Shelly Websocket
Not for electrically locking a means of egress.OpenApp is ingress-only software. Occupants must be able to exit without this integration, the cloud, or a phone. SeeLife safety and egress.
At a glance
Section titled “At a glance”Getting started
Section titled “Getting started”This provider type is available in OpenApp, but does not currently expose actions or ops.
If you want to control Shelly devices today, use Shelly Cloud (shelly_cloud).
When Shelly Websocket support is enabled, entity metadata will use the structure below.
Setup reference
Section titled “Setup reference”Integration config
Section titled “Integration config”Entity metadata (per entity)
Section titled “Entity metadata (per entity)”| Field | Type | Required | Description | Default | Example |
|---|---|---|---|---|---|
channel_index | integer | optional | Port (channel index) for multi-relay devices. Defaults to 0. | — | 0 |
shelly.device_id | string | required | Shelly device ID (under entity metadata.shelly). | — | ABC123 |
shelly.component | string | required | Shelly component type. One of: switch:0, switch:1, cover:0, cover:1, input:0, input:1. | — | switch:0 |
Policies
Policies restrict access on top of roles — they never grant it. Browse the policy catalog for arguments and examples. Expand a category below to see the policies that apply to this integration, then expand a policy for details.
Invitations
Guest invites — duration, uses, who may create them, and which doors they can cover.
19 policies
Invitations
Guest invites — duration, uses, who may create them, and which doors they can cover.
19 policies
Invitation curfew
Blocks invitation-based opens during a forbidden time window (for example nights).
Invitation curfew
Blocks invitation-based opens during a forbidden time window (for example nights).
Admins and residents are never curfewed; existing invitations are evaluated live, not modified.
Learn more — Invitation curfew- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no hour restrictions on invitation-based access.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Max invitation duration
Caps how long each invitation schedule slot may last.
Max invitation duration
Caps how long each invitation schedule slot may last.
Longer create or update requests are rejected, not shortened.
Learn more — Max invitation duration- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no policy cap on invitation slot length.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Max share duration
Caps how long a short-term share (TTL invitation) may last.
Max share duration
Caps how long a short-term share (TTL invitation) may last.
Combined with max invitation duration as the stricter of the two. Longer create requests are rejected, not shortened.
Learn more — Max share duration- Enforced at
- Authoring-time
- Tiers
- OrgIntegration
- Default
- System default is 86400 (1 day) when unset. Org policy may raise the share cap up to 31536000 (365d).
- Enforcement
- Enforce
Default share uses
When the author omits a use count on a share, store this default.
Default share uses
When the author omits a use count on a share, store this default.
The system default is 1 when this policy is not configured.
Learn more — Default share uses- Enforced at
- Authoring-time
- Tiers
- OrgIntegration
- Default
- Not configured — omitted share max_uses stores 1.
- Enforcement
- Enforce
Max share uses
Ceiling on how many times a share may be used.
Max share uses
Ceiling on how many times a share may be used.
Unlimited shares require allow_unlimited on every applicable row and no invitation_max_uses.
Learn more — Max share uses- Enforced at
- Authoring-time
- Tiers
- OrgIntegration
- Default
- Not configured — no extra ceiling; unlimited shares remain forbidden.
- Enforcement
- Enforce
Max invitation uses
Requires a finite use count and rejects unlimited invitations or counts above the cap.
Max invitation uses
Requires a finite use count and rejects unlimited invitations or counts above the cap.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — unlimited-use invitations are allowed.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Max invitation devices
Caps the number of unique guest browsers or app installations that may register an invitation.
Max invitation devices
Caps the number of unique guest browsers or app installations that may register an invitation.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — invitations may register any number of devices.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Max active invitations per user
Caps how many enabled, unexpired invitations one person may have at once.
Max active invitations per user
Caps how many enabled, unexpired invitations one person may have at once.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no cap on how many invitations one person may keep active.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Require invitation expiry
Forbids open-ended recurring invitations that never end.
Require invitation expiry
Forbids open-ended recurring invitations that never end.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — never-ending recurring invitations are allowed.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Allowed entry kinds
Limits which portal types (door, gate, boom-gate) an invitation may grant.
Allowed entry kinds
Limits which portal types (door, gate, boom-gate) an invitation may grant.
Combination intersects allowed sets.
Learn more — Allowed entry kinds- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — any portal entry kind may be granted.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Require invitation justification
Requires a non-empty creation justification when creating or updating an invitation.
Require invitation justification
Requires a non-empty creation justification when creating or updating an invitation.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — justification is optional.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Max doors per invitation
Caps how many unique portals a single invitation may grant.
