Professional Documents
Culture Documents
Lenel OpenAccessUserGuide
Lenel OpenAccessUserGuide
5
OpenAccess User Guide
Lenel® OnGuard® 7.5 OpenAccess User Guide
This guide is item number DOC-1057-EN-US, revision 9.058, November 2018.
© 2018 United Technologies Corporation. All rights reserved.
Lenel®, OnGuard®, Prism®, BlueDiamond™, and UltraView® are registered trademarks or trademarks of
UTC Fire & Security Americas Corporation, Inc. Lenel is a part of UTC Climate, Controls & Security, a unit
of United Technologies Corporation.
All trademarks are the property of their respective owners.
Information in this document is subject to change without notice. No part of this document may be reproduced
or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the prior
express written permission of UTC Fire & Security Americas Corporation, Inc., which such permission may
have been granted in a separate agreement (i.e., end user license agreement or software license agreement for
the particular application).
Non-English versions of Lenel documents are offered as a service to our global audiences. We have attempted
to provide an accurate translation of the text, but the official text is the English text, and any differences in the
translation are not binding and have no legal effect.
The software described in this document is furnished under a license agreement and may only be used in
accordance with the terms of that agreement.
Crystal Reports for Windows is a trademark of Business Objects, S.A.
Integral and FlashPoint are trademarks of Integral Technologies, Inc.
Portions of this product were created using LEADTOOLS ©1991-2011, LEAD Technologies, Inc. ALL
RIGHTS RESERVED.
Active Directory, Microsoft, SQL Server, Windows, and Windows Server are either registered trademarks or
trademarks of Microsoft Corporation in the United States and/or other countries.
Oracle is a registered trademark of Oracle International Corporation.
Other product names mentioned may be trademarks or registered trademarks of their respective companies
and are hereby acknowledged.
LENEL DOES NOT REPRESENT THAT SOFTWARE, HARDWARE OR RELATED SERVICES MAY
NOT BE HACKED, COMPROMISED AND/OR CIRCUMVENTED. LENEL DOES NOT WARRANT
THAT SOFTWARE, HARDWARE OR RELATED SERVICES WILL WORK PROPERLY IN ALL
ENVIRONMENTS AND APPLICATIONS AND DOES NOT WARRANT ANY SOFTWARE,
HARDWARE OR RELATED SERVICES AGAINST HARMFUL ELECTROMAGNETIC
INTERFERENCE INDUCTION OR RADIATION (EMI, RFI, ETC.) EMITTED FROM EXTERNAL
SOURCES. THE ABILITY OF SOFTWARE, HARDWARE AND RELATED SERVICES TO WORK
PROPERLY DEPENDS ON A NUMBER OF PRODUCTS AND SERVICES MADE AVAILABLE BY
THIRD PARTIES OVER WHICH LENEL HAS NO CONTROL INCLUDING, BUT NOT LIMITED TO,
INTERNET, CELLULAR AND LANDLINE CONNECTIVITY; MOBILE DEVICE AND RELATED
OPERATING SYSTEM COMPATABILITY; OR PROPER INSTALLATION, CONFIGURATION AND
MAINTENANCE OF AUTHORIZED HARDWARE AND OTHER SOFTWARE.
LENEL MAY MAKE CERTAIN BIOMETRIC CAPABILITIES (E.G., FINGERPRINT, VOICE PRINT,
FACIAL RECOGNITION, ETC.), DATA RECORDING CAPABILITIES (E.G., VOICE RECORDING),
AND/OR DATA/INFORMATION RECOGNITION AND TRANSLATION CAPABILITIES AVAILABLE
IN PRODUCTS LENEL MANUFACTURES AND/OR RESELLS. LENEL DOES NOT CONTROL THE
CONDITIONS AND METHODS OF USE OF PRODUCTS IT MANUFACTURES AND/OR RESELLS.
THE END-USER AND/OR INSTALLER AND/OR RESELLER/DISTRIBUTOR ACT AS CONTROLLER
OF THE DATA RESULTING FROM USE OF THESE PRODUCTS, INCLUDING ANY RESULTING
PERSONALLY IDENTIFIABLE INFORMATION OR PRIVATE DATA, AND ARE SOLELY
RESPONSIBLE TO ENSURE THAT ANY PARTICULAR INSTALLATION AND USE OF PRODUCTS
COMPLY WITH ALL APPLICABLE PRIVACY AND OTHER LAWS, INCLUDING ANY
REQUIREMENT TO OBTAIN CONSENT. THE CAPABILITY OR USE OF ANY PRODUCTS
MANUFACTURED OR SOLD BY LENEL TO RECORD CONSENT SHALL NOT BE SUBSTITUTED
FOR THE CONTROLLER'S OBLIGATION TO INDEPENDENTLY DETERMINE WHETHER CONSENT
IS REQUIRED, NOR SHALL SUCH CAPABILITY OR USE SHIFT ANY OBLIGATION TO OBTAIN
ANY REQUIRED CONSENT TO LENEL.
Product Warnings and Disclaimers
THESE PRODUCTS ARE INTENDED FOR SALE TO, AND INSTALLATION BY, AN EXPERIENCED
SECURITY PROFESSIONAL. UTC FIRE & SECURITY CANNOT PROVIDE ANY ASSURANCE THAT
ANY PERSON OR ENTITY BUYING ITS PRODUCTS, INCLUDING ANY "AUTHORIZED DEALER",
IS PROPERLY TRAINED OR EXPERIENCED TO CORRECTLY INSTALL SECURITY RELATED
PRODUCTS.
For more information on warranty disclaimers and product safety information, please check https://
www.utcfssecurityproducts.eu/productwarning/ or scan the following code:
Table of Contents
CHAPTER 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Expectations and Behaviors of OpenAccess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Confirming the Installed Version of OnGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Stopping and Restarting the Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
User-Defined Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
OpenAccess and Brute Force Attack Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Using OpenAccess to Issue Mobile Badges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Authenticated Token and Inactivity Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
OpenAccess Custom Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Caching Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Badge Printing Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Queuing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Job Runner/Thread Pool Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Timeout Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Event Context Provider Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Definitions, Acronyms, Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
OpenAccess Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
References and Applicable Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Deploying the LS Event Context Provider Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Enabling Verbose Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Starting the OpenAccess Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Sample Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Sample Web Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Sample C# Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Sample Java Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Swagger Specification and Interactive Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Using Response Headers to Develop Secure Web Applications . . . . . . . . . . . . . . . . . . . . . . . . . . 29
get session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
get identity_provider_url . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Receive Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
get event_subscriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
get event_subscriptions with id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
add event_subscriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
modify event_subscriptions with id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
delete event_subscriptions with id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Manage Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65
get logged_events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
get types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
get type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
get count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
get instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
get print request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
add print request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
delete print request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
get badge mobile_devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
add badge issue_mobile_credential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
get badge printers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
add instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
modify instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
bulk modify instance property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
delete instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
execute_method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
get cardholders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
get video_recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
get auth_data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
get logged_in_user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
get managed_access_levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
add managed_access_levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
delete managed_access_levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
get user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
modify user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
put user password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
get managers_of_access_level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
get editable_segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
get user segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
add user segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
delete user segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
get user preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
put user preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
post user preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
delete user preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Cardholders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
get cardholder_from_directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
get directory_accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
get directory_accounts_matching_cardholders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
put update_cardholder_with_directory_account_property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
post console cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
delete console cards with id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Lnl_AccessLevelManaged . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Lnl_AccessLevelReaderAssignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Lnl_AccessRequest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Lnl_AccessLevelRequest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Lnl_Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
Lnl_AlarmAckHistory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
Lnl_AlarmDefinition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Lnl_AlarmInput . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Lnl_AlarmOutput . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Lnl_AlarmPanel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Lnl_Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Lnl_AuthenticationMode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Lnl_Badge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Lnl_BadgeFIPS201 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Lnl_BadgeLastLocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Lnl_BadgeStatus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Lnl_BadgeType . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Lnl_Camera . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Lnl_CameraDeviceLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Lnl_CameraGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Lnl_CameraGroupCameraLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Lnl_Cardholder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Lnl_DeviceGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Lnl_Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Lnl_Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Lnl_ElevatorTerminal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Lnl_EventAlarmDefinitionLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Lnl_EventParameter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Lnl_EventSubtypeDefinition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Lnl_EventSubtypeParameterLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Lnl_EventType . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Lnl_GuardTour . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Lnl_Holiday . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Lnl_HolidayType . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Lnl_HolidayTypeLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Lnl_IncomingEvent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Lnl_Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Lnl_IntrusionArea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Lnl_IntrusionDoor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Lnl_IntrusionOutput . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Lnl_IntrusionZone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Lnl_LoggedEvent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Lnl_LogicalDevice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Lnl_LogicalSource . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Lnl_LogicalSubDevice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Lnl_MonitoringZone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Lnl_MonitoringZoneCameraLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Lnl_MonitoringZoneDeviceLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Lnl_MonitoringZoneRecorderLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Lnl_MultimediaObject . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Lnl_OffBoardRelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Lnl_OnBoardRelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Lnl_Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Lnl_Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Lnl_Person . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Lnl_PersonSecondarySegments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Lnl_PrecisionAccessGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Lnl_PrecisionAccessGroupAssignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Lnl_ProhibitedPassword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Lnl_PTZPreset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Lnl_Reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Lnl_ReaderInput . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Lnl_ReaderInput1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Lnl_ReaderInput2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Lnl_ReaderOutput . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Lnl_ReaderOutput1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Lnl_ReaderOutput2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Lnl_ReaderRequest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Lnl_Segment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Lnl_SegmentGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Lnl_SegmentUnit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Lnl_Timezone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Lnl_TimezoneInterval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Lnl_User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Lnl_UserAccount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Lnl_UserPermissionGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Lnl_UserFieldPermissionGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Lnl_UserPermissionDeviceGroupLink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Lnl_UserReportPermissionGroup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Lnl_UserSecondarySegment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Lnl_VideoLayout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Lnl_VideoLayoutSource . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Lnl_VideoTemplate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Lnl_Visit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Lnl_VisitEmailRecipient . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Lnl_VisitEvent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Lnl_Visitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Lnl_VisitDelegateAssignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Lnl_VisitSignInLocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Lnl_Workstation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Lnl_WorldTimezone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
User-Defined Value Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Association Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Lnl_AccessLevelGroupAssignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Lnl_BadgeOwner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Lnl_CardholderAccount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Lnl_CardholderBadge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Lnl_CardholderMultimediaObject . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Lnl_DirectoryAccount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Lnl_MultimediaObjectOwner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Lnl_PersonAccount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Lnl_ReaderEntersArea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Lnl_ReaderExitsArea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Lnl_SegmentGroupMember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Lnl_VisitorAccount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Lnl_VisitorBadge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Lnl_VisitorMultimediaObject . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
This document provides information about the LS OpenAccess service that can be used to manage
OnGuard and to integrate it with external systems such as IT systems. The LS OpenAccess service is
the API into OnGuard, and provides access to ID management data, hardware events, software
events, and access control events when changes are made to cardholders and their credentials.
The REST proxy that is part of the LS OpenAccess service allows you to create a client against a
REST API to OnGuard through NGINX as the web service which abstracts the Advanced Message
Queuing Protocol (AMQP) language. The LS Web Service is the service hosting NGINX.
OpenAccess requires the LS Message Broker service, and Secure Socket Layer (SSL) must be
enabled. The client uses the REST proxy to communicate with the LS OpenAccess service.
Note: If using OpenAccess or Enterprise in a cluster environment and using the default
installed certificates, the certificates might need to be reissued on the machine running
the LS Message Broker service. For instructions, refer to “Manually Issue an SSL
Certificate” in the NEC ExpressCluster X R3 Installation Guide or the Using Microsoft
Cluster Services with OnGuard guide. Also refer to the “OnGuard and the Use of
Certificates” appendix in the OnGuard Installation Guide.
The OpenAccess Tool is also installed with the LS OpenAccess service for troubleshooting purposes,
and is a client to the LS OpenAccess service. These services and the tool are applications that are
installed on the servers.
The following are some common scenarios where OpenAccess can integrate OnGuard with IT
systems:
Notes: OpenAccess is not intended to perform large batch processing tasks. If performing batch
processing, you will achieve improved performance by using the DataExchange Server
instead of OpenAccess.
There are some minor differences in behaviors between OpenAccess and legacy thick
clients such as Alarm Monitoring and System Administration. For more information,
refer to Expectations and Behaviors of OpenAccess on page 12.
• When a cardholder is created, the IT department creates a Windows account for that person. The
Windows account name is derived from the OnGuard cardholder name. The account is linked to
the cardholder in the OnGuard software.
• A single script creates an LDAP account, a cardholder, a badge for this cardholder (with a badge
type, assigning default access levels), and a link between the account and this cardholder.
• A single script terminates a person’s access to all company resources by disabling all of the
person’s badge(s) and LDAP accounts.
• When a cardholder is granted access to an area, that cardholder is granted access to use the
computers in that area.
• A cardholder enters the building under duress. The cardholder’s LDAP accounts are disabled to
prevent potential unauthorized use.
• A cardholder’s phone number changes in the OnGuard software. The new phone number is
propagated to the associated Windows account in the company’s Active Directory.
Administrators can also write scripts and applications that interact only with the OnGuard software.
Examples include command line tools that automate frequent administrative tasks and web user
interfaces that provide thin-client access to ID management data.
Authorization
All functionality available through OpenAccess is controlled by the same permissions that you are
already using to manage data in the OnGuard software. For example, if you want to add a cardholder
through OpenAccess, you must have the Add Cardholder user permission. If you want to view
readers through OpenAccess, you must have the View Reader user permission.
OpenAccess caches user credentials and segments for 1 minute by default. This is done for
performance reasons. Therefore, if a user is using an application built on the OpenAccess platform
and that user’s permissions or segments change, the user will continue to have his old permissions
until the 1-minute timeout is reached.
The Event Context Provider service, which is responsible for sending events matching event
subscriptions, caches user credentials and segments for 15 minutes by default. OnGuard Monitor
requires the Event Context Provider service.
User-Defined Fields
The user-defined field schema is updated every 10 minutes. If a user changes, adds, or deletes a
property using FormsDesigner, it will take up to 10 minutes for the change to appear in the LS
OpenAccess service. For more information, refer to User-Defined Fields on page 34.
Note: If the selected value cannot be parsed, the default value is used. If the property supports
a range and the value specified is below the supported minimum value, the minimum
value is used. Similarly, if the value specified is above the supported maximum value,
the maximum value is used
Authentication
Caching Properties
Note: Changing the caching properties to be more frequent than the default values will
negatively affect performance. It is recommended to not modify the caching properties.
Queuing
Timeout Settings
Client
A script or application that uses OpenAccess.
JSON
JavaScript Object Notation.
Object/Instance
A representation of a particular class with actual data.
Person
A cardholder or visitor.
SDK
Software Development Kit.
OpenAccess Architecture
OpenAccess Architecture
The LS Communication Server service publishes an event to the LS Event Context Provider service,
which provides additional detail about the event. If the subscriber is using the LS Web Event Bridge,
this service will begin publishing events to the client via WebSocket. For example, if the LS
Communication Server service publishes an Access Granted event, the LS Event Context Provider
service adds cardholder details. The event, with the added detail, is provided to the AMQP queue for
each subscriber that has permission to receive information about the event. If the subscriber is using
the LS Web Event Bridge, this service will publish events to the client via WebSocket.
