Require invitation identity

Type

invitation_require_identity

Category

Invitations

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

EnforceRequire approval

DefaultWhat happens when no row of this type is configured.

Not configured — PIN, photo, and verified phone are optional.

Each flag is combined with OR across applicable rows (any true flag wins). Create and update reject the request when a required field is missing — they do not clamp. Photo means a host-attached media slot named photo. PIN is 4–8 digits and is stored hashed on the invite. Phone OTP is scoped to that invite. At redemption, missing PIN, photo, or verified phone still blocks the open. Mixed enforce and require_approval rows: enforce wins for blocking; require_approval can still open the inbox when the type is authored that way.

When it is enforced

Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.

Where to set it

Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Shared row fieldsenforcement (enforce, require_approval,audit_only) and enabled apply to every type;audit_only and disabled rows never block.

Name	Type	Required	Values	Description
require_pin	boolean	No	—	When true, the host must set a 4–8 digit PIN (hashed on the invite).
require_photo	boolean	No	—	When true, the host must attach a photo media slot named photo.
require_verified_phone	boolean	No	—	When true, the host must supply an invitee phone and the guest must complete invite-scoped OTP before use.
output	string or integer	No	—	Optional channel or output id. When set, the policy binds only that output. When omitted, it binds every output of the tier target. A scoped row does not apply when the acting output is unknown.

How overlapping rows combine

Most-restrictive: boolean OR of each flag across applicable rows. Disabled and audit_only rows never block. Reject missing identity, do not clamp.

Example

Creating an invitation without a PIN or invitee phone is rejected. A guest who has not verified the phone cannot redeem the link.

config

{
  "require_pin": true,
  "require_photo": false,
  "require_verified_phone": true
}

Integrations

This type is documented on these connectors:

• Home Assistant (home_assistant)
• KNX (knx)
• MQTT (mqtt)
• PalGate Cloud (palgate_cloud)
• Shelly Cloud (shelly_cloud)
• Shelly Websocket (shelly_websocket)
• Tasmota (tasmota)
• Virtual Access (virtual_access)
• Virtual Demo Devices (virtual_demo)
• Waveshare (waveshare)

Related

• Policy catalog
• Policies architecture guide
• Require invitation justification (invitation_require_justification)
• Invitation allowed days (invitation_allowed_days)
• Approval threshold (approval_threshold)

Typed configuration

The OpenAPI contract names this object InvitationIdentityPolicyConfig:

{
  "require_pin": true,
  "require_photo": false,
  "require_verified_phone": true,
  "output": "main"
}

At least one requirement must be true. Applicable rows combine each flag with logical OR; missing required invitation identity is rejected rather than silently omitted.