Tasmota

Not affiliated with Tasmota

OpenApp is an independent product and is not associated with, endorsed by, sponsored by, or affiliated with Tasmota or Espressif in any way. "Tasmota" and "Espressif" are trademarks of their respective owners and are used here only to describe interoperability.

For any issues with this integration, contact OpenApp — not Tasmota or Espressif. They cannot support problems caused by OpenApp, and contacting them about this integration may delay a resolution.

Not for electrically locking a means of egress.OpenApp is ingress-only software. Occupants must be able to exit without this integration, the cloud, or a phone. SeeLife safety and egress.

At a glance

• Product: Tasmota (GPL-3 firmware; OpenApp does not fork or rebrand it)
• Manufacturer: Espressif chips (ESP8266 and the ESP32 family)
• Maturity: Early — first-party flash UX is new; Tasmota itself is mature

Getting started

1. Create a Tasmota integration (empty config — broker comes from env) and a device: list the GPIOs OpenApp may drive (output type and pulse per pin). Set opening class on that device (not_applicable for onboard RGB; ingress_only plus attestation for a door or gate). Optional board presets only pre-fill GPIO fields (for example ESP32-C61-DevKitC-1 onboard RGB → GPIO 8 / ws2812; ESP32-S3-DevKitC-1 v1.1 N16R8 → GPIO 38 / ws2812).
2. OpenApp issues dev:{device_id}, scoped ACLs (openapp/tasmota/{device_id}/#), and a WebPassword. It creates one switch entity per allowlisted GPIO.
3. Stay in the OpenApp dashboard (or the public installer) and click Flash firmware. ESP Web Tools writes Tasmota’s current stock factory binary for the chip on the USB port (the browser loads the image from this site; OpenApp proxies Tasmota’s OTA file). Then Improv sets Wi-Fi. Flashing does not send OpenApp MQTT, WebPassword, or GPIO settings. Keep USB plugged in and click Send settings over USB. Pin changes are not on the board until you send settings again. If the browser can’t open the port, see Connect the board over USB.
4. Open a door: OpenApp publishes ON to openapp/tasmota/{device_id}/cmnd/POWER (first GPIO) or …/cmnd/POWER2 and up for later slots. Device PulseTime drops the output; OpenApp may still send OFF.

Do not list a GPIO that has other hardware on it unless you intend OpenApp to drive that pin. Unlisted pins are not configured as relays.

The C61-DevKitC-1 and S3-DevKitC-1 are dev boards, not product SKUs. Their power LEDs are not GPIO-controllable. Onboard RGB is addressable (WS2812-class): GPIO 8 on C61 (also a strapping pin), GPIO 38 on S3-DevKitC-1 hardware v1.1 (GPIO 48 on v1.0). Driving RGB as relay will not blink it cleanly. WS2812 cannot be mixed with relay outputs on the same device. OpenApp sets Tasmota Sleep 0 so MQTT POWER is not delayed by Wi-Fi DTIM power save.

Where the Tasmota UI is (optional fallback)

Tasmota’s HTTP UI is the board’s own server. OpenApp does not proxy it.

• Happy path: it never appears (flash + Improv + send settings over USB).
• No Wi-Fi / no Improv: join SoftAP tasmota-XXXX, then http://192.168.4.1/.
• Board already on LAN: http://192.168.x.y/ or http://tasmota_<id>.local/.

Use that UI only if sending settings over USB failed, you flashed from tasmota.github.io/install without OpenApp, or you want to debug. Open Troubleshoot in the dashboard, copy the console command (a Tasmota Backlog), and paste it in Console, or enter the LAN IP so OpenApp GET http://<ip>/cm.

Connect the board over USB

Flash and Send settings over USB use the browser Web Serial API. Use Chrome or Edge on a computer. The page must be HTTPS or localhost. Phones and tablets can’t flash.

Use a USB cable that carries data, not charge-only. In the port picker, choose the USB-serial adapter (often CH340, CP210x, or USB Serial).

