Quiet hours

Type

quiet_hours

Category

Agent safety

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Access-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegration

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

DefaultWhat happens when no row of this type is configured.

Not configured — no quiet-hours window.

Denies an otherwise-allowed open during a local time window for the principal kinds in applies_to. Default applies_to is agents, API keys, and invitations — not human admins unless you include them. Local time uses the organization IANA timezone and wraps midnight the same way invitation curfew does.

When it is enforced

Evaluated when someone opens a door or gate or triggers an entity action. If this policy applies, the open is denied even when roles and grants would otherwise allow it.

Where to set it

Settings → Policies (org) or the integration Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Shared row fieldsenforcement (enforce, require_approval,audit_only) and enabled apply to every type;audit_only and disabled rows never block.

Name	Type	Required	Values	Description
start	string	Yes	HH:MM	Inclusive start of the window as local `HH:MM` (00:00–23:59). May be later than end (midnight-wrapping, for example 22:30→06:00).
end	string	Yes	HH:MM	Inclusive end of the window as local `HH:MM`. At 06:00 the minute 06:00 is blocked and 06:01 is not.
applies_to	string or string[]	No	agentapi_keyinvitationmemberresidentadminall	Principal kinds this row binds. Closed set: agent, api_key, invitation, member, resident, admin, all. Unknown strings and empty arrays are rejected. `all` matches every kind. When omitted, the type-specific default applies (see Default). Device-tier rows without `applies_to` often bind everyone, including admins. Default: agent, api_key, invitation
output	string or integer	No	—	Optional channel or output id. When set, the policy binds only that output. When omitted, it binds every output of the tier target. A scoped row does not apply when the acting output is unknown.

How overlapping rows combine

Any applicable enforcing row that binds the current principal kind denies the open. Disabled and audit_only rows never block.

Example

An agent or API key cannot open the lobby door at 02:00. A signed-in admin still can, unless applies_to includes admin.

config

{
  "start": "22:00",
  "end": "06:00",
  "applies_to": [
    "agent",
    "api_key",
    "invitation"
  ]
}

Integrations

This type is documented on these connectors:

• Home Assistant (home_assistant)
• KNX (knx)
• MQTT (mqtt)
• PalGate Cloud (palgate_cloud)
• Shelly Cloud (shelly_cloud)
• Shelly Websocket (shelly_websocket)
• Tasmota (tasmota)
• Virtual Access (virtual_access)
• Virtual Demo Devices (virtual_demo)
• Waveshare (waveshare)

Related

• Policy catalog
• Policies architecture guide
• Invitation curfew (invitation_curfew)
• Rate limit (rate_limit)
• Emergency lockdown (emergency_lockdown)
• Require step-up (require_step_up)

Typed configuration

The OpenAPI contract names this object QuietHoursPolicyConfig:

{
  "start": "22:00",
  "end": "06:00",
  "applies_to": ["agent", "api_key", "invitation"],
  "output": "main"
}

start and end are inclusive organization-local HH:MM values. A later end wraps midnight. applies_to and output are optional; omit them to use the policy defaults and target every output of the tier.