Maintenance window

Type

maintenance_window

Category

Operational

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

DefaultWhat happens when no row of this type is configured.

Not configured — no technician-only maintenance window.

Denies opens outside the remaining allowed roles while the local hour is inside the window (midnight-wrapping, same as quiet hours). Combination intersects allowed_roles; empty intersection means nobody may open. Technician matching follows invite_creator_roles (apartment technician or virtual-access technician suffix). When allowed_roles is omitted, the default is technician.

When it is enforced

Evaluated when someone opens a door or gate or triggers an entity action. If this policy applies, the open is denied even when roles and grants would otherwise allow it.

Where to set it

Settings → Policies (org) or the integration Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Shared row fieldsenforcement (enforce, require_approval,audit_only) and enabled apply to every type;audit_only and disabled rows never block.

Name	Type	Required	Values	Description
start	string	Yes	HH:MM	Inclusive start of the window as local `HH:MM` (00:00–23:59). May be later than end (midnight-wrapping, for example 22:30→06:00).
end	string	Yes	HH:MM	Inclusive end of the window as local `HH:MM`. At 06:00 the minute 06:00 is blocked and 06:01 is not.
allowed_roles	string[]	No	adminintegrations:updateresidenttechnician	Roles that may open during the window. Matching follows invite_creator_roles. Combination intersects lists. Default: ["technician"]
output	string or integer	No	—	Optional channel or output id. When set, the policy binds only that output. When omitted, it binds every output of the tier target. A scoped row does not apply when the acting output is unknown.

How overlapping rows combine

Most-restrictive: any applicable window that binds the actor may deny; allowed_roles are intersected. Empty intersection means nobody. Disabled and audit_only rows never block.

Example

Between 01:00 and 05:00 only a technician or org admin can open. A resident invitation is denied.

config

{
  "start": "01:00",
  "end": "05:00",
  "allowed_roles": [
    "technician",
    "admin"
  ]
}

Integrations

This type is documented on these connectors:

• Home Assistant (home_assistant)
• KNX (knx)
• MQTT (mqtt)
• PalGate Cloud (palgate_cloud)
• Shelly Cloud (shelly_cloud)
• Shelly Websocket (shelly_websocket)
• Tasmota (tasmota)
• Virtual Access (virtual_access)
• Virtual Demo Devices (virtual_demo)
• Waveshare (waveshare)

Related

• Policy catalog
• Policies architecture guide
• Quiet hours (quiet_hours)
• Who may invite (invite_creator_roles)
• Emergency lockdown (emergency_lockdown)