Linux: failed to open the serial port

If the browser reports that it failed to open the serial port, the board is often plugged in but your user can’t open the device node (/dev/ttyUSB0 or /dev/ttyACM0). On Debian and Ubuntu that node is owned by the dialout group. The OpenApp flash modal shows these steps when USB serial fails.

sudo usermod -aG dialout "$USER"

Then log out of the desktop session and log back in (or reboot). A new terminal in the same session is not enough. Run groups and confirm you see dialout.

If it still fails:

• Close anything else using the port (Arduino IDE, PlatformIO, serial monitors, another browser tab). After a failed flash, unplug the board and plug it back in before retrying — the installer may still hold the port open.
• Use a native Chrome or Edge package. Snap Chromium often can’t open serial devices.
• On Ubuntu, brltty can claim CH340 adapters. Disable that service if you don’t use a braille display.
• ModemManager can claim the same adapters. Add a udev rule that sets ID_MM_DEVICE_IGNORE for your adapter’s USB vendor and product IDs, then reload udev.

MQTTS, WebPassword, PulseTime

• MQTTS: deployed zones use :8883 and MqttTLS 1 in the Backlog. Local compose uses authenticated :1883. The stock ESP8266 tasmota.bin pin may omit TLS; prefer an ESP32-family chip for production MQTTS.
• WebPassword: OpenApp issues one and writes it in the same Backlog so the board HTTP UI is not left open. Download is authenticated (GET /devices/{id}/tasmota/provisioning); do not put that URL on the public internet.
• PulseTime: each output’s pulse_ms maps to PulseTime1, PulseTime2, … (0 = latching). OpenApp also uses OpenApp-controlled per-command auto-off and may still publish OFF. A sole WS2812 output that ignores PulseTime gets a one-shot Rule1 timer in the Backlog.

Rotate MQTT + WebPassword with POST /devices/{id}/tasmota/rotate-credentials, then re-apply the Backlog.

Mains safety

Dry-contact modules and low-voltage LEDs are in scope for DIY. Mains wiring needs a qualified electrician.

Setup reference

Field	Type	Required	Description	Default	Example
OPENAPP_MQTT_API_BROKER_HOST / OPENAPP_MQTT_API_BROKER_PORT	string	required	Required deployment environment: hostname and port the **OpenApp API** uses to publish `POWER` commands. Shared with Waveshare. No defaults — the process fails fast if unset.	—	emqx
OPENAPP_MQTT_DEVICE_BROKER_HOST / OPENAPP_MQTT_DEVICE_BROKER_PORT	string	required	Required deployment environment: broker address **written into the Tasmota Backlog** (reachable from the board). Local compose uses **1883**; deployed zones use **8883**. No defaults.	—	mqtt.openapp.house:8883
outputs	array	required	Allowlist of GPIOs OpenApp may toggle. Each item has `gpio`, `output_type` (`relay`, `relay_i`, or `ws2812`), and optional `pulse_ms`. Only these pins are programmed as Tasmota relays; other user GPIOs are set to None. One OpenApp switch entity per item. Max 32 (ESP8266 factory builds typically bind 8).	—	[{"gpio":4,"output_type":"relay","pulse_ms":1000}]

Policies

Policies restrict access on top of roles — they never grant it. Browse the policy catalog for arguments and examples. Expand a category below to see the policies that apply to this integration, then expand a policy for details.

Invitations

Guest invites — duration, uses, who may create them, and which doors they can cover.

19 policies

Invitation curfew

Blocks invitation-based opens during a forbidden time window (for example nights).

Admins and residents are never curfewed; existing invitations are evaluated live, not modified.

Learn more — Invitation curfew

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no hour restrictions on invitation-based access.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max invitation duration

Caps how long each invitation schedule slot may last.

Longer create or update requests are rejected, not shortened.

Learn more — Max invitation duration

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no policy cap on invitation slot length.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max share duration

Caps how long a short-term share (TTL invitation) may last.