The LS OpenAccess Service includes both the OpenAccess Service and REST Proxy. The LS
Message Broker service provides the AMQP protocol. The LS Web Service (NGINX) exposes
endpoints for each web service.
Note: Each subscriber has its own queue on the LS Message Broker service. This is done for
security purposes, allowing subscribers to see only the event information they are
authorized to see.
This section provides details about procedures that must be performed before using the LS
OpenAccess service, including:
• License for OpenAccess on page 21
• Starting OpenAccess on page 22
• Stopping and Restarting the Services on page 22
• LS OpenAccess Service on page 23
• Authorization on page 23
• Authentication on page 24
• Deploying the LS Event Context Provider Service on page 24
• Enabling Verbose Logging on page 24
• Starting the OpenAccess Tool on page 25
• Sample Applications on page 25
Starting OpenAccess
The LS OpenAccess service requires the LS Message Broker Service, and Secure Socket Layer (SSL)
must be enabled. The LS Message Broker service is deployed with OnGuard servers automatically.
For information on configuring the LS Message Broker Service, refer to the System Options Folder
chapter in the System Administration User Guide.
1. Confirm that the LS Message Broker service is running on the workstation identified on the
System Administration > System Options form.
2. Confirm that the LS OpenAccess service is running on the workstation identified on the System
Administration > System Options form.
Note: Both the LS Message Broker service location and the LS OpenAccess service location
configured on the System Administration > System Options form must match the
deployed certificate name perfectly, or SSL/TLS errors will result. For more
information, refer to SSL/TLS Secure Channel Errors on page 267.
3. Confirm that the LS Web Service is running.
4. Confirm that the LS Event Context Provider service is running.
Note: The LS Event Context Provider service must run on the same host as the LS
OpenAccess service.
5. Confirm that the LS Web Event Bridge service is running.
Note: By default, the LS Web Event Bridge service is configured to locate LS OpenAccess on
the same server. If you installed the LS Web Event Bridge service on a different server
than the LS OpenAccess service, open the
Lnl.OG.WebEventBridgeService.exe.config file and edit the proxy to the Fully
Qualified Domain Name (FQDN) of the server running LS OpenAccess.
For more information, refer to OpenAccess Architecture on page 19.
LS OpenAccess can also be run as an application. For troubleshooting purposes, select Start > All
Programs > OnGuard > Service and Support > OpenAccess.
• LS OpenAccess service
• LS Web Event Bridge
• LS Event Context Provider service
LS OpenAccess Service
REST service provider URL: <protocol>://<host>:8080/api/access/onguard/openaccess
The REST proxy that is part of the LS OpenAccess service interprets web requests intended for
OpenAccess, and allows web clients to interface with the LS OpenAccess service. The LS
OpenAccess service uses NGINX as the web service.
For information on how to format the “REST Request URL” proxy calls for each method, refer to
Chapter 4: REST API Reference on page 43.
For some methods, “REST Request Body Contents” is also provided if a response is expected. The
body is a JavaScript Object Notation (JSON) representation of the key-value pairs for each method.
Authorization
All functionality available through OpenAccess is controlled by the same permissions that you are
already using to manage data in ID CredentialCenter. For example, if you want to add a cardholder
through OpenAccess, you must have the Add Cardholder user permission. If you want to view
readers through OpenAccess, you must have the View Reader user permission.
Notes: OpenAccess caches user credentials and segments for 1 minute by default. This is done
for performance reasons. Therefore, if a user is using OpenAccess and that user’s
permissions or segments change, the user will continue to have his old permissions until
the 1-minute timeout is reached.
The Event Context Provider service, which is responsible for sending events matching
event subscriptions, caches user credentials and segments for 15 minutes by default.
Authentication
Authentication to the LS OpenAccess service uses the OnGuard internal account or manual Single
Sign-On (SSO) only. This differs from DataConduIT, which uses automatic SSO only. For more
information, refer to the Single Sign-On section of the Installation Guide.
Most OpenAccess calls require authentication prior to the calls, except for:
• get directories (See get directories, on page 50 for details.)
• get version (See get version, on page 44 for details.)
Call add authentication to perform the authentication to the service. By default, the authentication
token expires 8 hours after it was created. For more information, refer to Cross-Origin Resource
Sharing on page 40.
Note: The Event Generator is another useful troubleshooting tool. Use Event Generator to
create “fake” events that can be received by event subscribers. For more information,
refer to Appendix A: Event Generator on page 273.
To enable Verbose Logging:
1. Launch the Configuration Editor by selecting Start > All Programs > OnGuard > Service and
Support > Configuration Editor.
2. Select Show advanced settings.
Note: You do not need to restart the LS OpenAccess service after enabling Verbose Logging.
By default, the OpenAccess.log file is located in C:\ProgramData\Lnl\logs. Disable Verbose
Logging when finished troubleshooting to prevent the log file from growing too large.
Note: To run the OpenAccess Tool, you will be prompted to enter a valid Application ID.
Contact Lenel Technical Support if you do not have an Application ID.
Sample Applications
Sample applications that demonstrate how to use the OpenAccess API are located in <OnGuard
installation directory>\doc\en-US\OpenAccess Samples.
Notes: If developing your own application, using WebSockets as the transport improves
performance. To do this, target .NET Framework 4.6.1 or later instead of .NET
Framework 4.0, as shown in this sample application. WebSockets also requires
Windows 8 or later, or Windows 2012 or later.
When the LS Web Event Bridge service is restarted, it loses subscription details for all
existing clients. Therefore, clients must re-subscribe to continue receiving events. New
transient subscriptions must be created, but durable subscriptions can be re-established
with the ModifySubscription call (ModifySubscription on page 137).
The sample clients do not listen for connection lost events. If the SignalR connection to
the LS Web Event Bridge is lost, the client can modify or create a new subscription via
the Web Event Bridge API to restore the SignalR connection and the flow of events.
This limitation does not exist when using WebSockets. For more information, refer to
Chapter 5: Event API Reference on page 135.
Sample C# Applications
The following table lists the sample C# applications:
Notes: If developing your own application, using WebSockets as the transport improves
performance. To do this, target .NET Framework 4.6.1 or later instead of .NET
Framework 4.0, as shown in this sample application. WebSockets also requires
Windows 8 or later, or Windows 2012 or later.
When the LS Web Event Bridge service is restarted, it loses subscription details for all
existing clients. Therefore, clients must re-subscribe to continue receiving events. New
transient subscriptions must be created, but durable subscriptions can be re-established
with the ModifySubscription call (ModifySubscription on page 137).
If not using WebSockets, there is a limitation within SignalR where the client will not be
notified that the LS Web Event Bridge service has restarted. In this case, the client will
not know to re-subscribe. This limitation does not exist when using WebSockets.
Notes: The command `gradlew run` uses the JDK’s private JRE (probably C:\Program
Files\Java\jdk1.8.0_65\jre). Running the build output in build\distributions uses the
public JRE in the path (probably C:\Program Files\Java\jre1.8.0_65), as expected.
For more information about certificates, refer to the “OnGuard and the Use of
Certificates” appendix in the OnGuard Installation Guide.
Note: Depending on where OnGuard is installed, you might need to update the value of
$onguard_install_dir in C:\ProgramData\Lnl\nginx\conf\environment.conf. Restart
LS Web Service to pick up any NGINX configuration changes.
Notes: You must use double-quotes around string delimiters when filtering. Single-quotes will
result in a system.parse error.
You cannot search on some fields, such as encrypted text and password fields. If you
search on an encrypted text or password field, an error is shown. Refer to the
display_attributes response from get type on page 70 to determine if a field is
searchable.
If the \ or " characters are part of a name, those characters must be escaped in the
search string. For example, if the name to search for is Includes\Backslash, it
should be entered in the filter as Includes\\Backslash, and if the name is
Includes"Quote, it should be entered as Includes\"Quote.
Find all cardholders with either the last name is “Lake” or the first name is
“Lisa”
LastName = "Lake" OR FirstName = "Lisa"
For more information, refer to Chapter 6: Data and Association Class Reference on page 161.
Date/Time Format
Binary Format
When doing a get instances call, the REST proxy that is part of the LS OpenAccess service returns
binary properties (indicated as binary in Data Classes on page 161) as base64-encoded strings. When
doing an add or modify instance call for a type with binary data, OpenAccess expects the data as a
base64-encoded string (for example, iVBORw0KGgoAAAANSUhEUgAAAGIAAABUCAIAA…).
Binary data is returned to a client as a map with the following structure:
"content_type":"image/jpeg",
"data":"[base64 encoded string]"
Binary data (indicated as binary in Data Classes on page 161) is returned as raw bytes in the
OpenAccess Tool, not base64 encoded.
When sending data using the OpenAccess Tool, OpenAccess expects the data as a comma-separated
string of bytes (for example, 137, 80, 78, 71, 13, 10, 26, …).
String Format
All strings are expected in UTF-8 format.
Badges
Each badge instance has all of its UDFs exposed through OpenAccess. This includes system fields
such as badge ID (ID), badge type (TYPE), badge status (STATUS), and the internal ID
(BADGEKEY). All fields except for the internal ID, number of badge prints, last changed, and last
printed timestamps are available for read/write access subject to the validation described above.
The PIN code is exposed in a manner similar to the way it is done in ID CredentialCenter. You can set
the badge PIN code by setting the property during an add or modify operation. However, if you search
up a badge and attempt the read the PIN code, the property will always contain a null value.
A client will be able to assign access levels to a new badge by giving it a badge type. The new badge
will be assigned the default access levels for that badge type.
In a segmented system, the client cannot change the badge type if it controls a different set of
segments than the previous badge type. This is because changing the badge type of a badge could
possibly remove access levels from that badge without user confirmation.
Directory Accounts
Adding an instance of Lnl_Account is equivalent to linking a directory account to a cardholder or
visitor in ID CredentialCenter. Similarly, deleting an instance is equivalent to unlinking the account.
When adding an instance of Lnl_Account, all fields except for the ID are required. The AccountID
property refers to the value of the LDAP attribute. For Microsoft Active Directory accounts, this
defaults to the account security identifier, or SID. Other LDAP directories will probably use a
different LDAP attribute.
Visits
Each visit instance has all of its UDFs exposed through OpenAccess. This includes system fields such
as host id (CARDHOLDERID), type (TYPE), visitor id (VISITORID), and the internal ID (ID). All
fields except for the internal ID, last changed, time in, and time out are available for read/write access
subject to the validation described above.
Once a visit has been signed in, scheduled time in cannot be changed, nor can the cardholder or
visitor of the visit, same thing with signing out a visitor.
E-mail recipients configured through Lnl_Visit cannot be viewed through Lnl_Visit;
Lnl_VisitEmailRecipient must be used for viewing.
User-Defined Fields
The user-defined field schema is updated every 10 minutes. If a user changes, adds, or deletes a
property using FormsDesigner, it will take up to 10 minutes for the change to appear in the LS
OpenAccess service.
Notes: OpenAccess generates property names based on the field names shown in
FormsDesigner.
When provided via the object name of a User Defined Field (UDF) in FormsDesigner,
the display_name attribute is the user-friendly name of the item. For more information,
refer to get type on page 70. Also refer to the “Field Properties Folder – General
Settings Form” section in the FormsDesigner User Guide.
SegmentID
SEGMENTID only appears as a property in data classes that support segmentation when
segmentation for that class is enabled. For more information, refer to get segmentation settings on
page 131 and Lnl_Segment on page 227. Restarting the LS OpenAccess service is required when
making segmentation changes.
Receiving Events
Note: Because a durable subscriber’s events are stored while the subscriber is offline, you
should minimize offline time and delete durable subscribers that are no longer needed,
to avoid overwhelming the Message Broker.
• Transient (non-durable) event subscribers only receive events that occur while the subscriber is
online (for a process) or logged in (for a user). Events that occur when the subscriber is offline/
logged out are not sent. To continue receiving events and remain active, a transient subscriber
must send a modify event_subscriptions call every 24 hours.
Note: If either the LS Message Broker service or the LS Event Context Provider service is not
running, hardware and alarm acknowledgment events might not reach the client even if
those events are reported within Alarm Monitoring and are using a durable event
subscription.
If a subscriber fails to send a modify event_subscriptions call in the expected time frame (seven
days for a durable subscription, 24 hours for a transient subscription), the system will delete the
subscription and stop sending events. The LS Event Context Provider checks for and deletes expired
subscriptions every 10 minutes.
To learn more about event_subscriptions calls:
• See add event_subscriptions on page 60.
• See modify event_subscriptions with id on page 62.
• See delete event_subscriptions with id on page 64.
Note: Deleted subscriptions cannot be reinstated. Create a new subscription using the
event_subscriptions method.
Notes: OpenAccess will not return an error if you filter on a field that does not exist.
Also, you cannot filter software events using timestamp or object_id.
If the \ or " characters are part of a name, those characters must be escaped in the
search string. For example, if the name to search for is Includes\Backslash, it
should be entered in the filter as Includes\\Backslash, and if the name is
Includes"Quote, it should be entered as Includes\"Quote.
The following hardware and alarm acknowledgment event properties can only be specified in the
definition of the filter parameter for subscription API calls:
Note: The following table is for hardware and alarm acknowledgment events only. All
software events can be specified in the definition of the filter parameter for subscription
API calls. For more information, refer to Software Event Reference on page 153.
access_granted_entry_- Definition: See Properties for Access Granted Events on page 144.
made Type: Boolean
Example: access_granted_entry_made eq true
area_entering_id Definition: See Properties for Access Granted Events on page 144.
Type: 32-bit signed integer
Example: area_entering_id eq 3
area_entering_name Definition: See Properties for Access Granted Events on page 144.
Type: String
Example: area_entering_name eq ‘Default Area’
area_exiting_id Definition: See Properties for Access Granted Events on page 144.
Type: 32-bit signed integer
Example: area_exiting_id eq 3
area_exiting_name Definition: See Properties for Access Granted Events on page 144.
Type: String
Example: area_exiting_name eq ‘default area’
badge_extended_id Definition: The full Federal Agency Smart Credential Number (FASC-
N) or full UUID from a Personal Identity Verification (PIV)-based card
or other Federal Information Processing Standard (FIPS) 201-based
card.
Type: String; maximum length = 64 characters
Example: badge_extended_id eq
‘11112222333333456666666666788889’
badge_issue_code Definition: See Properties for Access Granted Events on page 144.
Type: 32-bit unsigned integer
Example: badge_issue_code eq 4
badge_key Definition: See Properties for Access Granted Events on page 144.
Type: 64-bit signed integer
Example: badge_key eq 1326
badge_key_str Definition: See Properties for Access Granted Events on page 144.
Type: String
Example: badge_key_str eq '1326'
badge_status_name Definition: See Properties for Access Granted Events on page 144.
Type: String
Example: badge_status_name eq ‘Active’
badge_type_name Definition: See Properties for Access Granted Events on page 144.
Type: String
Example: badge_type_name eq ‘Employee’
cardholder_key Definition: See Properties for Access Granted Events on page 144.
Type: 64-bit integer
Example: cardholder_key eq 636719
cardholder_last_name Definition: See Properties for Access Granted Events on page 144.
Type: String
Example: cardholder_last_name eq ‘Smith’
3. Add an entry for each HTTP origin that accesses the OpenAccess API. There are several
commented out examples in the config file (remove the "#" and then modify them as needed).
There is support for simple strings as well as regular expressions. Refer to http://nginx.org/en/
docs/http/ngx_http_map_module.html for more details about the NGINX map directive.
4. Save the file and restart the LS Web Service service.
Version
Every OpenAccess API call must include a version, with versions starting at “1.0” and incrementing
up from there. OpenAccess uses the version to maintain backward compatibility as the API is
updated.
Versions are formatted <major>.<minor>. Each API call is versioned independently. For example,
you can call get event_subscriptions (version = "1.0") and then call authenticate
(version = "2.7"). Versions with the same <major> components are compatible, but might
offer different optional features. For example, calling authenticate version 1.3 might offer a
fast=true property. This property might be ignored by version 1.0, but the basic authenticate
functionality is the same. Versions with different <major> components are not compatible. An API
version 2.0 call that contains API version 1.0 parameters will result in an error.
Note: This Brute Force Attack protection only applies to internal accounts. Directory accounts
are protected according to directory policies.
This section provides details about the LS OpenAccess service’s Application Programming Interface
(API).
The REST proxy that is part of the LS OpenAccess service allows you to create a client against a
REST API to OnGuard through NGINX as the web service which abstracts the AMQP language. The
LS Web Service is the service hosting NGINX. Use the REST Request URL and body contents
described below for each API call.
Notes: The errors you might receive in the response header are very helpful when creating a
client application that uses OpenAccess. Also, any request taking longer than 60
seconds to fulfill results in a timeout error. For more information, refer to Error
Messages on page 263.
You will receive an HTTP 200 code whenever an API call executes successfully.
API calls are handled asynchronously. It is the responsibility of the client to handle
synchronization as needed.
When creating Body content, this sample shows when to use quotation marks:
{
"some_string": "I am a string",
"some_number": 1000,
"some_bool": false
}
&version=1.0
When a request is queued in this way, OpenAccess will queue a task for execution and return a 202
(Accepted) HTTP status code and a response identical to GET /queue/{id}. For example:
{
"id": "5c4b7890-ee73-4199-b3d3-366003eb8ca1",
"status": "pending",
"version": "1.0"
}
The id property indicates the ID of the queued task, which can be used to check the status of the task:
GET /queue/5c4b7890-ee73-4199-b3d3-366003eb8ca1?version=1.0
When the task is complete, the response will include the response to the queued request:
{
"id": "5c4b7890-ee73-4199-b3d3-366003eb8ca1",
"response": {
...
},
"status": "complete",
"version": "1.0"
}
The response can be retrieved any number of times until the task is deleted. A completed task can be
deleted with DELETE /queue/{id} or it will be deleted automatically after 1 hour.
Even though you can queue any request, it is only recommended when a request is expected to run
long, like GET /directory_accounts and GET /
directory_accounts_matching_cardholders.
get version
Used to retrieve the OnGuard product name and version information.
REST Request URL: GET /api/access/onguard/openaccess/
version?version=value
get keepalive
Used to prevent idle session timeout.
REST Request URL: GET /api/access/onguard/openaccess/
keepalive?version=value
get keepalive
get feature_availability
Used to check if an OnGuard license feature is available.
REST Request URL: GET /api/access/onguard/openaccess/
feature_availability?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get feature_availability
get queue
Gets the queued tasks created by the user. This method is only intended to check the status of multiple
tasks. Request a specific task to get the response. Users can only view their own queued tasks.
REST Request URL: GET /api/access/onguard/openaccess/
queue?version=value
get queue
item_list list yes A list of queued tasks. Each task in the list
is provided with its unique ID and status.
get queue/{id}
Gets the queued task with the given ID, which includes the response when the task is complete. Users
can only view their own queued tasks.
REST Request URL: GET /api/access/onguard/openaccess/queue/
{id}?version=value
get queue/{id}
delete queue/{id}
Deletes the queued task with the given ID. All queued tasks will be deleted automatically after 1 hour
if not manually deleted. Only complete tasks can be deleted, and users can only delete their own
queued tasks.
REST Request URL: DELETE /api/access/onguard/openaccess/queue/
{id}?version=value
delete queue/{id}
add partner_values
Used by OnGuard software partners.
add partner_values
Session-Token string yes The authenticated token for the current user
session.
modify partner_values
Used by OnGuard software partners.
REST Request URL: PUT /api/access/onguard/openaccess/
partner_values?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
modify partner_values
Session-Token string yes The authenticated token for the current user
session.
get directories
Returns a list of directories configured within the OnGuard software. If using an internal account for
authentication, you can call add authentication without specifying a directory ID. It is generally
called prior to add authentication to get the user’s directory ID.
add authentication
Notes: The add authentication call returns a token to be used in all subsequent authorized calls.
For information about how OpenAccess protects against Brute Force Attacks, refer to
OpenAccess and Brute Force Attack Protection on page 13.
Note: The oidc_token name:value pair was introduced in Version 2.0 of the add
authentication call.
{
"user_name":"value",
"password":"value",
"directory_id":"value",
"oidc_token":"value"
}
add authentication
user_name string Required for Ver- 1.0 and The user's user name, in plain
sion 1.0. later text.
For Version 2.0
and later, not
required if using
oidc_token.
password string Required for Ver- 1.0 and The user's password, in plain
sion 1.0. later text.
For Version 2.0
and later, not
required if using
oidc_token.
oidc_token string Not available for 2.0 and An OpenID Connect access
Version 1.0. later token.
For Version 2.0 Introduced in Version 2.0 of the
and later, you must add authentication call.
provide either the
user_name and
password or the
oidc_token.
token_expira- datetime yes 1.0 and This represents the time when
tion_time (string) later the authenticated token will
expire, in UTC time. The client
should use this information to re-
authenticate as needed. For
example:
2016-10-
07T22:05:02+00:00
delete authentication
Logs a user out of the LS OpenAccess service by invalidating the token and removing the user from
its internal map.
REST Request URL: DELETE /api/access/onguard/openaccess/
authentication?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
delete authentication
get session
Retrieves session data for a session token.
REST Request URL: GET /api/access/onguard/openaccess/
session?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get session
token_ datetime yes The time the token will expire, in UTC time.
expiration_time (string) For example:
2016-10-07T22:05:02+00:00
token_start_time datetime yes The time the token was first issued, in UTC
(string) time. For example:
2016-10-07T22:05:02+00:00
get identity_provider_url
Gets the URL that users authenticating with a third-party OpenID Connect provider should be
directed to in their browsers.
REST Request URL: GET /api/access/onguard/openaccess/
identity_provider_url?version=value&directory_id=value&
redirect_url=value&response_mode=value
get identity_provider_url
response_mode string yes The mode the identity provider should use
to respond. Valid values are "form_post"
and "fragment". "form_post" causes the
identity provider to respond with an HTTP
POST to the redirect_url, with the content
in the message body. "fragment" will con-
tain the response in the redirect URL.
url string yes The URL to send the user to for authentica-
tion.
Receive Events
get event_subscriptions
Retrieves event subscriptions, and details about the subscriptions. Non-System Account (SA) users
can only retrieve their own event subscriptions.
REST Request URL: GET /api/access/onguard/openaccess/
event_subscriptions?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get event_subscriptions
get event_subscriptions
user_id string yes The ID of the user who owns the subscrip-
tion, as a string.
total_pages int32 yes The total number of pages, given the exist-
ing number of instances (total_items) and
the page_size being used.
message_bro- int32 yes The port of the message broker where the
ker_port events are published.
binding_key string yes The unique binding key with which events
will be published on the exchange.
created_date datetime yes The date and time when the subscription
(string) was created.
last_updated_ datetime yes The date and time when the subscription
date (string) was last updated.
user_id string yes The ID of the user who owns the subscrip-
tion, as a string.
message_bro- int32 yes The port of the message broker where the
ker_port events are published.
binding_key string yes The unique binding key with which events
will be published on the exchange.
created_date datetime yes The date and time when the subscription
(string) was created.
last_updated_ datetime yes The date and time when the subscription
date (string) was last updated.
add event_subscriptions
Adds an event subscription.
REST Request URL: POST /api/access/onguard/openaccess/
event_subscriptions?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
add event_subscriptions
user_id string yes The ID of the user who owns the subscrip-
tion, as a string.
message_bro- int32 yes The port of the message broker where the
ker_port events are published.
binding_key string yes The unique binding key with which events
will be published on the exchange.
created_date datetime yes The date and time when the subscription
(string) was created.
last_updated_ datetime yes The date and time when the subscription
date (string) was last updated.
user_id string yes The ID of the user who owns the subscrip-
tion, as a string.
message_bro- int32 yes The port of the message broker where the
ker_port events are published.
binding_key string yes The unique binding key with which events
will be published on the exchange.
created_date datetime yes The date and time when the subscription
(string) was created.
last_updated_ datetime yes The date and time when the subscription
date (string) was last updated.
Manage Instances
get logged_events
Retrieves a page of logged events from the OnGuard database.
REST Request URL: GET /api/access/onguard/openaccess/
logged_events?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get logged_events
filter string yes The clause text used to count only those
instances that match a given attribute.
For example, firstname="Lisa".
Note: You must use double-quotes
around string delimiters when
filtering. Single-quotes will result
in an InvalidQuery error.
OpenAccess does not support filtering with
the following properties:
• EVENT_SOURCE_NAME
• CARDHOLDER_FIRST_NAME
• CARDHOLDER_LAST_NAME
• DEVICE_NAME
• SUBDEVICE_NAME
• ACCESS_RESULT
• CARDHOLDER_ENTERED
• DURESS
• ALARM_ACK_BLUE_CHANNEL
• ALARM_ACK_GREEN_CHANNEL
• ALARM_ACK_RED_CHANNEL
• ALARM_BLUE_CHANNEL
• ALARM_GREEN_CHANNEL
• ALARM_RED_CHANNEL
For more information refer to Searching for
Objects on page 31.
get logged_events
alarm_ack_blue_ int32 yes The blue component of the RGB color for
channel the alarm after it is acknowledged (0 to
255).
alarm_ack_ int32 yes The green component of the RGB color for
green_channel the alarm after it is acknowledged (0 to
255).
alarm_ack_red_ int32 yes The red component of the RGB color for
channel the alarm after it is acknowledged (0 to
255).
alarm_blue_ int32 yes The blue component of the RGB color for
channel the alarm (0 to 255).
alarm_green_ int32 yes The green component of the RGB color for
channel the alarm (0 to 255).
alarm_red_ int32 yes The red component of the RGB color for
channel the alarm (0 to 255).
badge_ int32 yes Issue code of the card that caused the
issue_code event.
event_source_ string yes The name of the device at which the event
name occurred.
total_pages int32 yes The total number of pages, given the exist-
ing number of instances (total_items) and
the page_size being used.
get types
Retrieves a list of types available via the LS OpenAccess service.
REST Request URL: GET /api/access/onguard/openaccess/
types?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get types
total_items int32 yes The total number of types that are exposed
to the user and returned in the types map.
get type
Retrieves information for a specific type.
REST Request URL: GET /api/access/onguard/openaccess/
type?type_name=value&version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get type
type_name string yes The name of the type for which to retrieve
information.
properties list yes The properties of the type. See get type
response: properties list on page 71.
methods list yes The methods available for this type. See
get type response: methods map on
page 72.
max_length int32 only string proper- The maximum length of the string or binary
ties and some property.
binary properties
get count
Used to retrieve the number of existing instances of a given object type.
REST Request URL: GET /api/access/onguard/openaccess/
count?type_name=value&filter=value&version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get count
get instances
Retrieves instances of a particular type based on the client-supplied filter.
When using this call for types with binary properties (Lnl_MultimediaObject), the binary data is
returned base64 encoded.
REST Request URL: GET /api/access/onguard/openaccess/instances?
page_number=value&page_size=value&order_by=value&
type_name=value&filter=value&version=value
Note: Page_number and page_size are optional. The default page_number = 1, and the default
page_size = 20. Paging is always performed, and the maximum number of instances
(page_size) that can be retrieved with a single request is 100. To preserve system
performance such as when using multimedia objects, you might need to choose a page
size smaller than 100.
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get instances
Session-Token string yes The authentication token for the current user session.
type_name string yes The name of the type being added. For example,
Lnl_Cardholder.
get instances
Employee Michael,Mary,Shawn
Visitor Thomas,Ellen,Abe
If you query the base abstract type Lnl_Person, ordering by the Name property, the result would
return as:
Abe,Ellen,Thomas,Mary,Michael,Shawn
Use care when selecting which values you specify with your order_by, as the request might take too
long to fulfill. This is a problem if you order_by very large classes, such as Lnl_LoggedEvent
(Lnl_LoggedEvent on page 201), which might result in a timeout error. For more information, refer to
Error Messages on page 263.
In general, using the default order_by works well because key fields are optimized for performance
through the use of an index. If you order_by fields that are not indexed and are large classes,
performance might suffer.
When using order_by to specify that a field is sorted in descending order, add a minus character (“-”)
in front of the field name. Without the minus character, the field will be sorted in ascending order.
Also, different fields can be sorted differently. For example, to sort lastname in descending order and
firstname in ascending order:
GET /api/access/onguard/openaccess/
instances?page_number=1&page_size=20&
order_by=-lastname,firstname&type_name=Lnl_Cardholder&version=value
total_pages int32 yes The total number of pages, given the exist-
ing number of instances (total_items) and
the page_size being used.
Application-Id : value
Note: If you are using OpenAccess to issue mobile badges and are behind a network proxy, an
error might occur when issuing or managing mobile credentials. To resolve this error, on
the server where the LS OpenAccess service is running, change the logon account for
the LS OpenAccess service from Local System to a user whose account has the correct
proxy settings configured.
REST Request URL: GET /api/access/onguard/openaccess/badge/{badgekey}/
mobile_devices?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
Session-Token string yes The authentication token for the current user ses-
sion.
mobile_device_list list yes A list of mobile devices for the person associated
with the badge. See get badge mobile_devices
response: mobile_device_list properties on
page 81.
Note: If you are using OpenAccess to issue mobile badges and are behind a network proxy, an
error might occur when issuing or managing mobile credentials. To resolve this error, on
the server where the LS OpenAccess service is running, change the logon account for
the LS OpenAccess service from Local System to a user whose account has the correct
proxy settings configured.
REST Request URL: POST /api/access/onguard/openaccess/badge/
{badgekey}/issue_mobile_credential?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
Session-Token string yes The authentication token for the current user
session.
badgekey int32 yes The unique identifier of the badge for which a
mobile credential should be issued. For more
information, refer to Lnl_Badge on page 176.
mobile_device_ int32 yes The activation code to use for issuing a creden-
activation_code tial to the mobile device.
get badge_printers
Session-Token string yes The authentication token for the current user ses-
sion.
badge_type_id int32 no When not passed into the request, the API
returns all available printers for all badge types.
Represents the badge type id found in the Bad-
geType table.
printer_name string yes The printer name, or the network path to the
printer.
add instances
Adds instances of a particular type.
REST Request URL: POST /api/access/onguard/openaccess/
instances?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
add instances
type_name string yes The name of the type being added. For
example "Lnl_Cardholder".
type_name string yes The name of the type being added. For
example "Lnl_Cardholder".
modify instances
Modifies existing instances of a particular type.
REST Request URL: PUT /api/access/onguard/openaccess/
instances?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
modify instances
type_name string yes The name of the type being modified. For
example, "Lnl_Cardholder".
modify instances
type_name string yes The name of the type to modify. For exam-
ple, "Lnl_Cardholder".
delete instances
Deletes existing instances of a particular type.
REST Request URL: DELETE /api/access/onguard/openaccess/
instances?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
"property_name":value,
...
}
}
delete instances
type_name string yes The name of the type being deleted. For
example "Lnl_Cardholder".
execute_method
Executes a supported method against an existing instance of a particular type. For an example, refer
to Chapter 7: Using OpenAccess to Send Alarms to OnGuard on page 251.
REST Request URL: POST /api/access/onguard/openaccess/
execute_method?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
...
}
}
execute method
type_name string yes The name of the type being operated upon.
For example "Lnl_IncomingEvent”.
get cardholders
Performs an advanced cardholder search, optionally searching on badge fields. Returns instances that
match the search criteria. For more information, refer to Lnl_Cardholder on page 185.
get cardholders
get cardholders
Note: For more information about the order_by property, refer to Additional order_by Details
on page 75.
total_pages int32 yes The total number of pages, given the exist-
ing number of instances (total_items) and
the page_size being used.
get video_recorders
This method retrieves one page of the list of all video recorders configured in the OnGuard system.
Note: This method replaces the previously existing get instances call for the type
Lnl_VideoRecorder, which retrieved only Lenel NVR video recorders. This method
retrieves all recorders, regardless of type.
REST Request URL: GET /api/access/onguard/openaccess/
video_recorders?version=value
get video_recorders
http_port int32 yes The HTTP port configured for the Lenel
NVR web service.
https_port int32 yes The HTTPS port configured for the Lenel
NVR web service.
total_pages int32 yes The total number of pages, given the exist-
ing number of instances (total_items) and
the page_size being used.
get auth_data
This method retrieves the authentication token for a Lenel NVR. This token is used for authentication
and authorization against Lenel NVR Services. This method replaces the GetAuthenticationData
method of the Lnl_VideoRecorder type.
Note: In OnGuard 7.4, this method is supported for video recorders of type Lenel NVR only.
REST Request URL: GET /api/access/onguard/openaccess/video_recorder/
{id}/auth_data?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get auth_data
Users
get logged_in_user
Returns information pertaining to the authenticated user.
REST Request URL: GET /api/access/onguard/openaccess/
logged_in_user?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get logged_in_user
Session-Token string yes The authentication token for the current user ses-
sion.
password_ datetime yes The date and time that the password will expire.
expiration_time (string) This only exists if the user logged in with the
password expiration policy enabled.
ptz_priority int32 yes The PTZ priority level of the user. Since only one
person can control a PTZ camera at a time, a
user with higher priority can take over PTZ control
of a camera from someone who has lower priority.
SA users have a PTZ priority of 1000. Other users
are assigned values between 1 (low priority) and
255 (high priority). For more information, refer to
“Monitor Permission Groups: Permissions Sub-
tab Procedures” in the System Administration
User’s Guide.
get managed_access_levels
Returns a list of access levels a user can manage, and indicates if the user has Area Access Manager
view-only access.
id string yes ID of the user for whom you want the man-
aged access levels, as a string.
access_level_list list yes The list of access levels a user can man-
age. Each item in the list contains the id,
which is the ID of the access level associ-
ated with the user, and the name, which is
the name of the access level. The access
level filter and badge filter are combined,
so that the access level search is applied
only to those badges that match the badge
filter.
add managed_access_levels
Adds to the existing list of access levels a user can manage.
Notes: If adding any of the requested access levels fail, an error code is provided and none of
the requested access levels are added.
Access level management cannot be added to the SA user.
add managed_access_levels
access_level_list list yes A list of access level IDs the user can man-
age.
delete managed_access_levels
Deletes specific access levels from the access levels a user can manage.
REST Request URL: DELETE /api/access/onguard/openaccess/user/{id}/
managed_access_levels?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
delete managed_access_levels
access_level_list list yes A list of access level IDs the user cannot
manage.
get user
Gets the OnGuard-specific properties for a user.
REST Request URL: GET /api/access/onguard/openaccess/user/
{id}?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get user
id string yes ID of the user for whom you want the moni-
toring zone ID and monitoring zone name,
as a string.
last_ datetime yes The date and time of the user’s last suc-
successful_ cessful login.
login_time
modify user
Modifies the OnGuard-specific properties for a user.
REST Request URL: PUT /api/access/onguard/openaccess/user/
{id}?version=value&database_id=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
modify user
get managers_of_access_level
Gets a list of user IDs for users who can manage the access level.
Note: Users assigned “view-only” permission to an access level are not included in the list
returned from this call.
REST Request URL: GET /api/access/onguard/openaccess/
managers_of_access_level?access_level_id=value&version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get managers_of_access_level
user_id_list list yes List of user IDs for users who can manage
the access level.
get editable_segments
Gets a list of segments and segment groups for which the logged-in user has editable permission. For
more information, refer to Lnl_Segment on page 227.
Note: This call is not supported on non-segmented systems. Use the get segmentation call to
determine if your system supports segmentation (refer to get segmentation settings on
page 131).
REST Request URL: GET /api/access/onguard/openaccess/
editable_segments?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get editable_segments
Note: This call is not supported on non-segmented systems. Use the get segmentation call to
determine if your system supports segmentation. For more information, refer to get
segmentation settings on page 131.
REST Request URL: GET /api/access/onguard/openaccess/user/{id}/
segments?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
get user segments
Note: This call is not supported on non-segmented systems. Use the get segmentation call to
determine if your system supports segmentation. For more information, refer to get
segmentation settings on page 131.
REST Request URL: POST /api/access/onguard/openaccess/user/{id}/
segments?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
Note: This call is not supported on non-segmented systems. Use the get segmentation call to
determine if your system supports segmentation. For more information, refer to get
segmentation settings on page 131.
REST Request URL: DELETE /api/access/onguard/openaccess/user/{id}/
segments?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
preference_ json yes The data the user wants to save in json for-
settings mat. For example:
preference_settings :
{"Address":{"Operator":"LIKE",
"value":"NYC"}}
Cardholders
get cardholder_from_directory
This is an authenticated method that returns the internal ID, equivalent to Lnl_cardholder.ID, of a
cardholder in the system who has a linked directory account with the directory credentials that are
passed in as parameters. For more information, refer to Lnl_Cardholder on page 185.
get cardholder_from_directory
get directory_accounts
Gets directory accounts matching the provided filter.
Note: Depending on the Active Directory server configuration, number of users in the
directory, and uniqueness of the search criteria, this method might time out. Consider
using the queue parameter, which allows for an asynchronous response. For more
information, refer to Task queuing: dealing with long running requests on page 43, and
also refer to get queue on page 46.
REST Request URL: GET /api/access/onguard/openaccess/
directory_accounts
get directory_accounts
get directory_accounts
get directory_accounts_matching_cardholders
Gets directory accounts matching the given cardholders, based on the property pairs specified by the
filter.
REST Request URL: GET /api/access/onguard/openaccess/
directory_accounts_matching_cardholders
get directory_accounts_matching_cardholders
The returned parameters are a list of matching cardholders or non-matching cardholders. For
example:
name : type : required : description
put update_cardholder_with_directory_account_property
Updates the given cardholder with the given directory account property.
put update_cardholder_with_directory_account_property
Console
Application-Id : value
Settings
Note: You do not need to be logged in to make this call. A session-token and application-id are
not required.
If Logon authorization warning in System Administration is set to None, then the response to get
authorization_warning display_authorization_warning is set to false and
authorization_warning_options is not available.
Authorization_warning_options is a map which contains the values described in the Response table
below. One property in the map is font_properties, which is a map of properties specific to the
display font.
Some of the font properties are not directly selectable in the font dialog when setting up the font for
the authorization warning in System Administration. For example, escapement cannot be set directly.
Its value is based on other factors of the font selection. height is related to the font size selected, but
does not map to it exactly; it often comes back negative. weight changes based on whether bold is
selected or not. face_name is the name of the font selected. These properties come directly from the
MFC LOGFONT structure. The purpose is to give a web client application all of the font information,
and then let the client figure out how to convert this information to the appropriate HTML for the
client to show.
REST Request URL: GET /api/access/onguard/openaccess/settings/
authorization_warning?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
expiration_first_reminder_days int32 yes The first day to remind the user that
the password is almost expired.
expiration_first_ int32 no The first day to remind the user that the
reminder_days password is almost expired.
Default = 15
Minimum = expiration_reminder_days
Maximum = expiration_days
Note: For more information about segmentation settings, refer to “Segment Options Form” in
the System Administration User Guide.
REST Request URL: GET /api/access/onguard/openaccess/settings/
segmentation?version=value
Additional HTTP Headers:
Session-Token : value
Application-Id : value
For more information, refer to “Segment Options Form” in the System Administration User Guide.
default_visitor_ string yes The name of the default visitor badge type.
badge_type_name
Events can be received using the Web Event Bridge. The Web Event Bridge is a SignalR server
running at /api/access/onguard/openaccess/eventbridge, which provides a hub named “Outbound”.
Because the Web Event Bridge is a SignalR server, it is easiest to use one of the SignalR client APIs.
There are SignalR client APIs for C# and JavaScript, and there are sample event subscriber
applications provided for both. For help writing SignalR clients, refer to http://www.asp.net/signalr/
overview/guide-to-the-api/hubs-api-guide-net-client and http://www.asp.net/signalr/overview/guide-
to-the-api/hubs-api-guide-javascript-client.
CreateSubscription
Creates a subscription and starts receiving events using the OnBusinessEventReceived event
handler.
Method Signature
CreateSubscription(security : object, eventSubscription : object) : object
For a list of inputs and outputs, refer to add event_subscriptions on page 60.
Parameters
Return Value
The created event subscription.
ModifySubscription
Modifies a subscription and starts receiving events using the OnBusinessEventReceived event
handler.
Method Signature
ModifySubscription(security : object, eventSubscription : object) : object
Parameters
Return Value
The modified event subscription.
StopSubscription
Stops receiving events using the OnBusinessEventReceived event handler. Also deletes the
subscription if it is transient.
Method Signature
StopSubscription()
StartManaging
Starts receiving management messages using the OnManagementEvent event handler.
Method Signature
StartManaging(agentName : string)
Parameters
StopManaging
Stops receiving management messages using the OnManagementEvent event handler.
Method Signature
StopManaging()
OnBusinessEventReceived
Called when an event is received.
Parameters
OnExceptionRaised
Called when an exception is raised.
Parameters
OnConnectionFromMessageBusLost
Called when the connection to the message bus is lost.
OnConnectionToMessageBusEstablished
Called when the connection to the message bus is established.
OnManagementEvent
Called when a management event is received.
Parameters
Notes: If an event contains an ID for an item that does not exist in the database, the fields
relating to that item are not included in the event. For example, if an access denied event
is received with a badge ID of 4, but there is no badge with an ID of 4 in the database,
there will be no badge or cardholder properties included in that event.
For a complete list of event types and subtypes, perform a get_instances call on
Lnl_EventType and Lnl_EventSubtypeDefinition. For more information, refer to get
instances on page 74, Lnl_EventType on page 191, and Lnl_EventSubtypeDefinition on
page 190.
alarm_ack_blue_channel int16 The blue component of the RGB color for the alarm
after it is acknowledged (0 to 255).
alarm_ack_green_channel int16 The green component of the RGB color for the alarm
after it is acknowledged (0 to 255).
alarm_ack_red_channel int16 The red component of the RGB color for the alarm after
it is acknowledged (0 to 255).
alarm_blue_channel int16 The blue component of the RGB color for the alarm (0
to 255).
alarm_do_not_delete_on_ac boolean True if this alarm should not be deleted from the client
knowledge view after it is acknowledged.
alarm_green_channel int16 The green component of the RGB color for the alarm (0
to 255).
alarm_red_channel int16 The red component of the RGB color for the alarm (0 to
255).
alarm_show_cardholder boolean True if the cardholder view should be shown for this
type of alarm.
alarm_video_verify boolean True if the video verification view should be shown for
this type of alarm.
alarm_visual_notification boolean True if the occurrence of this alarm type should be high-
lighted by, for example, bringing the main alarm monitor
window to the foreground.
device_name string Name of the device that is the source of the event.
timestamp int64 The time when the event occurred at its source, follow-
ing the AMQP standard of milliseconds since January
1, 1970 in UTC time.
version string The version of this specific event message type. This is
a period-delimited string in the format <major>.<minor>.
• A minor version change is one in which only fields
were added, and a parser that ignores
unrecognized fields can still process the message.
• A major version change is one in which the
message structure has changed in a manner that is
not backwards compatible with the previous
structure.
Version is managed on a per event type basis, not the
version of the application that sent the message. A spe-
cific event type is uniquely identified using the ordered
list of domain, event type, and version.
The following properties are delivered for controller-based events, which are events for devices that
are either controllers or have a root parent device that is a controller:
controller_id uint16 The ID of the controller for the device that is the source
of an event.
event_source_name string The name of the device that generated the event.
serial_number int32 The serial number of the event, as specified by the con-
troller.
timestamp_processed int64 The time when the event was processed by the Com-
munication Server, following the AMQP standard of mil-
liseconds since January 1, 1970 in UTC time.
area_entering_id int32 The ID of the area that a cardholder entered, if the cor-
responding reader is defined to detect when an area is
entered.
area_exiting_id int32 The ID of the area that a cardholder exited, if the corre-
sponding reader is defined to detect when an area is
exited.
cardholder_key int64 The database record ID, which is not displayed in Sys-
tem Administration, but which can be useful when
developing custom scripts.
cardholder_key int64 The database record ID, which is not displayed in Sys-
tem Administration, but which can be useful when
developing custom scripts.
Asset Events
When an Asset event occurs, subscribers with proper authorization receive the following properties
and their values:
asset_event_type int32 The event type of the event associated with the asset
event.
asset_event_subtype int32 The event subtype of the event associated with the
asset event.
Biometric Events
Properties for Biometric Events
Intercom Events
When an Intercom event occurs, subscribers with proper authorization receive the following
properties and their values:
Intrusion Events
When an Intrusion event occurs, subscribers with proper authorization receive the following
properties and their values:
intrusion_user_id string The ID of the user who will receive information about an
intrusion event.
receiver_line_number uint16 The line number used by the receiver that generated
the event.
Transmitter Events
When a Transmitter event occurs, subscribers with proper authorization receive the following
properties and their values:
transmitter_input_id int32 The ID of the input on the transmitter associated with the
event.
Video Events
Properties for Video Events
video_start_time uint32 The start time of the video associated with an event.
video_end_time uint32 The end time of the video associated with an event.
Status Events
All events are examined, regardless of their message type, to determine if the information indicates a
status change. If that is the case, additional information specifying the status change is appended to
the event before it is distributed to subscribing clients. The appended information follows the same
key/value pair methodology but uses specific keys to indicate that the data specifies status
information.
The presence of the key status_count indicates that status information is contained in the event and
the value is an integer count of the number of status change items that have been appended. In most
cases, the count value will be one, but there are cases where the count value can be higher indicating
that the source event contained information indicating that multiple state changes have occurred.
For each status change item, there are four key/value pairs that convey the information about that
particular status change, as summarized below.
status_<n>_name string The name of the status item that changed, where <n> is
an integer index specifying which status item the data is
for, with 0 for the first status item, 1 for the second, etc.
status_<n>_name_text string The language translated display text for the name.
status_<n>_value_text string The language translated display text for the value of the
status item.
status_0_name ReaderMode
status_0_value ReaderModePinOrCard
status_count 1
Here is an example of status change information where the status item conveys a value and the range
of values is not fixed or predefined. For these status items, both the value and value_text elements
contain the data.
status_0_name PanelCardCapacity
status_0_value 500
status_0_value_text 500
status_count 1
Here is an example of status change information containing multiple status items that can be
appended to an event:
status_0_name = ReaderAuxInputLineStatus
status_0_value = Alarm
status_0_value_text = Alarm
status_1_name = ReaderAuxInputMasking
status_1_value = Unmasked
status_1_value_text = Unmasked
status_count = 2
The table below identifies the status change items currently supported through the OpenAccess API.
Name Description
Name Description
32 business_event_class: hardware_event
controller_id int16 The ID of the access panel that generated the alarm.
acknowledge_status lint32 The status of the acknowledgment that can be one of the
following:
• 0 Update
• 1 Acknowledged without notes
• 2 Acknowledged with notes
• 3 In Progress
timestamp int64 The time when the event occurred at its source, following
the AMQP standard of milliseconds since January 1, 1970
in UTC time.
version string The version of this specific event message type. This is a
period-delimited string in the format <major>.<minor>.
• A minor version change is one in which only fields
were added, and a parser that ignores unrecognized
fields can still process the message.
• A major version change is one in which the message
structure has changed in a manner that is not
backwards compatible with the previous structure.
Version is managed on a per event type basis, not the
version of the application that sent the message. A spe-
cific event type is uniquely identified using the ordered list
of domain, event type, and version.
Note: For all Add events, each object property name is prefixed with new_. For all Delete
events, each object property name is prefixed with old_. All Modify events include both
the new_ and _old prefixes.
timestamp int64 The time when the event occurred at its source, follow-
ing the AMQP standard of milliseconds since January
1, 1970 in UTC time.
Badge Events
When a Badge event occurs, subscribers with proper authorization receive the following properties
and their values. For more information, refer to Lnl_Badge on page 176.
ACTIVATE datetime Badge activate date. The default is the current date and
(string) time.
DEADBOLT_ boolean If true, the selected cardholder will have deadbolt over-
OVERRIDE ride privileges, which allows the cardholder to access a
door with a deadbolt function mortise lock even when
the deadbolt is thrown.
DEFAULT_FLOOR int32 Indicates the floor number that is called by default when
the badge is presented to a reader associated with the
DEC (elevator terminal). Configure the Default floor
from -128 to 127.
DEST_EXEMPT boolean When selected, the badge will not be included in the
destination assurance processing and no alarms will be
generated if the cardholder violates any of the destina-
tion assurance settings.
PASSAGE_MODE boolean If true, the cardholder is allowed to use the card twice
(within the lock's unlock duration) to place the lock in an
unlock mode for an indefinite duration.
Cardholder Events
When a Cardholder event occurs, subscribers with proper authorization receive the following
properties and their values. For more information, refer to Lnl_Cardholder on page 185.
PRIMARYSEGMENTID int32 This property is only visible when cardholders are seg-
mented.
Visitor Events
When a Visitor event occurs, subscribers with proper authorization receive the following properties
and their values. For more information, refer to Lnl_Visitor on page 239.
PRIMARYSEGMENTID int32 This property is only visible when visitors are seg-
mented.
Visit Events
When a Visit event occurs, subscribers with proper authorization receive the following properties and
their values. For more information, refer to Lnl_Visit on page 235.
LASTCHANGED datetime The date and time the visit was last changed, in UTC
(string) time.
SCHEDULED_TIMEIN datetime The scheduled time the visitor will arrive for the visit.
(string)
SCHEDULED_ datetime The scheduled time the visitor will leave from the visit.
TIMEOUT (string)
TIMEIN datetime The actual time the visitor arrived for the visit, in UTC
(string) time.
TIMEOUT datetime The actual time the visitor left the visit, in UTC time.
(string)
VisitEvent Events
When a VisitEvent event occurs, subscribers with proper authorization receive the following
properties and their values. For more information, refer to Lnl_VisitEvent on page 238.
LastChanged datetime The last time the properties of the visit event changed,
(string) in UTC time.
Data Classes
For more information about each data class, execute a get type call. For more information, refer to get
type on page 70.
Notes: All class and property access is subject to OnGuard user permissions.
In the following tables, View indicates that the property is view only and not editable.
Read indicates that the property is editable on Add only. Edit indicates that the property
is always editable.
DatabaseID only appears as a property when the OnGuard system is an Enterprise
system. For more information, refer to get enterprise settings on page 124.
SEGMENTID only appears as a property in data classes that support segmentation
when segmentation for that class is enabled. For more information, refer to get
segmentation settings on page 131 and Lnl_Segment on page 227. Restarting the LS
OpenAccess service is required when making segmentation changes.
Lnl_AccessGroup
Description: An access group defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void AssignGroup([in]int32 badgeKey);
Assigns all the access levels in the group to a specific badge.
Parameters:
badgeKey - int32 internal ID of the badge to which the access levels are assigned.
Lnl_AccessLevel
Description: An access level defined in the security system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_AccessLevelAssignment
Description: An access level assignment defined in the security system.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Note: A successful response indicates that the badge and access level assignment have
reached the database. The successful response does not indicate that the assignment has
reached the access panel. There might be a delay before the assignment reaches the
panel.
The following table describes how OpenAccess uses cardholder permissions and Area Access
Manager levels to determine which access levels the authenticated OpenAccess user who is making
the call can assign.
Yes No All
No No None
Note: If the authenticated OpenAccess user only has Area Access Manager access levels
defined, all access levels in the AssignLevel array must be contained within the
authenticated OpenAccess user’s Area Access Manager access levels. For example, if
the authenticated OpenAccess user has access levels 1 and 2, then the authenticated
OpenAccess user cannot assign access levels 1, 2, and 3, and the entire access level
assignment attempt will fail.
Lnl_AccessLevelManaged
Description: View all access levels that can be managed by Access Manager users.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_AccessLevelReaderAssignment
Description: An access level reader assignment defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_AccessRequest
Description: A request raised by a person for accessing access levels and readers.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
datetime (string) SubmittedDate The date and time when the View
request was submitted.
datetime (string) ApprovedDate The date and time when the View
request was approved.
datetime (string) DeniedDate The date and time when the View
request was denied.
datetime (string) OnHoldDate The date and time when the View
request was put on hold.
Lnl_AccessLevelRequest
Description: A request raised by a person for accessing access levels.
Abstract: No
Access: View/Add
Superclass: Lnl_AccessRequest
Platforms: OnGuard
datetime (string) SubmittedDate The date and time when the View
request was submitted.
datetime (string) ApprovedDate The date and time when the View
request was approved.
datetime (string) DeniedDate The date and time when the View
request was denied.
datetime (string) OnHoldDate The date and time when the View
request was put on hold.
Methods:
void Approve([in] string Note, [in] boolean EmailCardholder);
Approves the AccessLevel Request. setting ApprovedDate to current date/time.
void Deny([in] string Note, [in] boolean EmailCardholder);
Denies the AccessLevel Request. setting DeniedDate to current date/time.
void Hold([in] string Note, [in] boolean EmailCardholder);
Holds the AccessLevel Request. setting OnHoldDate to current date/time.
Parameters:
Note : Notes when the request is approved, denied and put on hold.
EmailCardholder : Whether the cardholder should be notified.
Lnl_Account
Description: A directory account belonging to a person in the security system.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_AlarmAckHistory
Description: Records a change in the acknowledgment status of an OnGuard alarm.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_AlarmDefinition
Description: Defines how the alarm that is received from the panel is displayed. Lnl_AlarmDefinition
instances are queried by an end user in order to establish configuration details. This contrasts with
Lnl_Alarm instances, which come in with all security events that come through the Communication
Server.
Note: Text instructions are required in order for an instance from this alarm class to appear in
OpenAccess. Text instructions are created using the System Administration >
Monitoring > Alarms > Alarm Configuration form.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_AlarmInput
Description: Retrieves the hardware status for the device. Inherits from Lnl_Input, described below.
Implements the input control methods and represents an alarm input found on an input control
module.
Abstract: No
Access: View
Superclass: Lnl_Input
Platforms: OnGuard
Properties:
Methods:
void Mask();
Sends a command to mask a specific alarm input.
void Unmask();
Sends a command to unmask a specific alarm input.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
ALRM_STATUS_SECURE 0x00
ALRM_STATUS_ACTIVE 0x01
ALRM_STATUS_GND_FLT 0x02
ALRM_STATUS_SHRT_FLT 0x03
ALRM_STATUS_OPEN_FLT 0x04
ALRM_STATUS_GEN_FLT 0x05
Lnl_AlarmOutput
Description: Retrieves the hardware status for the device. Inherits from Lnl_Output, described below.
Implements the relay control methods and represents an alarm relay found on an input or output
control module.
Notes: The Activate(), Deactivate(), and Pulse() methods are not supported on Mercury, NGP,
or Casi alarm panels when those panels are designated as elevator hardware.
Access panels with a dual reader that are designated as elevator hardware will not
generate instances of this class.
Abstract: No
Access: View
Superclass: Lnl_Output
Platforms: OnGuard
Properties:
Methods:
void Activate()
Sends a command to activate a specific alarm output.
void Deactivate()
Sends a command to deactivate a specific alarm output.
void Pulse()
Sends a momentary pulse command to a specific alarm output.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Lnl_AlarmPanel
Description: Retrieves the hardware status for the device. This class represents the Alarm input or
output control module.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Lnl_Area
Description: An APB area defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void MoveBadge();
Moves a badge from one area into another.
void MoveBadge([in] int32 areaID, [in] int64 badgeID, [in] int32 panelID, [in] int32 readerID, [in]
int32 segmentID, [in] datetime UTCTime);
Parameters:
• areaID - This is ID of the area to move the badge to.
• badgeID - This is the badge ID of the badge you want to move.
• panelID - This is the ID of the panel of the reader responsible for moving the badge to the new
area.
• readerID - This is the ID of the reader responsible for moving the badge.
• segmentID - This is the segment associated with the panelID, readerID.
• UTCTime - The time when the badge was moved to the area.
Lnl_AuthenticationMode
Description: Authentication modes for pivCLASS authenticated readers. Authentication modes
specify the authentication mechanism used by the reader to authenticate a cardholder. These modes
are configured as assurance profiles in the pivCLASS Validation Server. Use the ID of a retrieved
authentication mode when setting reader modes with the Lnl_Reader associated class. For more
information, refer to Lnl_Reader on page 216.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_Badge
Description: A badge in the security system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Note: A successful response indicates that the badge and access level assignment have
reached the database. The successful response does not indicate that the assignment has
reached the access panel. There might be a delay before the assignment reaches the
panel.
Methods:
• void AssignAccessLevel([in] int32[] LevelIn);
Assigns the access level(s) of a badge. The following table describes how OpenAccess uses
cardholder permissions and Area Access Manager levels to determine which access levels a the
authenticated OpenAccess user who is making the call can assign.
Does authenticated
OpenAccess user have Does authenticated
permission group, badge, OpenAccess user have The authenticated OpenAccess
and “Modify Access Level Area Access Manager user can assign these access
Assignment” permissions? levels defined? levels
Yes No All
No No None
Note: If the authenticated OpenAccess user only has Area Access Manager access levels
defined, all access levels in the AssignLevel array must be contained within the
authenticated OpenAccess user’s Area Access Manager access levels. For example, if
the authenticated OpenAccess user has access levels 1 and 2, then the authenticated
OpenAccess user cannot assign access levels 1, 2, and 3, and the entire access level
assignment attempt will fail.
Parameters:
LevelIn - Array that includes all the access level IDs the badge needs to be assigned with, in the
format:
– [1, 2, 3]
• void ReplaceAccessLevels([in] int32 SourceBadgekey);
Replaces the access levels assigned to the badge instance with the access levels belonging to the
badge with the supplied badgekey.
If no input parameter is provided, this method removes all access level assignments of the badge.
This is the recommended approach for deleting all access level assignments from a badge.
Parameters:
SourceBadgekey - The badgekey of the badge from which to copy the access levels.
• void ReplacePIN([in] int32 SourceBadgekey);
Replaces the PIN assigned to the current badge instance with the PIN belonging to the badge
with the supplied badgekey.
Parameters:
SourceBadgekey - The badgekey of the badge from which to copy the PIN.
Lnl_BadgeFIPS201
Description: Holds the data imported from FIPS 201 credentials.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_BadgeLastLocation
Description: Shows at what reader the badge was presented last.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_BadgeStatus
Description: The status of a badge in the security system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_BadgeType
Description: A badge type in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
• void GetRequiredFields([out] string[] RequiredFields);
Returns a list of field names that this badge type requires a cardholder to have in order to possess
a badge of this type.
Lnl_Camera
Description: A camera defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void GetHardwareStatus([out] uint32 Status)
Retrieves the hardware status for the device. Status is only retrieved from the hardware when the
UpdateHardwareStatus is called on the parent ISC.
Lnl_CameraDeviceLink
Description: Shows the relationship between a camera and a device (such as a reader). Used for
determining if event video is available for the specified device.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_CameraGroup
Description: Camera group definition.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_CameraGroupCameraLink
Description: An association between a camera and camera group.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_Cardholder
Description: A cardholder in the security system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Person
Platforms: OnGuard
Properties: The class has all the properties of the Lnl_Person class, plus any custom fields defined by
the end user. In addition, the class has the following properties:
Lnl_DeviceGroup
Description: A group consisting of one or more readers, inputs, outputs, cameras, or remote
monitoring devices. A group can contain devices from more than one access panel, and a device can
belong to more than one group. In a segmented system, a device group can belong either to one
segment or to all segments.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_Directory
Description: A directory defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
See the ID CredentialCenter User Guide for more information about directory properties.
Lnl_Element
Description: The base class for many data classes.
Abstract: Yes
Access: None
Superclass: None
Platforms: OnGuard
Properties: None
Lnl_ElevatorTerminal
Description: An elevator terminal defined in the security system. Retrieves the hardware status for the
device.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void GetHardwareStatus();
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Possible returned values are:
– 1 = default floor only
– 2 = Access to authorized floors
– 3 = User entry of destination floor
– 4 = Default floor or user entry of destination floor
void SetAllowedFloors();
Sends a command to update which floors and doors are accessible via the elevator terminal
without supplying security credentials. This method takes a single parameter named
AllowedFloorListID which corresponds to a Floor List in the OnGuard software. Returns Pass or
Fail.
void SetTerminalMode();
Sends a command to update the elevator terminal’s operational mode for interacting with the
cardholder. This method takes the numerical value of a single parameter named Mode. Possible
values are:
– 1 = Default floor only. When the cardholder presents a valid badge to the elevator reader, or
enters a valid PIN code or floor number on the elevator terminal, the system calls the default
floor.
– 2 = Access to authorized floors. When the cardholder presents a valid badge to the elevator
reader, and then selects an authorized floor, the system calls the authorized floor.
– 3 = User entry of destination floor. The cardholder has the option to select a floor with or
without presenting a valid badge to the elevator reader. If the selected floor is an allowed
floor, the system calls the floor. If the floor is a non-allowed floor, the cardholder is
requested to present a valid badge.
– 4 = Default floor or user entry of destination floor. When the cardholder presents a valid
badge to the elevator reader, the system calls the cardholder’s default floor. Within a
configurable timeout period, the cardholder can override the default floor call by entering
another floor number.
Lnl_EventAlarmDefinitionLink
Description: The link between the event type and alarm for a particular device.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_EventParameter
Description: An event parameter.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_EventSubtypeDefinition
Description: An event subtype defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_EventSubtypeParameterLink
Description: An association between an event subtype and event parameter.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_EventType
Description: An event type defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_GuardTour
Description: A guard tour provides a security guard with a defined set of tasks that must be performed
within a specified period of time.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
• void LaunchTour([in] int64 BadgeId, [in] int32 MonStationId, [out] int32 ReturnValue);
Parameters:
– BadgeId - Badge ID
– MonStationID - Monitoring station (workstation) ID
– ReturnValue - Result of the guard tour. Possible values:
– 0: Success
– 1: Tour already in progress
– 2: Tour not in progress
– 3: Invalid tour ID
– 4: Invalid tour status
– 5: Invalid badge ID
– 6: Invalid monitoring station
– 7: Communication error
Lnl_Holiday
Description: A holiday that is defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_HolidayType
Description: A holiday that is defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_HolidayTypeLink
Description: Defines what holiday type that is associated with a given holiday
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_IncomingEvent
Description: An data class that supports sending incoming events via OpenAccess. This object has no
properties; it only has the methods listed below.
Abstract: No
Superclass: Lnl_Element
Platforms: OnGuard
Properties: None
Methods:
• void SendIncomingEvent([in] string Source, [in] string Device, [in] string SubDevice, [in]
string Description, [in] datetime Time, [in] boolean IsAccessGrant, [in] boolean IsAccessDeny,
[in] int64 BadgeID, [in] string(hex) ExtendedID);
Parameters:
– Source - text representation of the object/device that generated the event
Variable-length Unicode string. This parameter is required. The source must be defined in
the OpenAccess Sources folder (in the System Administration application) prior to using the
Lnl_IncomingEvent::SendIncomingEvent method. For more information, refer to Add a
Logical Source on page 256.
– Device - text representation of a device associated with a OpenAccess Source that generated
the event
Variable-length Unicode string. This parameter is optional. The device must be defined in
the OpenAccess Sources folder > OpenAccess Devices tab (in System Administration) prior
to using the Lnl_IncomingEvent::SendIncomingEvent method.
– SubDevice - text representation of a sub device associated with a OpenAccess Device that
generated the event.
Variable-length Unicode string. This parameter is optional. The device must be defined in
the OpenAccess Sources folder > OpenAccess Sub-Devices tab (in System Administration)
prior to using the Lnl_IncomingEvent::SendIncomingEvent method.
– Description - text that describes the event
Variable-length Unicode string.
– Time - The time when this event occurred. If this is empty, the current time will be used.
– IsAccessGrant - boolean value that specifies whether the event reported for the OpenAccess
Source, Device or Sub-Device will be the “Granted Access” event. This parameter is
optional. However, if this parameter is set to true, BadgeID or ExtendedID can be specified
to report an “Granted Access” event for a specific OnGuard cardholder. The OpenAccess
Source, Device or Sub-Device must be defined in the OpenAccess Sources folder >
OpenAccess Devices tab (in the System Administration application) prior to using the
Lnl_IncomingEvent::SendIncomingEvent method with the IsAccessGrant parameter set to
true. For more information, refer to Generating Access Granted and Access Denied Events
on page 196.
– IsAccessDeny - boolean value that specifies whether the event reported for the OpenAccess
Source, Device or Sub-Device will be the “Access Denied” event. This parameter is
optional. However, if this parameter is set, then BadgeID or ExtendedID can be specified to
report an “Access Denied” event for a specific OnGuard cardholder. The OpenAccess
Source, Device or SubDevice must be defined in the OpenAccess Sources folder >
OpenAccess Devices tab (in the System Administration application) prior to using the
Lnl_IncomingEvent::SendIncomingEvent method with the IsAccessDeny parameter set to
true. For more information, refer to Generating Access Granted and Access Denied Events
on page 196.
– BadgeID - Numeric identifier that refers to a badge in the OnGuard database that generated
the event. This parameter is optional and is used in association with all badge related events.
– ExtendedID - Extended length string identifier that refers to a PIV-based badge in the
OnGuard database that generated the event. Specifies the 128-bit UUID or 200-bit FASC-N.
This parameter is optional and is used in association with all badge-related events. This
parameter must be in hexadecimal string format. The FASCN or UUID needs to be
converted to a binary value that begins with “0x” and includes the values of the FASCN/
UUID.
Note: BadgeID is always given precedence over ExtendedID during the search for the badge
information to be displayed in Alarm Monitoring.
• int32 AcknowledgeAlarm([in] int32 CurrentAckStatus, [in] int32 SerialNumber, [in] string
CommServerHostName, [in] int32 PanelID, [in] int32 AlarmID, [in] datetime AlarmTime, [in]
int32 AckStatus, [in] string AckNotes, [out] int32 SimultaneousAckStatus);
Description:
Allows acknowledgment of alarms received from the system. Most of the parameters can be
extracted from the Lnl_LoggedEvent.
Return:
0 - If acknowledgment fails. Examine the SimultaneousAckStatus value to see if the conflict
occurred when processing the request.
1 - If acknowledgment succeeds.
Parameters:
– CurrentAckStatus - current acknowledgment status of the alarm to ensure that simultaneous
acknowledgment by other means does not interfere with user’s intent. Possible values are:
0 - No. Initial status for an unacknowledged event.
1 - Yes. Acknowledge.
2 - Note. Acknowledge with note.
3 - In-Progress. Mark event as “in-progress”
– SerialNumber - serial number of the event to acknowledge
– CommServerHostName - host name of the Communication server through which the event
arrived
– PanelID - Panel ID associated with the event to ensure the integrity of the acknowledgment
request
– AlarmID - Event type ID associated with the event to ensure the integrity of the
acknowledgment request
– AlarmTime - Time the event occurred to ensure the integrity of the acknowledgment request
– AckStatus - Acknowledgment status to set. See the CurrentAckStatus parameter description
for possible values.
– AckNotes - Acknowledgment notes to set. AckStatus must be 2.
– SimultaneousAckStatus - Value greater than 0 if alarm had been acknowledged by other
means. Contains the new acknowledgment status if that was the case. See the
CurrentAckStatus parameter description for possible values.
Note: The OpenAccess Source, Device, and SubDevice names must all match what has been
configured in the OnGuard database in order for the event to be reported in Alarm
Monitoring.
Lnl_Input
Description: Abstract class that represents any kind of input.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_IntrusionArea
Description: Implements the control methods for the Intrusion Area. Retrieves the hardware status for
the device.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void Arm([in] int32 armState);
void Disarm()
Sends a command to disarm the area.
void SilenceAlarms ()
Sends a command to silence area alarms.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
OFFLINE_STATUS 0x00
ONLINE_STATUS 0x01
Lnl_IntrusionDoor
Description: Implements the control methods for the Intrusion Door.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void Open()
Sends a command to open the intrusion door.
void SetMode([in] int32 Mode);
Sends a command to change the door mode.
void GetHardwareStatus([out] uint32 Status);
Retrieves the hardware status for the device. Status is only retrieved from the hardware when the
UpdateHardwareStatus is called on the parent ISC.
DoorLock 0x0
DoorUnlock 0x1
SetDoorSecure 0x2
Lnl_IntrusionOutput
Description: Abstract class that inherits from Lnl_Output. Declares the relay control methods and
represents an output device of the Intrusion Panel.
Abstract: Yes
Access: View
Superclass: Lnl_Output
Platforms: OnGuard
Properties:
Lnl_IntrusionZone
Description: Implements the control methods for the Intrusion Zone.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void Bypass()
Sends a command to open by pass the alarm zone.
void UnBypass();
OFFLINE_STATUS 0x00
ONLINE_STATUS 0x01
Lnl_LoggedEvent
Description: Represents a hardware event that has been logged to the database.
Notes: When requesting instances of Lnl_LoggedEvent with a get instances call, a filter is
required due to the large number of instances this class usually contains. Also, be
careful what you specify as the order_by value. If left blank, the key values (PanelID,
SerialNumber) are used, which works well.
You can also specify Time as the order_by value. If you filter by Time, you will improve
performance if you also order_by Time. However, it is not recommended to use any
other combination without an index in place on the EVENTS table, as doing so might
generate a timeout error. For more information, refer to Error Messages on page 263.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_LogicalDevice
Description: A third-party logical device.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_LogicalSource
Description: A third-party logical source.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_LogicalSubDevice
Description: A third-party logical sub-device.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_MonitoringZone
Description: A Monitoring zone defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Lnl_MonitoringZoneCameraLink
Description: Defines what cameras are associated with a given monitoring zone.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Lnl_MonitoringZoneDeviceLink
Description: Defines what devices are associated with a given monitoring zone.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Lnl_MonitoringZoneRecorderLink
Description: Defines what Lenel NVR Video Recorders are associated with a given monitoring zone.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_MonitoringZoneDeviceLink
Platforms: OnGuard
Properties:
Lnl_MultimediaObject
Description: An image, signature, document, or biometric template belonging to a person in the
security system.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Photo Image 0 1
Thumbnail 2 1
Signature 0 8
Lnl_OffBoardRelay
Description: Inherits from Lnl_Output, and therefore has the same properties. Implements the relay
control methods and represents an Off-Board relay connected to the Intrusion Panel. Retrieves the
hardware status for the device.
Abstract: No
Access: View
Superclass: Lnl_IntrusionOutput
Platforms: OnGuard
Properties:
Methods:
void Activate()
Sends a command to activate a specific alarm relay.
void Deactivate()
Sends a command to deactivate a specific alarm relay.
void Toggle();
Toggles the state of the specific alarm relay.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Lnl_OnBoardRelay
Description: Inherits from Lnl_Output, and therefore has the same properties. Implements the relay
control methods and represents an On-Board relay of the Intrusion Panel. Retrieves the hardware
status for the device.
Abstract: No
Access: View
Superclass: Lnl_IntrusionOutput
Platforms: OnGuard
Properties:
Methods:
void Activate()
Sends a command to activate a specific alarm relay.
void Deactivate()
Sends a command to deactivate a specific alarm relay.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Lnl_Output
Description: Abstract class that represents any kind of output.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_Panel
Description: A panel defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void DownloadFirmware()
Sends a download firmware command to the ISC.
void DownloadDatabase()
Sends a command to the ISC to download the cardholder database.
void ResetUseLimit()
Sends a command to reset the use limit of all cardholders within the ISC.
void UpdateHardwareStatus()
Sends a command to retrieve the status of the Intelligent System controller and all downstream
hardware connected to the specific system controller.
void Connect()
Used for dial-up only. This command instructs the host to connect to the ISC via dial-up.
void Disconnect()
Used for dial-up only. This command instructs the host to send a disconnect command to the ISC.
void SetClock()
Sends the current time down to the ISC.
void GetHardwareStatus([out] uint32 Status)
Retrieves the hardware status for the device. Status is only retrieved from the hardware when
UpdateHardwareStatus is called on the parent ISC. If the device is offline, the status is returned
with a value of “0”.
Lnl_Person
Description: A cardholder or visitor in the security system.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Note: The properties listed below with Edit access are editable only through instances of
Lnl_Cardholder and Lnl_Visitor.
Lnl_PersonSecondarySegments
Description: An association between a person and that person’s assigned secondary segments. Present
only in segmented systems where cardholder or visitor segmentation is enabled.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_PrecisionAccessGroup
Description: A defined set of unique access privileges for assignment to individual cardholders. Only
present if the system is configured to use precision access. For more information, refer to “Precision
Access Form” in the System Administration User Guide.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_PrecisionAccessGroupAssignment
Description: An assignment relationship between a badge and a precision access group. Only present
if the system is configured to use precision access. For more information, refer to “Precision Access
Form” in the System Administration User Guide.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_ProhibitedPassword
Description: The prohibited password list defined in the system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_PTZPreset
Description: PTZ presets configured by the OnGuard software.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_Reader
Description: A reader defined in the security system.
Abstract: No
Access: View/Modify
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void OpenDoor()
Sends a command to open the door for a specific reader.
void SetMode([in] int32 Mode)
Sends a command to set the current operating mode of a reader.
void GetMode ([out] int32 Mode)
Retrieves current mode of the reader. Mode is only retrieved from the hardware when the
UpdateHardwareStatus is called on the parent ISC.
Parameters:
MODE_LOCKED 0x0
MODE_CARDONLY 0x1
MODE_PIN_OR_CARD 0x2
MODE_PIN_AND_CARD 0x3
MODE_UNLOCKED 0x4
MODE_FACCODE_ONLY 0x5
MODE_CYPHERLOCK 0x6
MODE_AUTOMATIC 0x7
You can set the current mode of the reader to an authentication mode using the ID retrieved with
the Lnl_AuthenticationMode class. Authentication mode IDs are not static like the system-
defined reader modes in the table above.
void SetBiometricVerifyMode([in] boolean Value)
Sends a command to enable/disable the biometric mode of verification for a reader.
Note: Using this method requires that you configure at least one biometric type for the
reader’s controller. You must also configure the desired biometric template type to
greater than 0 on the System Options > Biometrics tab.
Parameters:
boolean Value: True – enable biometric mode of verification. False – disable biometric mode of
verification.
void SetFirstCardUnlockMode([in] boolean Value)
Sends a command to enable/disable first card unlock mode for the reader.
Note: Using this method requires that you enable the First Card Unlock option on the reader's
controller.
Parameters:
boolean Value: True – enable first card unlock mode. False – first card unlock mode.
void DownloadFirmware()
Sends a download firmware command to the reader interface module.
void GetHardwareStatus([out] uint32 Status)
Retrieves the hardware status for the device. Status is only retrieved from the hardware when the
UpdateHardwareStatus is called on the parent ISC.
Lnl_ReaderInput
Description: Abstract class, inherits from Lnl_Input. Declares the input control methods and
represents an auxiliary input found on a reader interface module.
Abstract: Yes
Access: View
Superclass: Lnl_Input
Platforms: OnGuard
Properties:
Lnl_ReaderInput1
Description: Inherits from Lnl_ReaderInput. Declares the input control methods and represents the
first auxiliary input found on a reader interface module. Retrieves the hardware status for the device.
Abstract: No
Access: View
Superclass: Lnl_ReaderInput
Platforms: OnGuard
Properties:
Methods:
void Mask();
Sends a command to mask a specific reader input.
void Unmask();
Sends a command to unmask a specific reader input.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
ALRM_STATUS_SECURE 0x00
ALRM_STATUS_ACTIVE 0x01
ALRM_STATUS_GND_FLT 0x02
ALRM_STATUS_SHRT_FLT 0x03
ALRM_STATUS_OPEN_FLT 0x04
ALRM_STATUS_GEN_FLT 0x05
Lnl_ReaderInput2
Description: Inherits from Lnl_ReaderInput. Declares the input control methods and represents the
second auxiliary input found on a reader interface module. Retrieves the hardware status for the
device.
Abstract: No
Access: View
Superclass: Lnl_ReaderInput
Platforms: OnGuard
Properties:
Methods:
void Mask();
Sends a command to mask a specific reader input.
void Unmask();
Sends a command to unmask a specific reader input.
ALRM_STATUS_SECURE 0x00
ALRM_STATUS_ACTIVE 0x01
ALRM_STATUS_GND_FLT 0x02
ALRM_STATUS_SHRT_FLT 0x03
ALRM_STATUS_OPEN_FLT 0x04
ALRM_STATUS_GEN_FLT 0x05
Lnl_ReaderOutput
Description: Abstract class, inherits from Lnl_Output. Declares the relay control methods and
represents an auxiliary relay found on a reader interface module.
Abstract: Yes
Access: View
Superclass: Lnl_Output
Platforms: OnGuard
Properties:
Lnl_ReaderOutput1
Description: Inherits from Lnl_ReaderOutput. Implements the relay control methods and represents
the first auxiliary relay found on a reader interface module. Retrieves the hardware status for the
device.
Abstract: No
Access: View
Superclass: Lnl_ReaderOutput
Platforms: OnGuard
Properties:
Methods:
void Activate()
Sends a command to activate a specific alarm relay.
void Deactivate()
Sends a command to deactivate a specific alarm relay.
void Pulse()
Sends a momentary pulse command to a specific alarm relay.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Lnl_ReaderOutput2
Description: Inherits from Lnl_ReaderOutput. Implements the relay control methods and represents
the second auxiliary relay found on a reader interface module. Retrieves the hardware status for the
device.
Abstract: No
Access: View
Superclass: Lnl_ReaderOutput
Platforms: OnGuard
Properties:
Methods:
void Activate()
Sends a command to activate a specific alarm relay.
void Deactivate()
Sends a command to deactivate a specific alarm relay.
void Pulse()
Sends a momentary pulse command to a specific alarm relay.
void GetHardwareStatus([out] uint32 Status)
Status is only retrieved from the hardware when the UpdateHardwareStatus is called on the
parent ISC.
Lnl_ReaderRequest
Description: A request raised by a person for accessing readers.
Abstract: No
Access: View/Add
Superclass: Lnl_AccessRequest
Platforms: OnGuard
datetime (string) StartDate Start date the cardholder requests for Read
the reader.
datetime (string) EndDate End date the cardholder requests for Read
the reader.
int32 OnHoldByUserID The user ID of the user who put the View
request on hold.
datetime (string) SubmittedDate The date and time when the request View
was submitted.
datetime (string) ApprovedDate The date and time when the request View
was approved.
datetime (string) DeniedDate The date and time when the request View
was denied.
datetime (string) OnHoldDate The date and time when the request View
was put on hold.
Methods:
void Approve([in] string Note, [in] boolean EmailCardholder);
Approves the Reader Request. setting ApprovedDate to current date/time.
void Deny([in] string Note, [in] boolean EmailCardholder);
Denies the Reader Request. setting DeniedDate to current date/time.
void Hold([in] string Note, [in] boolean EmailCardholder);
holds the Reader Request. setting OnHoldDate to current date/time.
Parameters:
Note: Notes when the request is approved, denied and put on hold.
EmailCardholder: Whether the cardholder should be notified.
Lnl_Segment
Description: A segment or segment group defined in the security system. Present in segmented
systems only.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_SegmentGroup
Description: A segment group in the security system. Present in segmented systems only. Refer to
Lnl_SegmentGroupMember on page 248 to determine which segments make up a segment group.
Abstract: No
Access: View
Superclass: Lnl_Segment
Platforms: OnGuard
Properties: Same properties as in Lnl_Segment.
Lnl_SegmentUnit
Description: A segment in the security system. Present in segmented systems only.
Abstract: No
Access: View
Superclass: Lnl_Segment
Platforms: OnGuard
Properties: Same properties as in Lnl_Segment.
Lnl_Timezone
Description: A time zone defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_TimezoneInterval
Description: A time zone interval used by instances of Lnl_Timezone.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_User
Description: A user defined in the system.
Abstract: No
Access: View/Add /Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_UserAccount
Description: An association between a user and its directory account.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_UserPermissionGroup
Description: A user permission group defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_UserFieldPermissionGroup
Description: A user field permission group defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_UserPermissionDeviceGroupLink
Description: Describes a link between a device group and a permission.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_UserReportPermissionGroup
Description: A user report permission group defined in the system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_UserSecondarySegment
Description: An association between a user and all assigned segments.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_VideoLayout
Description: Configuration of the matrix view for displaying video channels.
Abstract: No
Access: View
Superclass: None
Platforms: OnGuard
Properties:
Lnl_VideoLayoutSource
Description: Source details for the cells in the video layout.
Abstract: No
Access: View
Superclass: None
Platforms: OnGuard
Properties:
Lnl_VideoTemplate
Description: A video template for the matrix view of the player window.
Abstract: No
Access: View
Superclass: None
Platforms: OnGuard
Properties:
Lnl_Visit
Description: A visit in the security system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Methods:
void SignVisitOut();
Signs a visit out, modifying the visit and setting TIMEOUT to current date/time. Any associated
badge with the visitor is deactivated and set to the status as configured in the OnGuard software.
void SignVisitIn([in]int32 BadgeTypeID, [in]string PrinterName, [in]int64 AssignedBadgeID);
Signs a visit in, modifying the visit and setting TIMEIN to current date/time. If
AssignedBadgeID is set to a valid ID, the badge is automatically assigned to the visitor and made
active.
Parameters:
• badgeTypeID - This is the badge type you want to assign the visitor.
• AssignedBadgeID - This is the badge ID you want to assign the visitor, a badge already in the
system.
• printerName - The name of the printer you want to use to print out the disposable badge
Note: If badgeTypeID is provided so must the printerName (unless there is a default printer set
up for the badgeTypeID specified) and AssignedBadgeID will be ignored. If
AssignedBadgeID is specified, badgeTypeID and printerName are ignored. See the
Visitor Management User Guide for more detailed documentation on visits and signing
them in.
Lnl_VisitEmailRecipient
Description: A visit e-mail recipient in the security system.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_VisitEvent
Description: A hosted event with visits and visitors.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Method:
HRESULT SendEmail([in] int32 ID, [in] Boolean UseSystemDefaults, [in] string Action, [in]
Boolean, IncludeHost, [in] Boolean IncludeVisitor, [in] Boolean IncludeDefRecipents, [in] string
EmailList);
Sends an email to the host, co-hosts, default recipients (if configured), delegate (if visit event is
created by the delegate), and individual mails to visitors when a visit event is scheduled with
multiple visitors.
Parameters:
• ID - Visit_EventID passed as 'property_value_map'.
• UseSystemDefaults - If true, then emails will be sent as configured in System Administation
settings. All other parameters passed to this method are ignored. If false, then emails will be sent
as configured by the parameters.
• Action - Add/Modify. 'Add' when visit event is added and 'Modify' when visit event is updated.
• IncludeHost - Whether the host is notified.
• IncludeVisitor - Whether the visitor is notified.
• IncludeDefRecipients - Whether the default recipients are notified.
• EmailList - A list of semi-colon separated e-mail recipients (other than the visitor, host, or
defaults).
Lnl_Visitor
Description: A visitor in the security system.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Person
Platforms: OnGuard
Properties: The class has all the properties of the Lnl_Person class, plus custom fields defined by the
end user and the following:
Lnl_VisitDelegateAssignment
Description: A visit delegate assignment in the system.
Abstract: No
Access: View/Add/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_VisitSignInLocation
Description: The sign-in location for visits.
Abstract: No
Access: View/Add/Modify/Delete
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_Workstation
Description: The workstation used to configure the Monitor Zones used on monitoring stations.
Abstract: No
Access: View
Superclass: None
Platforms: OnGuard
Properties:
Lnl_WorldTimezone
Description: A world time zone defined in the security system.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Association Classes
When using a filter to get instances of an association class, configure the filter as shown in this
example:
type_name=Lnl_AccessLevelGroupAssignment and
filter=AccessGroup="Lnl_AccessGroup.ID=1"
This filter provides all access levels that belong to the access group with ID = 1.
Lnl_AccessLevelGroupAssignment
Description: An association between an access level and the group in which it belongs.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_BadgeOwner
Description: An association between a badge and the person who owns it.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_CardholderAccount
Description: An association between an account and the cardholder with which it is associated.
Abstract: No
Access: View
Superclass: Lnl_PersonAccount
Platforms: OnGuard
Properties:
Lnl_CardholderBadge
Description: An association between a badge and the cardholder who owns it.
Abstract: No
Access: View
Superclass: Lnl_BadgeOwner
Platforms: OnGuard
Properties:
Lnl_CardholderMultimediaObject
Description: An association between a multimedia object and the cardholder who owns it.
Abstract: No
Access: View
Superclass: Lnl_MultimediaObjectOwner
Platforms: OnGuard
Properties:
Lnl_DirectoryAccount
Description: An association between an account and the directory in which it is stored.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_MultimediaObjectOwner
Description: An association between a multimedia object and the person who owns it.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_PersonAccount
Description: An association between an account and the person with which it is associated.
Abstract: Yes
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_ReaderEntersArea
Description: An association between a reader and the APB area to which it allows entry.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_ReaderExitsArea
Description: An association between a reader and the APB area to which it allows departure from.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_SegmentGroupMember
Description: An association between a segment unit and the segment group of which the unit is a
member. Present in segmented systems only.
Abstract: No
Access: View
Superclass: Lnl_Element
Platforms: OnGuard
Properties:
Lnl_VisitorAccount
Description: An association between an account and the visitor with which it is associated.
Abstract: No
Access: View
Superclass: Lnl_PersonAccount
Platforms: OnGuard
Properties:
Lnl_VisitorBadge
Description: An association between a badge and the visitor who owns it.
Abstract: No
Access: View
Superclass: Lnl_BadgeOwner
Platforms: OnGuard
Properties:
Lnl_VisitorMultimediaObject
Description: An association between a multimedia object and the visitor who owns it.
Abstract: No
Access: View
Superclass: Lnl_MultimediaObjectOwner
Platforms: OnGuard
Properties:
OpenAccess provides the capability of sending alarms to the Alarm Monitoring application. These
alarms are also logged to the OnGuard database just like other alarms.
It is necessary to first setup a Logical Source using System Administration before using this
capability of OpenAccess. OpenAccess will use this source as the device to display alarms for in
Alarm Monitoring. For more information, refer to Add a Logical Source on page 256.
Note: In order to receive logical source events, add at least one online panel to the same
monitor zone as the source.
After configuring the Logical Source, you should also add any Logical Device and Logical Sub-
Device downstream devices in System Administration. Use of devices and sub-devices is optional.
OnGuard uses devices and sub-devices to report alarms for Logical Source child and sub-child
devices in Alarm Monitoring. For more information, refer to Add a Logical Device on page 258 and
Add a Logical Sub-Device on page 260.
Sending alarms to Alarm Monitoring is very simple.
Note: To use the following example, change “localhost” to the Fully Qualified Domain Name
(FQDN) of your server.
OpenAccess is an advanced application integration service that allows real time, bidirectional
integration between OnGuard and third party IT sources. OpenAccess allows System Administrators
to develop scripts and/or applications that allow events in one domain (security or IT) to cause
appropriate actions in the other.
Note: The Logical Sources method has four parameters: the source, description, device
(optional), and sub-device (optional). The source of the Logical Sources method must
match the source name on the Logical Sources form. If the optional parameters are used,
the device of the Logical Sources method must match the device name on the Logical
Devices form, and the sub-device must match the sub-device name on the Logical Sub-
Devices form.
• Have at least one panel (non-system Logical Source) configured and marked online so that the
Communications Server will work properly with Logical Sources. The panel does not need to
exist or actually be online in Alarm Monitoring; it simply needs to exist and show up in the
System Status view. Once this is configured, events can be received successfully by Alarm
Monitoring from Logical Sources.
This folder is displayed by selecting Logical Sources from the Additional Hardware menu, or by
selecting the Logical Sources toolbar buttonin System Administration or ID CredentialCenter.
Toolbar Shortcut
Logical Devices and Logical Sub-Devices also display in Alarm Monitoring in the System Status
Tree. For example, a Logical Source named “Tivoli” with a Logical Device named “Tivoli device”
and a Logical Sub-Device named “Tivoli sub-device” would display in Alarm Monitoring in the
following manner:
Listing window
Lists Logical Source names.
Name
Identifies the name of the Logical Source. This is a “friendly” name assigned to each Logical
Source to make it easy to identify.
Online
The Logical Source is always online and ready for use. This status does not apply to the
Logical Source.
Daylight savings
Select this check box if Daylight Savings Time is enforced in the selected access panel’s
geographical location.
Add
Click this button to add a Logical Source.
Modify
Click this button to modify a Logical Source.
Delete
Click this button to delete a Logical Source.
Help
Click this button to display online help for this form.
Multiple Selection
If selected, more than one entry in the listing window can be selected simultaneously. The
changes made on this form will apply to all selected Logical Sources.
Close
Click this button to close the Logical Sources folder.
IMPORTANT: In addition to having a Logical Source configured, there must be at least one
panel (non-system Logical Source) configured and marked online so that the
Communications Server will work properly with Logical Sources. The panel
does not need to exist or actually be online in Alarm Monitoring; it simply
needs to exist and show up in the System Status view. Once this is set up,
events can be received successfully by Alarm Monitoring and event
subscribers from Logical Sources.
5. Click [OK].
6. A prompt to confirm that you want to make the modification displays. Click [OK].
Listing window
Lists Logical Device names.
Name
Identifies the name of the Logical Device. This is a “friendly” name assigned to each Logical
Device to make it easy to identify.
Logical Source
Select the Logical Source that is the parent of the child device being configured. Logical
Sources are configured on the Logical Sources tab (Additional Hardware > Logical Sources >
Logical Sources tab).
Add
Click this button to add a Logical Device.
Modify
Click this button to modify a Logical Device.
Delete
Click this button to delete a Logical Device.
Help
Click this button to display online help for this form.
Multiple Selection
If selected, more than one entry in the listing window can be selected simultaneously. The
changes made on this form will apply to all selected Logical Devices.
Close
Click this button to close the Logical Sources folder.
Note: If segmentation is enabled, the segment of the Logical Source will be used as the
segment for the Logical Device.
1. From the Additional Hardware menu, select Logical Sources. The Logical Sources folder
opens.
2. Click the Logical Devices tab.
3. Click [Add].
4. In the Name field, type a name for the Logical Device.
5. Select the Logical Source that is the parent of the Logical Device.
Note: The Logical Source must be configured on the Logical Sources tab.
6. Click [OK].
Listing window
Lists Logical Sub-Device names, along with the parent Logical Device and Logical Source.
Name
Identifies the name of the Logical Sub-Device. This is a “friendly” name assigned to each
Logical Sub-Device to make it easy to identify.
Logical Device
Select the Logical Device that is the parent of the child Sub-Device being configured. Logical
Devices are configured on the Logical Devices tab (Additional Hardware > Logical Sources
> Logical Devices tab).
Add
Click this button to add a Logical Sub-Device.
Modify
Click this button to modify a Logical Sub-Device.
Delete
Click this button to delete a Logical Sub-Device.
Help
Click this button to display online help for this form.
Multiple Selection
If selected, more than one entry in the listing window can be selected simultaneously. The
changes made on this form will apply to all selected Logical Sub-Devices.
Close
Click this button to close the Logical Sources folder.
Note: If segmentation is enabled, the segment of the Logical Source will be used as the
segment for the Logical Sub-Device.