Max doors per invitation
Caps how many unique portals a single invitation may grant.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no policy cap on portals per invitation.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Own-apartment doors only
Invitations may only grant doors the author can open as a resident of an allowed apartment.
Own-apartment doors only
Invitations may only grant doors the author can open as a resident of an allowed apartment.
Org/integration admins are exempt unless applies_to says otherwise. PalGate-only sites with no apartments fail for residents.
Learn more — Own-apartment doors only- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — invitations may grant any portal the author can otherwise share.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Prohibit master-door invitations
Rejects an invitation if any granted portal’s door is a listed OpenApp device id (union of ids; never client-forged hardware ids).
Prohibit master-door invitations
Rejects an invitation if any granted portal’s door is a listed OpenApp device id (union of ids; never client-forged hardware ids).
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — master doors may be granted on invitations.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Who may invite
Literal allow-list of roles that may create invitations.
Who may invite
Literal allow-list of roles that may create invitations.
Combination intersects lists; empty intersection means nobody. Not admin-exempt. Compose with user_sharing (both must pass).
Learn more — Who may invite- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — anyone who can otherwise create invitations may do so.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
No invitation re-share
When the row binds the actor, invite create/update is rejected.
No invitation re-share
When the row binds the actor, invite create/update is rejected.
Org/integration default bind is resident (invitees), not generic members. Device-tier without applies_to binds everyone.
Learn more — No invitation re-share- Enforced at
- Authoring-time
- Tiers
- OrgIntegration
- Default
- Not configured — invitees may create further invitations if their roles allow it.
- Enforcement
- Enforce
Require invitation identity
Requires a host PIN, a host-attached photo, and/or a verified invitee phone before an invitation can be created or used.
Require invitation identity
Requires a host PIN, a host-attached photo, and/or a verified invitee phone before an invitation can be created or used.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — PIN, photo, and verified phone are optional.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- EnforceRequire approval
Invitation allowed days
Limits invitation-based opens to listed weekdays, minus blackout dates and optional holiday-calendar dates.
Invitation allowed days
Limits invitation-based opens to listed weekdays, minus blackout dates and optional holiday-calendar dates.
Existing invitations are evaluated live, not modified.
Learn more — Invitation allowed days- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — invitation-based access is not limited by weekday or blackout date.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Holiday calendar
Lists organization-local ISO dates that invitation allowed-days can treat as holidays.
Holiday calendar
Lists organization-local ISO dates that invitation allowed-days can treat as holidays.
This type does not deny access by itself.
Learn more — Holiday calendar- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no shared holiday date list.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Holds
Door hold-open and hold-closed — who may set a hold and for how long.
5 policies
Holds
Door hold-open and hold-closed — who may set a hold and for how long.
5 policies
Require hold expiry
Members and residents cannot set a permanent hold.
Require hold expiry
Members and residents cannot set a permanent hold.
Temporary (and unless also forbidden, weekly) holds are still allowed.
Learn more — Require hold expiry- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — permanent holds are allowed for anyone with the set-hold role.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Max hold duration
Caps how long a temporary hold can last.
Max hold duration
Caps how long a temporary hold can last.
Longer requests are rejected, not shortened. PalGate hardware latch max is an extra cap when present.
Learn more — Max hold duration- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no policy cap on temporary hold duration.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
No repeating holds
Members and residents may only set a one-shot hold, not a repeating calendar schedule.
No repeating holds
Members and residents may only set a one-shot hold, not a repeating calendar schedule.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — repeating holds are allowed for anyone with set-hold.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Allowed hold modes
Limits members and residents to hold-open, hold-closed, or both (for example, stay-off for lights but not stay-on).
Allowed hold modes
Limits members and residents to hold-open, hold-closed, or both (for example, stay-off for lights but not stay-on).
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — both hold-open and hold-closed are allowed.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
No holds
Members and residents cannot set a hold, even if an admin granted the set-hold role.
No holds
Members and residents cannot set a hold, even if an admin granted the set-hold role.
Device-tier without applies_to binds everyone, including admins.
Learn more — No holds- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — anyone with the set-hold role may set a hold.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Sharing
Who may share access or manage linked users outside invitations.
3 policies
Sharing
Who may share access or manage linked users outside invitations.
3 policies
User sharing control
Restricts whether non-admins may share access or create invitations out of band — block outright or require admin approval.
User sharing control
Restricts whether non-admins may share access or create invitations out of band — block outright or require admin approval.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — non-admins may share access freely.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- EnforceRequire approval
No transitive delegation
Invite create: org admin or apartment admin only.
No transitive delegation
Invite create: org admin or apartment admin only.
Vendor users_admin writes (except list): org admin only. Runs in addition to user_sharing.
Learn more — No transitive delegation- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — ordinary role and user_sharing rules apply.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Approval threshold
Requires N distinct organization-admin approve votes before a pending policy approval proceeds.
Approval threshold
Requires N distinct organization-admin approve votes before a pending policy approval proceeds.
Any deny denies. Self-approval does not count.
Learn more — Approval threshold- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — a single admin approve or deny is enough.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Lifecycle
Move-out and idle membership — revoke leftover invites without deleting the user.
2 policies
Lifecycle
Move-out and idle membership — revoke leftover invites without deleting the user.
2 policies
Revoke invites on move-out
When a resident is removed from an apartment, enabled invitations they authored that grant that apartment’s doors are revoked.
Revoke invites on move-out
When a resident is removed from an apartment, enabled invitations they authored that grant that apartment’s doors are revoked.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — leftover invitations stay enabled after move-out.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Expire dormant users
After idle days, revoke that person’s invitations and remove residencies.
Expire dormant users
After idle days, revoke that person’s invitations and remove residencies.
The user account is not deleted. Admins are exempt unless included.
Learn more — Expire dormant users- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — idle members and residents are not auto-expired.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Agent safety
Time windows, throttles, and extra confirmation for agents, API keys, and guests.
4 policies
Agent safety
Time windows, throttles, and extra confirmation for agents, API keys, and guests.
4 policies
Quiet hours
Blocks access during a local hour window for listed principal kinds (agents, API keys, invitations).
Quiet hours
Blocks access during a local hour window for listed principal kinds (agents, API keys, invitations).
Admins are not restricted unless included.
Learn more — Quiet hours- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no quiet-hours window.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Rate limit
Throttles entity opens per principal in a sliding window so retrying agents cannot exhaust door quota.
Rate limit
Throttles entity opens per principal in a sliding window so retrying agents cannot exhaust door quota.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no policy throttle on opens.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Require step-up
Requires extra confirmation before a physical write for the listed principal kinds.
Require step-up
Requires extra confirmation before a physical write for the listed principal kinds.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no extra confirmation beyond ordinary authorization.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Anti-tailgating cooldown
After a successful open of an entity, further opens of that entity are denied until the cooldown elapses.
Anti-tailgating cooldown
After a successful open of an entity, further opens of that entity are denied until the cooldown elapses.
Admins are exempt by default.
Learn more — Anti-tailgating cooldown- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no per-door cooldown after a successful open.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Operational
Site-wide lockdown and notifications when a policy denies access.
6 policies
Operational
Site-wide lockdown and notifications when a policy denies access.
6 policies
Emergency lockdown
When active, denies non-admin inbound cloud opens.
Emergency lockdown
When active, denies non-admin inbound cloud opens.
Does not lock a means of egress or fire-door assembly, and is not a building lock-in.
Learn more — Emergency lockdown- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- Org
- DefaultWhat happens when no row of this type is configured.
- Not configured — no lockdown.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Emergency free egress
When active, OpenApp will not deny inbound cloud opens.
Emergency free egress
When active, OpenApp will not deny inbound cloud opens.
This is not fire-alarm release.
Learn more — Emergency free egress- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- Org
- DefaultWhat happens when no row of this type is configured.
- Not configured — ordinary denies still apply.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Notify on curfew attempt
Emits an audit event (and configured channels) when curfew blocks an open.
Notify on curfew attempt
Emits an audit event (and configured channels) when curfew blocks an open.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Denial hook
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — curfew denials are not additionally notified.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Maintenance window
During a local hour window, only listed roles may open.
Maintenance window
During a local hour window, only listed roles may open.
Empty role intersection means nobody. Technicians match the same way as who-may-invite.
Learn more — Maintenance window- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — no technician-only maintenance window.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Notify on first use
Emits an audit event when an invitation’s use count goes from 0 to 1, if audit is among the channels.
Notify on first use
Emits an audit event when an invitation’s use count goes from 0 to 1, if audit is among the channels.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — first invitation use is not additionally notified.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
Notify on new sharing
Emits an audit event after users_admin writes (except list) and after invitation create that actually shares, if audit is among the channels.
Notify on new sharing
Emits an audit event after users_admin writes (except list) and after invitation create that actually shares, if audit is among the channels.
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- DefaultWhat happens when no row of this type is configured.
- Not configured — new sharing is not additionally notified.
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce