Access Points
What This Page Covers
This page explains how the Access Control Capability organizes physical locks and readers into a logical access model. It describes access points — the independently manageable units of a access control system — and how they bind to physical hardware.
The Logical Model
The Access Control Capability does not interact with locks and readers directly. Instead, it introduces a logical model on top of the normalized device layer:
Access Control (virtual device)
└── Access Point (logical entry point)
├── Actuator (bound to a lock or relay)
├── Authenticators (bound to keypads, readers, scanners)
└── Optional Cameras (bound to security cameras)
Physical devices — smart locks, keypads, card readers, fingerprint scanners — exist in the device tree as normalized devices with ClusterEndpoints and Attributes. An access point does not bind to the raw physical device. It references specific device endpoints by UUID — the lock that will open, the keypad where users enter PINs, the card reader that validates badges. The access point holds the access policies and the binding configuration. Credentials and profiles hold the time-based policies that grant access.
This separation means that the same lock can be reconfigured with different authenticators, that access policies can change without replacing hardware, and that any lock or reader supported by the platform can serve as an access point component regardless of its protocol.
Access Points
What an Access Point Is
An access point is an independently configurable entry point within an access control system. A deployment can have one access point covering a single door, or many access points across multiple doors, rooms, and buildings within the same system. For example:
- a single front-door access point with a keypad and card reader;
- separate access points for exterior doors (perimeter) and interior offices;
- separate access points for different floors, buildings or tenant units;
- a building entrance with a main keypad plus emergency bypass access.
Each access point is configured and managed independently. Adding or removing an authenticator from one access point does not affect others.
Access Point Components
Each access point has three types of components:
| Component | Purpose | Count | Required |
|---|---|---|---|
| Actuator | The physical device that performs the unlock (lock or relay) | Exactly 1 | Yes |
| Authenticators | Physical devices where users present credentials (keypads, card readers, scanners) | 1 or more | Yes |
| Cameras | Optional security cameras for recording access events | 0 or more | No |
Actuators
An actuator is the physical device that performs the unlock action. Two types are supported:
| Actuator Type | How It Works | Use Case |
|---|---|---|
| Door Lock | Smart lock with built-in electronic latch control | Entry doors, office doors, secured cabinets |
| Relay | Electrical relay controlling a mechanical lock or access control device | Existing electric strikes, remote access gates, legacy lock systems |
When configuring an access point with a Door Lock actuator, the lock's built-in keypad must be listed as one of the authenticators. This ensures that the lock can validate credentials locally even if cloud connectivity is intermittent.
Authenticators
An authenticator is a physical device where a user presents a credential to gain access. Three types are supported, and an access point can have multiple authenticators:
| Authenticator Type | Credential Type | How It Works |
|---|---|---|
| Keypad | PIN | User enters a numeric code; the keypad validates it locally |
| Card/NFC Reader | NFC | User presents a card or tag; the reader validates the device ID |
| Fingerprint Scanner | FINGERPRINT | User presents their finger; the scanner validates the biometric match |
When multiple authenticators are present on the same access point (e.g., a keypad and card reader on the same door):
- Any authenticator can validate the credential for that access point
- All authenticators must recognize the same credential
- If a user presents their card at the card reader OR their PIN at the keypad, both grant the same access
Camera Linking
Access points can optionally link to security cameras to record access events and provide video evidence of who accessed the door and when.
| Feature | Behavior |
|---|---|
| Event Recording | When an access event occurs, the platform records the timestamp and associated camera link |
| Clip Retrieval | Administrators can fetch video clips from the linked camera around the event timestamp |
| Multiple Cameras | An access point can link to multiple cameras (e.g., entrance and interior angles) |
Access Point State
At runtime, each access point carries the following state:
| Field | Description |
|---|---|
name | Display name of the access point |
actuatorUuid | UUID of the assigned lock or relay device |
authenticatorUuids | List of UUIDs for all assigned keypads, readers, and scanners |
cameraUuids | List of UUIDs for optionally linked cameras |
maxUsers | Maximum number of active user credentials allowed on this access point |
maxSchedules | Maximum number of concurrent access profiles allowed on this access point |
maxScheduleCommandSlots | Total weekly schedule slots available across all profiles |
Access Point Configuration
Capacity Limits
Each access point has capacity metrics that reflect the hardware limits of its authenticators:
| Limit | Meaning | What happens when exceeded |
|---|---|---|
maxUsers | Maximum active credentials | New credential assignments are blocked with a capacity error |
maxSchedules | Maximum concurrent access profiles | New profiles cannot be assigned to this access point |
maxScheduleCommandSlots | Total weekly schedule command slots | Complex schedules that exceed the slot count are rejected |
These limits ensure that the authenticators can be provisioned correctly and that the system respects hardware constraints.
Supported Device Types
Before an access point can be created, the system must identify which devices on the network can serve as actuators, authenticators, or cameras. The system classifies devices based on their capabilities:
Actuators — Devices with lock/relay control capability:
- Smart locks with electronic latch
- Relay modules for electric strikes
- Access control relays
Authenticators — Devices with credential validation capability:
- Keypads (PIN entry)
- Card/NFC readers (proximity authentication)
- Fingerprint scanners (biometric authentication)
Cameras — Devices with video capture capability:
- IP cameras with RTSP/RTMP/HTTP streaming
- Integrated camera modules
The system flags each candidate device as assignable or already-in-use depending on whether another access point has already claimed it.
Managing Access Points
Creating an Access Point
To create an access point, you need to:
- Identify or install the physical devices (lock, keypads, optional camera)
- Ensure all devices are registered and appear in the normalized device tree
- Create the access point configuration by specifying:
- A name for the access point (e.g., "Front Door")
- The UUID of the lock or relay (actuator)
- The UUIDs of all keypads, readers, scanners (authenticators)
- Optional UUIDs of linked security cameras
Updating an Access Point
Access point configuration can be changed:
- Rename — Update the display name
- Change authenticators — Add a new keypad, remove a card reader, etc.
- Link/unlink cameras — Associate or disassociate security cameras
- Change actuator — Replace the lock or relay (rare, requires all profiles to be deprovisioned)
When authenticators are changed:
- All currently active access profiles are re-provisioned to the new authenticator list
- If a profile is removed from an access point but still assigned elsewhere, it remains active
- The authenticators report their provisioning status back to the cloud
Deleting an Access Point
An access point can be deleted if:
- All assigned access profiles are deactivated (no active access grants)
- OR the deletion is forced (which deactivates all profiles)
Deleting an access point removes all access grants through that door but does not delete the underlying physical devices. The lock remains operational; only the access control configuration is removed.
Multiple Authenticators: Practical Implications
When an access point has multiple authenticators:
- Redundant access: If one authenticator fails, users can still access via another (e.g., if the keypad breaks, the card reader still works)
- Choice of method: Users can present credentials in different ways — some use PIN, others prefer card
- Simultaneous provisioning: All authenticators must have the same set of valid credentials
- Fallback paths: Users have multiple ways to authenticate to the same door
Where to Continue
| Goal | Page |
|---|---|
| Learn how credentials and access profiles work | Credentials and Profiles |
| Understand role-based access and audit logging | Roles, Permissions & Audit |
| Return to the Access Control overview | Access Control Overview |