is a listed OpenApp device id (union of ids; never client-forged hardware ids).

Learn more — Prohibit master-door invitations

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — master doors may be granted on invitations.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Who may invite

Literal allow-list of roles that may create invitations.

Combination intersects lists; empty intersection means nobody. Not admin-exempt. Compose with user_sharing (both must pass).

Learn more — Who may invite

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — anyone who can otherwise create invitations may do so.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

No invitation re-share

When the row binds the actor, invite create/update is rejected.

Org/integration default bind is resident (invitees), not generic members. Device-tier without applies_to binds everyone.

Learn more — No invitation re-share

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — invitees may create further invitations if their roles allow it.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require invitation identity

Requires a host PIN, a host-attached photo, and/or a verified invitee phone before an invitation can be created or used.

Learn more — Require invitation identity

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — PIN, photo, and verified phone are optional.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

EnforceRequire approval

Invitation allowed days

Limits invitation-based opens to listed weekdays, minus blackout dates and optional holiday-calendar dates.

Existing invitations are evaluated live, not modified.

Learn more — Invitation allowed days

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — invitation-based access is not limited by weekday or blackout date.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Holiday calendar

Lists organization-local ISO dates that invitation allowed-days can treat as holidays.

This type does not deny access by itself.

Learn more — Holiday calendar

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no shared holiday date list.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Holds

Door hold-open and hold-closed — who may set a hold and for how long.

5 policies

Require hold expiry

Members and residents cannot set a permanent hold.

Temporary (and unless also forbidden, weekly) holds are still allowed.

Learn more — Require hold expiry

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — permanent holds are allowed for anyone with the set-hold role.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max hold duration

Caps how long a temporary hold can last.

Longer requests are rejected, not shortened. PalGate hardware latch max is an extra cap when present.

Learn more — Max hold duration

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — no policy cap on temporary hold duration.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

No repeating holds

Members and residents may only set a one-shot hold, not a repeating calendar schedule.

Learn more — No repeating holds

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — repeating holds are allowed for anyone with set-hold.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Allowed hold modes

Limits members and residents to hold-open, hold-closed, or both (for example, stay-off for lights but not stay-on).

Learn more — Allowed hold modes

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — both hold-open and hold-closed are allowed.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

No holds

Members and residents cannot set a hold, even if an admin granted the set-hold role.

Device-tier without applies_to binds everyone, including admins.

Learn more — No holds

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — anyone with the set-hold role may set a hold.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Sharing

Who may share access or manage linked users outside invitations.

4 policies

User sharing control

Restricts whether non-admins may share access or create invitations out of band — block outright or require admin approval.

Learn more — User sharing control

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — non-admins may share access freely.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

EnforceRequire approval

No transitive delegation

Invite create: org admin or apartment admin only.

Vendor users_admin writes (except list): org admin only. Runs in addition to user_sharing.

Learn more — No transitive delegation

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — ordinary role and user_sharing rules apply.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Approval threshold

Requires N distinct organization-admin approve votes before a pending policy approval proceeds.

Any deny denies. Self-approval does not count.

Learn more — Approval threshold

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

DefaultWhat happens when no row of this type is configured.

Not configured — a single admin approve or deny is enough.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Linked-account admin

Controls whether a non-admin PalGate vendor account can complete setup: warn only, warn and require acknowledgment, or block until an admin account is used.

Learn more — Linked-account admin

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

Org

DefaultWhat happens when no row of this type is configured.

Not configured — warn and require acknowledgment (historical PalGate default).

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Lifecycle

Move-out and idle membership — revoke leftover invites without deleting the user.

2 policies

Revoke invites on move-out

When a resident is removed from an apartment, enabled invitations they authored that grant that apartment’s doors are revoked.

Learn more — Revoke invites on move-out

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — leftover invitations stay enabled after move-out.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Expire dormant users

After idle days, revoke that person’s invitations and remove residencies.

The user account is not deleted. Admins are exempt unless included.

Learn more — Expire dormant users

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — idle members and residents are not auto-expired.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Agent safety

Time windows, throttles, and extra confirmation for agents, API keys, and guests.

4 policies

Quiet hours

Blocks access during a local hour window for listed principal kinds (agents, API keys, invitations).

Admins are not restricted unless included.

Learn more — Quiet hours

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no quiet-hours window.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Rate limit

Throttles entity opens per principal in a sliding window so retrying agents cannot exhaust door quota.

Learn more — Rate limit

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no policy throttle on opens.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require step-up

Requires extra confirmation before a physical write for the listed principal kinds.

Learn more — Require step-up

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no extra confirmation beyond ordinary authorization.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Anti-tailgating cooldown

After a successful open of an entity, further opens of that entity are denied until the cooldown elapses.

Admins are exempt by default.

Learn more — Anti-tailgating cooldown

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no per-door cooldown after a successful open.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Operational

Site-wide lockdown and notifications when a policy denies access.

6 policies

Emergency lockdown

When active, denies non-admin inbound cloud opens.

Does not lock a means of egress or fire-door assembly, and is not a building lock-in.

Learn more — Emergency lockdown

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

Org

DefaultWhat happens when no row of this type is configured.

Not configured — no lockdown.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Emergency free egress

When active, OpenApp will not deny inbound cloud opens.

This is not fire-alarm release.

Learn more — Emergency free egress

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

Org

DefaultWhat happens when no row of this type is configured.

Not configured — ordinary denies still apply.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Notify on curfew attempt

Emits an audit event (and configured channels) when curfew blocks an open.

Learn more — Notify on curfew attempt

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Denial hook

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — curfew denials are not additionally notified.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Maintenance window

During a local hour window, only listed roles may open.

Empty role intersection means nobody. Technicians match the same way as who-may-invite.

Learn more — Maintenance window

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no technician-only maintenance window.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Notify on first use

Emits an audit event when an invitation’s use count goes from 0 to 1, if audit is among the channels.

Learn more — Notify on first use

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — first invitation use is not additionally notified.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Notify on new sharing

Emits an audit event after users_admin writes (except list) and after invitation create that actually shares, if audit is among the channels.

Learn more — Notify on new sharing

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — new sharing is not additionally notified.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Integration users (users_admin)

The PalGate provider exposes the users_admin capability, which lets OpenApp list and remove gate users directly from the PalGate device — without leaving the dashboard. This powers the Users tab on the integration detail page.

Capability shape

• Handle kind: phone (PalGate identifies users by E.164 phone number).
• Ops:
  • users_admin.list_users — returns the directory of phone numbers granted access to a single PalGate device. The op takes { device_id } (the PalGate device id, not the OpenApp device row id) and is auto-invoked by GET /integrations/{id}/integration-users once per integration device.
  • users_admin.remove_user — revokes a phone number from a PalGate device. Body: { device_id, handle } where handle is the user’s E.164 phone.

OpenApp permissions (gate operator vs access administrator)

Permission	Action
integrations:read	View integration, execute gate-open ops
integrations:users:list	GET /integrations/{id}/integration-users, Users tab
integrations:users:write	Invite/resend/cancel in dashboard, users_admin.remove_user

The PalGate API still requires the linked phone to be a gate administrator to list or remove users on a device. When the linked account is not admin, the Users tab shows a limited state instead of a hard error. Full reference: PalGate permissions guide.

Linked-account admin policy

Org-tier policy type linked_account_admin (default warn_and_ack when unset):

Value	Setup	Users tab
warn_only	Allow; show warnings	Fails to list if not PalGate admin
warn_and_ack	Non-admin must accept acknowledgment	Limited directory when not admin
admin_only	Block if linked account is not admin on setup device	Full users_admin when admin

This is authored in Settings → Policies, not org metadata. Who may share gate users is a separate user sharing policy. See Policies and the policy catalog.

Device-level policies (gate owner control)

A verified PalGate gate administrator can become the OpenApp device steward for a gate and set device-level policies (for example a curfew or sharing controls) that bind every organization and integration pointing at the same physical gate — even ones the steward cannot otherwise see. The gate identity is auto-detected and stewardship is verified against the real gate, so it cannot be spoofed. See Regaining control of shared devices.

directory_limited (generic API)

GET /integrations/{id}/integration-users may include directory_limited: true when the upstream provider did not return the full user directory (for example the linked credentials lack provider-side admin rights). This field is provider-agnostic — PalGate-specific linked-account role details are in device metadata palgate_linked_account (refreshed via the palgate.probe_linked_account integration op).

Status reconciliation

/integrations/{id}/integration-users joins each PalGate-reported phone with the OpenApp users table and any pending user_invitations for the same org:

status	Meaning
linked	OpenApp user has a verified phone matching the gate entry — the dashboard shows a deep link.
invited	No matching OpenApp user, but an open user_invitations row targets the same phone.
unlinked	Neither — the gate has a directory entry that OpenApp has never invited or attached. The Users tab flags these as unmanaged. OpenApp does not remove them automatically.

Linked-account role API

• POST /integrations/{id}/ops/palgate.probe_linked_account — probe the linked account on one gate (payload.device_id = PalGate device id). Persists palgate_linked_account in the matching OpenApp device metadata.
• POST /integration-setup/v1/palgate/probe-linked-account — wizard probe before integration exists (requires integrations:create).

Known gaps

• No email handle: PalGate’s API only models phone-based access. The Users tab therefore hides the email column on PalGate integrations even though user_invitations itself supports both channels.
• Per-device scope: PalGate users are scoped to a single device, so the Users tab aggregates per-device lists. Removing a phone from one device does not propagate to other PalGate devices in the same integration.
• No display name: PalGate does not return a display name for directory entries. Rows render with an em-dash until OpenApp can resolve the phone to an existing user.

Related

• PalGate permissions and Linked Device
• Policies, the policy catalog, and Regaining control of shared devices
• Open a gate with PalGate Cloud