1. From the Additional Hardware menu, select Logical Sources. The Logical Sources folder
opens.
2. Click the Logical Sub-Devices tab.
3. Click [Add].
4. In the Name field, type a name for the Logical Sub-Device.
5. Select the Logical Device that is the parent of the Logical Sub-Device.
Note: The Logical Device must be configured on the Logical Devices tab.
6. Click [OK].
5. Click [OK].
6. A prompt to confirm that you want to make the deletion will be displayed. Click [OK].
This section describes how to use the OpenAccess Tool and other techniques to troubleshoot issues
with the LS OpenAccess service.
It is also useful to understand the OpenAccess architecture. For more information, refer to
OpenAccess Architecture on page 19.
Error Messages
This section defines how the LS OpenAccess service communicates errors to the client. If an error
occurs, the response header will include an entry named error which is a key/value map. The
response may otherwise contain only standard response headers.
The error is a string in a period-delimited hierarchical string that follows the platform namespace. For
example:
"error":
{
"code":"openaccess.general.invalidapplicationid",
"message":"You are not licensed for OpenAccess."
}
code string yes The error code, which is a string with a full
namespace.
For more information about error codes, refer to Errors List on page 264.
Errors List
Notes: This section does not contain every OpenAccess error code that might be logged. Only
the most common error codes are listed.
The error code sent to the client generally contains less detail than is logged at the
server. Check the server logs for more information.
If the LS OpenAccess service cannot connect to the database, that can cause many of the
OpenAccess errors. Confirm that the service has a database connection.
system.http_error_code A timeout occurred because the request 40_ (400, 404, 408,
took longer than 60 seconds. Also, the and so on)
request might be malformed or contain
invalid parameters.
Warning List
Note: This section does not contain every OpenAccess warning. Only the most common
warnings are listed.
Notes: To run the OpenAccess Tool, you will be prompted to enter a valid Application ID.
Contact Lenel Technical Support if you do not have an Application ID.
The Event Generator is another useful troubleshooting tool. Use Event Generator to
create “fake” events that can be received by event subscribers. For more information,
refer to Appendix A: Event Generator on page 273.
Creating Instances
To create an instance:
1. In the OpenAccess tool, select the Instances tab.
2. In the Types drop-down, select the type you want to create.
3. Click [Create]. The listing window populates with the properties assigned to the type.
4. Double-click each property in the listing window you want to define and enter the value.
5. When you are finished defining property values, click [Submit].
6. Click [Instances] to view the existing instances.
Modifying Instances
To modify an instance:
1. In the OpenAccess tool, select the Instances tab.
2. In the Types drop-down, select the type you want to modify.
3. Click [Instances] to view the existing instances.
4. Select an instance you want to modify. The listing window populates with the properties assigned
to that instance.
5. Click [Modify].
6. Double-click each property in the listing window you want to modify and enter the new value.
7. When you are finished modifying property values, click [Submit].
8. Click [Instances] to view the existing instances.
Deleting Instances
To delete an instance:
1. In the OpenAccess tool, select the Instances tab.
2. In the Types drop-down, select the type you want to delete.
3. Click [Instances] to view the existing instances of that type. The listing window populates with
the existing instances.
4. Select the instance you want to delete.
5. Click [Delete].
6. A dialog opens asking if you want to delete the instance. Click [OK].
7. A dialog indicates that the instance was deleted successfully. Click [OK].
Name (FQDN), then applications must access OpenAccess using the server’s FQDN. Likewise, if the
certificate name does not use the server’s FQDN, then applications must access OpenAccess by not
using the server’s FQDN.
Note: The OpenAccess Tool uses the OpenAccess location configured on the System
Administration > System Options form.
For information about certificates and how to correct these errors, refer to the “OnGuard and the Use
of Certificates” appendix in the OnGuard Installation Guide.
Note: The Event Generator is a useful troubleshooting tool. Use Event Generator to create
“fake” events that can be received by event subscribers. For more information, refer to
Appendix A: Event Generator on page 273.
Note: OpenAccess does not work with directories of type Windows Local Accounts because
local accounts do not support manual single sign-on. To work around this, create a
directory of type Microsoft Windows NT 4 Domain and enter the machine name in the
Domain field.
The Event Generator is a utility that is used to generate events without having “live” or online
hardware connected to a system; it enables customers who wish to generate events without
purchasing hardware to do so.
The Event Generator is available on the Lenel Web site: https://partner.lenel.com/downloads/
onguard/software. (You will need your Lenel login to gain access to this site.)
Note: When accessing the Downloads section at https://partner.lenel.com, make sure to select
the version of OnGuard that is currently installed.
It is also available on the OnGuard Software Development Kit (SDK) installation disc.
End delay
Amount of time that will elapse after the last event is sent
In between delay
Amount of time that will elapse between events that are sent
Badge ID min
The lowest badge ID that is allowed to be randomly selected. Badge IDs will be randomly
determined, but will fall in the range between the specified badge ID min and max.
Badge ID max
The highest badge ID that is allowed to be randomly selected. Badge IDs will be randomly
determined, but will fall in the range between the specified badge ID min and max.
Listing window
Lists events that have been added, along with the event type, event ID, device ID, input ID,
message type, data type, badge ID, Panel ID, and text associated with each.
Event type
Lists all non-receiver/intrusion events in the OnGuard system. For receiver/intrusion events,
use the Advanced user interface.
Event sub-type
Lists sub-categories of the selected event type.
Panel
Lists all available panels for the selected event type. The event will be generated for the
selected panel.
Device
Lists all available readers for the selected event type (if applicable). The event will be
generated for the selected reader.
Input or output
Lists all available inputs and outputs for the selected event type (if applicable). The event will
be generated for the selected input or output.
OK
If adding a new event, the event will be added. If modifying an event, the modifications will
be saved.
Cancel
Closes the Edit Event (Simple) window without adding or modifying any events.
Event type
Lists all categories of events in the OnGuard system. This field is used in combination with the
Event category drop-down to filter what events are listed in the Events drop-down.
Event category
Allows the events in the Events drop-down listbox to be filtered based on the category. Non-
receiver/intrusion events and receiver/intrusion events are available in this drop-down; in the
Simple user interface only non-receiver/intrusion events are available.
Events
Lists all events for the selected event type and event category.
Parameterized
Select this check box to generate an event that uses event parameters.
Note: Not all events support parameters. For more information on event parameters, refer to
the OpenDevice Events Guide in the OnGuard Software Development Kit (Program
Files (x86)\OnGuard Software Development Kit\OpenDevice).
Parameter
Enter the parameter value associated with the event to generate. For more information, refer to
the OpenDevice Events Guide for events that have the sb_EventParam listed.
Message type
Indicates the message type of the event. The available choices are: Event, Status, Video. Most
messages will be of the Event type. Status messages are for messages which pass back status
information and will not display in Alarm Monitoring. Video events are special events used by
video.
Data type
Indicates the type of additional data to be used with the message. For example, some messages
can have a badge ID and a specific data type will be used for these so this information can be
passed back.
The fields available on this window for the data type change depending on which data type is
selected. For example, if the EVENT_DATA_TYPE_STATUS data type is selected, the New
status, Old status, and Comm status fields are displayed and active.
There are six custom data fields: data1, data2, data3, data4, dat5, and data6. If a data type uses
custom fields, then the field names are displayed instead of data1, data2, data3, etc.
When a data type contains less than six custom data fields, the extra fields are disabled. For
example:
• New status = data1
• Old status = data2
• Comm status = data3
• data4, data5 and data6 are not used and are disabled
If your event does not have additional data, use the EVENT_DATA_TYPE_STATUS.
For more information, refer to Custom Data Fields Displayed for Each Data Type Setting on
page 278.
Text
Enter text to be associated with the event
Device ID
This is a downstream device ID that can be used to represent the event is from a downstream
device instead of just from a panel. OnGuard uses a three tiered device ID in the format P-D-I;
this is the second value.
Panel ID
If the Override Event Generator’s panel ID option is being used, you will need to specify the
panel ID that will be used for the event in replacement for the event generator’s panel ID.
Account Number
Enter the account number for the receiver. This number is then displayed in Alarm Monitoring
under the Controller column.
Note: When using the Event Code Template drop-down list, the Event type, Event
category, and Events drop-down lists are not used.
OK
If adding a new event, the event will be added. If modifying an event, the modifications will
be saved.
Cancel
Closes the Edit Event (Advanced) window without adding or modifying any events
EVENT_DATA_TYPE_FC (Facility Code) Facility code - Facility code associated with the
event.
Issue code - Issue code.
File
Save Events
Saves the event list as a file with an EVT extension. This is generally done after the event
configuration has been completed.
Load Events
Enables you to load a previously saved event configuration.
Edit
Create Event
Contains a sub-menu of options that are used to create events.
– Create Event (Advanced): Enables you to create an event using additional advanced
parameters that are not available in the simple mode.
– Create Event (Simple): Enables you to create an event using the least number of
parameters possible.
Modify Event
Contains a sub-menu of options that are used to modify events.
– Modify Event (Advanced): For a selected event, displays the basic parameters and
enables you to change them.
– Modify Event (Simple): For a selected event, displays advanced parameters and
enables you to change them.
Delete Event
Used to delete a selected event. A confirmation message is displayed before the actual deletion
occurs.
Clear Events
Clears all events listed in the main window. Make sure to save the events before executing this
command if you wish to use the events in the future; otherwise, you will need to recreate them.
Send Event
This option in the Edit menu performs the same function as Send Event. For more
information, refer to Send Event on page 280.
Generate Events
This option in the Edit menu performs the same function as Generate Events. For more
information, refer to Generate Events on page 281.
Send Event
Generates a single selected event, which is then sent to Alarm Monitoring.
Generate Events
Generates multiple events according to the configured frequency settings, and sends them to
Alarm Monitoring.
Note: If you receive an information message stating that the LnlEventGeneratoru.dll already
exists in the C:\Program Files (x86)\OnGuard directory, replace the file.
3. Register the LnlEventGeneratoru.dll. For more information, refer to Registering the
LnlEventGeneratoru.dll on page 282.
4. In the OnGuard software, add hardware such as access panels, readers, and so on. Keep in mind
this hardware does not have to be “online”; it might even be hardware that doesn’t really exist.
5. Run the Event Generator Setup Tool. To do this, navigate to the EventGeneratorSetupTool.exe
file in your OnGuard installation directory (C:\Program Files (x86)\OnGuard) and double-
click it.
Note: If you receive an error saying that the LnlFCDBu.dll file could not be found in the
specified path, register the LnlEventGeneratoru.dll. For more information, refer to
Registering the LnlEventGeneratoru.dll on page 282.
6. Click [Add Necessary Information].
b. Right-click on the icon in the system tray, and then select Open Communication
Server. The Communication Server will open in one window, and the Event Generator will
open in another window.
6. The Open With window opens. Click [Browse...], navigate to C:\Windows\system32, and then
double-click on the regsvr32.exe file.
Note: Run the regsvr32.exe file as an administrator. Otherwise, an error message will appear.
7. In the Open With window, Microsoft Register Server will now be highlighted. Click [OK].
The following message is displayed, indicating that the file was successfully registered:
8. The LnlEventGeneratoru.dll file is now registered. If you were setting up Event Generator,
return to Setting Up the Event Generator on page 281.
Generating Events
Events are generated differently depending on whether you are generating a single event or multiple
events.
This appendix provides copyright and licensing information for libraries, encoding algorithms,
templates, and so on used by the LS OpenAccess web service and the REST API.
Entity Framework
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by
Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is
granting the License.
"Legal Entity" shall mean the union of the acting entity and all other entities that control, are
controlled by, or are under common control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the direction or management of such entity,
whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding
shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this
License.
"Source" form shall mean the preferred form for making modifications, including but not limited to
software source code, documentation source, and configuration files.
"Object" form shall mean any form resulting from mechanical transformation or translation of a
Source form, including but not limited to compiled object code, generated documentation, and
conversions to other media types.
contained within such NOTICE file, excluding those notices that do not pertain to any
part of the Derivative Works, in at least one of the following places: within a NOTICE
text file distributed as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or, within a display
generated by the Derivative Works, if and wherever such third-party notices normally
appear. The contents of the NOTICE file are for informational purposes only and do not
modify the License. You may add Your own attribution notices within Derivative Works
that You distribute, alongside or as an addendum to the NOTICE text from the Work,
provided that such additional attribution notices cannot be construed as modifying the
License.
You may add Your own copyright statement to Your modifications and may provide
additional or different license terms and conditions for use, reproduction, or distribution
of Your modifications, or for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with the conditions
stated in this License.
5. Submission of Contributions.
Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the
Work by You to the Licensor shall be under the terms and conditions of this License, without any
additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed with Licensor regarding such
Contributions.
6. Trademarks.
This License does not grant permission to use the trade names, trademarks, service marks, or product
names of the Licensor, except as required for reasonable and customary use in describing the origin of
the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty.
Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any
warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS
FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of
using or redistributing the Work and assume any risks associated with Your exercise of permissions
under this License.
8. Limitation of Liability.
In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in
writing, shall any Contributor be liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a result of this License or out of the
use or inability to use the Work (including but not limited to damages for loss of goodwill, work
stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even
if such Contributor has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability.
While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee
for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent
with this License. However, in accepting such obligations, You may act only on Your own behalf and
on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to
indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims
asserted against, such Contributor by reason of your accepting any such warranty or additional
liability.
Antlr
ANTLR 4 License, viewable at www.antlr.org/license.html
Copyright (c) 2012 Terence Parr and Sam Harwell. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted
provided that the following conditions are met:
• Redistributions of source code must retain the above copyright notice, this list of conditions and
the following disclaimer.
• Redistributions in binary form must reproduce the above copyright notice, this list of conditions
and the following disclaimer in the documentation and/or other materials provided with the
distribution.
• Neither the name of the author nor the names of its contributors may be used to endorse or
promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
“AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Newtonsoft.Json
The MIT License (MIT)
Copyright (c) 2007 James Newton-King
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
SignalR
Copyright © Microsoft Open Technologies, Inc. All rights reserved. Licensed under the Apache
License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. Unless
required by applicable law or agreed to in writing, software distributed under the License is
distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
either express or implied. See the License for the specific language governing permissions and
limitations under the License.
R
Reference ....................................................... 161
Registering the LnlEventGeneratoru.dll ... 281
Response headers ............................................ 29
REST API Reference ...................................... 43
S
Sample applications ........................................ 25
sample C# applications ........................ 27
sample Java application ....................... 28
sample web applications ...................... 25
Sample code
retrieve error information .................. 251
Saving an event list ....................................... 285
SDK definition ................................................ 18
Secure Socket Layer ................................ 11, 22
Security identifier ........................................... 33
Sending alarms to OnGuard ........................ 251
Setting up the Event Generator .................. 281
SignalR ........................................................... 135
Software events ............................................. 153
SSL ............................................................. 11, 22
StartManaging ............................................... 139
Status events .................................................. 148
StopManaging ............................................... 139
StopSubscription ........................................... 138
Subscriptions ................................................... 62
event filters ............................................. 62
event queues ........................................... 19
overview ................................................. 19
using event filters .................................. 62
Swagger specification and documentation . 29
T
Test Event From alarm ................................. 252
Transmitter events ........................................ 148
Troubleshooting ............................................ 263