Combined with max invitation duration as the stricter of the two. Longer create requests are rejected, not shortened.

Learn more — Max share duration

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

System default is 86400 (1 day) when unset. Org policy may raise the share cap up to 31536000 (365d).

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Default share uses

When the author omits a use count on a share, store this default.

The system default is 1 when this policy is not configured.

Learn more — Default share uses

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — omitted share max_uses stores 1.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max share uses

Ceiling on how many times a share may be used.

Unlimited shares require allow_unlimited on every applicable row and no invitation_max_uses.

Learn more — Max share uses

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no extra ceiling; unlimited shares remain forbidden.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max invitation uses

Requires a finite use count and rejects unlimited invitations or counts above the cap.

Learn more — Max invitation uses

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — unlimited-use invitations are allowed.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max invitation devices

Caps the number of unique guest browsers or app installations that may register an invitation.

Learn more — Max invitation devices

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — invitations may register any number of devices.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max active invitations per user

Caps how many enabled, unexpired invitations one person may have at once.

Learn more — Max active invitations per user

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no cap on how many invitations one person may keep active.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require invitation expiry

Forbids open-ended recurring invitations that never end.

Learn more — Require invitation expiry

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — never-ending recurring invitations are allowed.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Allowed entry kinds

Limits which portal types (door, gate, boom-gate) an invitation may grant.

Combination intersects allowed sets.

Learn more — Allowed entry kinds

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — any portal entry kind may be granted.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require invitation justification

Requires a non-empty creation justification when creating or updating an invitation.

Learn more — Require invitation justification

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — justification is optional.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max doors per invitation

Caps how many unique portals a single invitation may grant.

Learn more — Max doors per invitation

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no policy cap on portals per invitation.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Own-apartment doors only

Invitations may only grant doors the author can open as a resident of an allowed apartment.

Org/integration admins are exempt unless applies_to says otherwise. PalGate-only sites with no apartments fail for residents.

Learn more — Own-apartment doors only

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — invitations may grant any portal the author can otherwise share.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Prohibit master-door invitations

Rejects an invitation if any granted portal’s door is a listed OpenApp device id (union of ids; never client-forged hardware ids).

Learn more — Prohibit master-door invitations

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — master doors may be granted on invitations.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Who may invite

Literal allow-list of roles that may create invitations.

Combination intersects lists; empty intersection means nobody. Not admin-exempt. Compose with user_sharing (both must pass).

Learn more — Who may invite

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — anyone who can otherwise create invitations may do so.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

No invitation re-share

When the row binds the actor, invite create/update is rejected.

Org/integration default bind is resident (invitees), not generic members. Device-tier without applies_to binds everyone.

Learn more — No invitation re-share

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — invitees may create further invitations if their roles allow it.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require invitation identity

Requires a host PIN, a host-attached photo, and/or a verified invitee phone before an invitation can be created or used.

Learn more — Require invitation identity

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — PIN, photo, and verified phone are optional.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

EnforceRequire approval

Invitation allowed days

Limits invitation-based opens to listed weekdays, minus blackout dates and optional holiday-calendar dates.

Existing invitations are evaluated live, not modified.

Learn more — Invitation allowed days

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — invitation-based access is not limited by weekday or blackout date.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Holiday calendar

Lists organization-local ISO dates that invitation allowed-days can treat as holidays.

This type does not deny access by itself.

Learn more — Holiday calendar

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no shared holiday date list.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Holds

Door hold-open and hold-closed — who may set a hold and for how long.

5 policies

Require hold expiry

Members and residents cannot set a permanent hold.

Temporary (and unless also forbidden, weekly) holds are still allowed.

Learn more — Require hold expiry

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — permanent holds are allowed for anyone with the set-hold role.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Max hold duration

Caps how long a temporary hold can last.

Longer requests are rejected, not shortened. PalGate hardware latch max is an extra cap when present.

Learn more — Max hold duration

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no policy cap on temporary hold duration.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

No repeating holds

Members and residents may only set a one-shot hold, not a repeating calendar schedule.

Learn more — No repeating holds

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — repeating holds are allowed for anyone with set-hold.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Allowed hold modes

Limits members and residents to hold-open, hold-closed, or both (for example, stay-off for lights but not stay-on).

Learn more — Allowed hold modes

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — both hold-open and hold-closed are allowed.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

No holds

Members and residents cannot set a hold, even if an admin granted the set-hold role.

Device-tier without applies_to binds everyone, including admins.

Learn more — No holds

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — anyone with the set-hold role may set a hold.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Sharing

Who may share access or manage linked users outside invitations.

3 policies

User sharing control

Restricts whether non-admins may share access or create invitations out of band — block outright or require admin approval.

Learn more — User sharing control

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — non-admins may share access freely.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

EnforceRequire approval

No transitive delegation

Invite create: org admin or apartment admin only.

Vendor users_admin writes (except list): org admin only. Runs in addition to user_sharing.

Learn more — No transitive delegation

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — ordinary role and user_sharing rules apply.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Approval threshold

Requires N distinct organization-admin approve votes before a pending policy approval proceeds.

Any deny denies. Self-approval does not count.

Learn more — Approval threshold

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — a single admin approve or deny is enough.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Lifecycle

Move-out and idle membership — revoke leftover invites without deleting the user.

2 policies

Revoke invites on move-out

When a resident is removed from an apartment, enabled invitations they authored that grant that apartment’s doors are revoked.

Learn more — Revoke invites on move-out

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — leftover invitations stay enabled after move-out.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Expire dormant users

After idle days, revoke that person’s invitations and remove residencies.

The user account is not deleted. Admins are exempt unless included.

Learn more — Expire dormant users

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — idle members and residents are not auto-expired.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Agent safety

Time windows, throttles, and extra confirmation for agents, API keys, and guests.

4 policies

Quiet hours

Blocks access during a local hour window for listed principal kinds (agents, API keys, invitations).

Admins are not restricted unless included.

Learn more — Quiet hours

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no quiet-hours window.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Rate limit

Throttles entity opens per principal in a sliding window so retrying agents cannot exhaust door quota.

Learn more — Rate limit

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no policy throttle on opens.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Require step-up

Requires extra confirmation before a physical write for the listed principal kinds.

Learn more — Require step-up

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no extra confirmation beyond ordinary authorization.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Anti-tailgating cooldown

After a successful open of an entity, further opens of that entity are denied until the cooldown elapses.

Admins are exempt by default.

Learn more — Anti-tailgating cooldown

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no per-door cooldown after a successful open.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Operational

Site-wide lockdown and notifications when a policy denies access.

6 policies

Emergency lockdown

When active, denies non-admin inbound cloud opens.

Does not lock a means of egress or fire-door assembly, and is not a building lock-in.

Learn more — Emergency lockdown

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

Org

DefaultWhat happens when no row of this type is configured.

Not configured — no lockdown.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Emergency free egress

When active, OpenApp will not deny inbound cloud opens.

This is not fire-alarm release.

Learn more — Emergency free egress

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

Org

DefaultWhat happens when no row of this type is configured.

Not configured — ordinary denies still apply.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Notify on curfew attempt

Emits an audit event (and configured channels) when curfew blocks an open.

Learn more — Notify on curfew attempt

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Denial hook

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — curfew denials are not additionally notified.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Maintenance window

During a local hour window, only listed roles may open.

Empty role intersection means nobody. Technicians match the same way as who-may-invite.

Learn more — Maintenance window

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — no technician-only maintenance window.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Notify on first use

Emits an audit event when an invitation’s use count goes from 0 to 1, if audit is among the channels.

Learn more — Notify on first use

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — first invitation use is not additionally notified.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

Notify on new sharing

Emits an audit event after users_admin writes (except list) and after invitation create that actually shares, if audit is among the channels.

Learn more — Notify on new sharing

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

DefaultWhat happens when no row of this type is configured.

Not configured — new sharing is not additionally notified.

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce