​

OpenPath (Avigilon Alta) Access Control Integration

​

Overview

​

Key Features

• Cloud-based management: Manage access from anywhere through OpenPath’s web platform
• Mobile access: Customers can use the Nexudus Passport app with mobile credentials
• Automatic provisioning: Access is granted and revoked automatically based on plan changes, bookings, and pass assignments
• Check-in tracking: Optionally use reader events to check customers in/out
• Multiple card types: Support for MIFARE CSN, DESFire encrypted cards, and custom card formats
• Group-based permissions: Map your inventory (passes, resources, desks) to OpenPath groups
• Booking-based temporary access: Automatic access during reservation windows
• Visitor cloud keys: Generate time-limited access links for visitors and guests
• Remote unlock: Allow customers to unlock doors remotely through the mobile app
• Multi-region support: Available in US and EU data centers

​

Integration Type

​

Capabilities

​

How It Works

​

Access Control Model

• Users represent individuals in the system (mapped to Nexudus customers)
• Groups define collections of doors/entries that users can access
• Entries are individual access points (doors, gates, turnstiles)
• Credentials are the methods users authenticate with (mobile, cards, cloud keys)
• Readers are the physical devices that grant access at entries

​

Multi-Door Support

1. In OpenPath, create a group (e.g., “24/7 Access”)
2. Add the relevant entries to that group in OpenPath
3. In Nexudus, map your pass/resource/desk to that group by its ID
4. Customers with that pass automatically get access to all entries in the group

​

Credential Types

1. Mobile credentials: Bluetooth-enabled access through the Nexudus Passport app
2. Cloud keys: Time-limited web links for temporary access (primarily for visitors)
3. Physical cards: RFID cards in various formats
   • MIFARE CSN: Simple card serial number (fast, less secure)
   • DESFire: Encrypted card data (secure, recommended)
   • Custom formats: Configurable card formats with facility codes and other fields

​

Prerequisites

1. Active OpenPath account with administrator access
2. API credentials (username and password for API authentication)
3. Organization ID — The numeric identifier for your OpenPath organization
4. Region selection — US or EU based on your data center location
5. OpenPath system configured with readers installed and online
6. Groups created in OpenPath for different access levels (e.g., 24/7 access, business hours only)
7. Nexudus location configured with plans, passes, and resources

​

Configuration

​

Step 1: Connect to OpenPath

1. In the Nexudus dashboard, go to Settings > Integrations
2. Find OpenPath or Avigilon Alta in the list and click Connect
3. Enter your connection details:
   • Username: Your OpenPath API username
   • Password: Your OpenPath API password
   • Organization ID: The numeric ID of your organization
   • Region: Select US or EU based on your data center
4. Click Save to establish the connection

​

Step 2: Configure Credential Type

1. In the Credential Type section, select your card type:
   • Automatic (recommended): Auto-detects based on card number length
     • 14 digits → DESFire (encrypted, secure)
     • Other lengths → MIFARE CSN (fast, less secure)
   • Specific card type: Choose a specific credential type if you have custom cards
2. Card Format (optional): If using custom card formats with facility codes or site codes:
   • Select the card format from the dropdown
   • Enter values for required fields (facility code, company code, etc.)
   • These values apply to all cards issued at this location
3. Click Save

• DESFire (Encrypted): More secure, slightly slower to read
• MIFARE CSN: Faster to read, less secure (uses only the card serial number)
• Automatic: Best for most installations — uses DESFire for 14-digit cards, MIFARE for others

​

Step 3: Configure Presence Tracking (Optional)

1. In the Presence Tracking section, you’ll see all readers from your OpenPath system
2. For each reader, choose an action:
   • Nothing: Reader access is tracked in OpenPath but doesn’t affect Nexudus
   • Check In: Unlocking this reader checks the customer in
   • Check Out: Unlocking this reader checks the customer out
   • Toggle: Unlocking switches between checked in and checked out

• Set the main entrance reader to Check In
• Set the exit reader to Check Out
• Set internal readers to Nothing (access granted but doesn’t affect presence)

​

Step 4: Map Passes to Groups

1. In the Passes section, you’ll see all passes configured for this location
2. For each pass, select the OpenPath Group that customers should be assigned to when they hold that pass
3. Leave blank if a pass should not grant physical access

• When a customer has an active contract on a plan that includes passes, they automatically receive those passes
• If the pass is mapped to an OpenPath group, the customer is added to that group
• When the pass expires or is consumed, access is revoked
• Time-limited passes (e.g., day passes with validity windows) automatically grant and revoke access at the appropriate times

​

Step 5: Map Resources to Groups

1. In the Resources section, you’ll see all resources configured for this location
2. For each resource, select the OpenPath Group required to access that space
3. Leave blank if resource bookings should not grant physical access

• When a customer books a resource, Nexudus grants them access 15 minutes before the booking starts
• Access is automatically revoked 15 minutes after the booking ends
• If the booking is cancelled, access is removed immediately

​

Step 6: Map Desks/Units to Groups

1. In the Desks/Units section, you’ll see all desks from your floor plans
2. For each desk, select the OpenPath Group required to access that area
3. Leave blank if desk assignments should not grant physical access

• When a desk is added to a customer’s contract, they receive access to the mapped group
• Access is granted when the contract starts and revoked when it ends
• Team billing support: If a customer uses team billing (merged billing), they also receive access to desks included in the paying member’s contracts

​

Step 7: Configure Visitor Cloud Keys (Optional)

1. In Settings > Integrations > OpenPath, enable the setting:
   • Send a CloudKey link to visitors: Set to Yes/True
2. Configure CloudKey Guests Entry IDs: Enter the entry IDs that visitors should have access to
   • Format: Comma-separated list of entry IDs (e.g., 123,456,789)
   • Find entry IDs in your OpenPath dashboard under Entries
3. Click Save

1. When you register a visitor in Nexudus, a cloud key link is automatically generated
2. The visitor receives an email with the access link
3. They can open the link on their mobile device to unlock doors
4. Access is valid from 15 minutes before their expected arrival until:
   • Next day at midnight (for general visitors)
   • 15 minutes after booking end time (for booking guests)
5. If the visitor is associated with a booking, they automatically receive access to the booked resource’s entries

• The cloud key is automatically scoped to the resource’s access group
• Access timing matches the booking window (start to end + 15 minutes)
• No need to manually configure entry IDs for booking-based visitors

​

Step 8: Save Configuration

1. Review all mappings to ensure they’re correct
2. Click Save to apply the configuration
3. Nexudus will immediately start provisioning access for customers based on the new mappings

​

How Access is Managed

​

When Access is Granted

1. Contract starts: Customer begins a contract on a plan → receives passes included in that plan → assigned to corresponding OpenPath groups
2. Pass activated: Customer receives a pass directly (not via a contract) → assigned to the mapped OpenPath group
3. Booking created: Customer books a resource → granted access to resource’s group 15 minutes before booking start time
4. Desk added to contract: Desk is added to an active contract → customer receives access to the desk’s mapped group
5. Booking guest added: Non-customer is added as a guest on a booking → granted cloud key access for the booking duration
6. Visitor registered: Visitor is registered → receives cloud key link with time-limited access
7. Check-in active: Customer with a valid pass checks in → maintains access through the check-in period

​

When Access is Revoked

1. Contract ends or cancelled: Customer loses passes from that contract → removed from corresponding OpenPath groups
2. Pass expires: Pass validity ends or usage is consumed → removed from mapped OpenPath group
3. Booking ends or cancelled: Booking time expires or is cancelled → access to resource’s group is removed
4. Desk removed from contract: Desk is removed from contract → access to desk’s group is revoked
5. Customer deactivated: Customer account is deactivated → all OpenPath access removed
6. No access groups remain: If customer has no passes, bookings, or desks → user is deleted from OpenPath

​

Access Update Timing

• Immediate updates: Contract changes, pass assignments, and customer deactivations trigger access updates within seconds (5-second debounce)
• Booking lead time: Booking access is granted 15 minutes before the booking start time
• Background processing: Access updates are queued in background jobs to handle high volumes efficiently
• Event processing: Reader events are synced every 9 minutes for check-in tracking
• Automatic retry: Failed operations retry automatically with exponential backoff (5 retries over 5 minutes)

​

Mobile App Experience

​

Setup for Customers

1. Customer downloads the Nexudus Passport app (iOS or Android)
2. Signs in with their Nexudus credentials
3. App detects OpenPath integration is active
4. Customer receives a mobile credential automatically
5. Customer can view available entries and unlock them remotely

​

Using Mobile Access

1. Customer opens the Nexudus Passport app
2. Navigates to Unlock Doors section
3. Views list of entries they currently have access to
4. Taps Unlock to remotely unlock an entry
5. Can also use Bluetooth proximity unlock if available

​

Mobile Credential Provisioning

• Automatic creation: When a customer receives their first access group, a mobile credential is created
• Manual provisioning (optional): Enable Set Up Mobile Credential in settings to automatically provision the credential for immediate use
• App-based setup: Customers can also provision credentials through the Nexudus Passport app

​

Physical Card Management

1. Go to Operations > Customers
2. Select the customer
3. In their profile, enter card IDs in the Access Card ID field
4. Separate multiple cards with commas: 123456,789012,345678
5. Save the customer profile

• No card: User receives mobile credential only
• Card assigned: User has both physical card and mobile credential
• Card removed: Physical credential is deleted, mobile credential remains

• 14-digit cards: Created as DESFire (encrypted)
• Other lengths: Created as MIFARE CSN
• Specific type selected: Uses the configured credential type

​

Visitor Access

​

Generating Visitor Cloud Keys

1. Register a visitor in Operations > Visitors
2. Enter their email address and expected arrival time
3. Nexudus automatically generates a cloud key link
4. The visitor receives the link via email

1. Open an existing visitor record
2. Click Generate Access Link (if available)
3. Copy the link and send it to the visitor

​

Cloud Key Access Scope

• Access to entries specified in Visitor Entry IDs setting
• Valid from 15 minutes before expected arrival
• Expires at midnight the following day (in location’s timezone)

• Access to all entries in the booked resource’s access group
• Valid from 15 minutes before booking start
• Expires 15 minutes after booking end
• Overrides general visitor entry IDs

1. Visitor opens the link on their mobile device
2. Link opens the OpenPath web interface
3. Visitor can unlock assigned entries
4. Access expires automatically at the configured time

​

Managing Visitor Access

1. Go to Operations > Visitors
2. Select the visitor
3. Click Revoke Access or delete the visitor record
4. The cloud key is immediately invalidated

• The visitor’s expected departure time passes
• The associated booking ends (for booking guests)
• The visitor record is deleted
• The visitor checks out

​

Remote Door Unlock

​

Enabling Remote Unlock

1. In Settings > Integrations > OpenPath, enable:
   • Has Remote Unlock: Set to Yes/True
2. This setting allows customers to unlock doors from anywhere, not just via proximity

​

How Remote Unlock Works

1. Customer opens Nexudus Passport app
2. Selects the entry to unlock
3. Taps Unlock
4. Nexudus sends the unlock command to OpenPath
5. Door unlocks immediately (subject to OpenPath’s configured unlock duration)

​

Troubleshooting

​

Monitoring Integration Errors

​

Business Checkup Dashboard

1. Go to Home > Important Items in the dashboard, or
2. Navigate directly to dashboard.nexudus.com/dashboards/checkup
3. Look for the Access Control Integration tile
4. If there are errors, the tile will be displayed in red

​

What Gets Flagged

• Authentication failures: Expired credentials or invalid API tokens
• Provisioning errors: Failed attempts to create or update customer access
• Configuration issues: Invalid group IDs or missing entries
• Synchronization problems: Delays or failures in updating access permissions
• Credential creation failures: Unable to issue mobile credentials or cards

• The customer affected
• The nature of the problem
• When the error occurred
• Error message from OpenPath
• Suggested actions to resolve it

​

Security Considerations

​

Data Shared with OpenPath

• Customer data: First name, last name, email address
• External ID: Nexudus customer ID (used to link records between systems)
• RFID cards: Card IDs from the Access Card ID field
• Access groups: Group IDs the customer should be assigned to

• Billing information
• Payment details
• Contract specifics (only group assignments)
• Personal notes or custom fields
• Other customers’ information

​

Credential Security

• Mobile credentials: Managed entirely by OpenPath; Nexudus only creates the credential record
• Cloud keys: Time-limited and automatically expire; can be revoked immediately
• Physical cards: Card numbers stored in Nexudus; OpenPath encrypts card data
• Remote unlock: Requires valid authentication to Nexudus Passport app
• User passwords: Never shared with Nexudus; authentication to OpenPath is handled by OpenPath

​

Access Logging

• Who accessed which entry
• When the access occurred
• Which credential was used (mobile, card, cloud key)
• Whether access was granted or denied

​

Related Documentation

• Access Control Overview
• Passes Configuration
• Plans & Contracts
• Resource Bookings
• Check-ins
• Visitor Management

​

Best Practices

​

Group Organization

• ✅ Good: “24/7 Access”, “Business Hours”, “Meeting Rooms”, “Private Offices”
• ❌ Avoid: “Hot Desk Plan”, “Dedicated Desk Plan” (these are billing products, not access types)

​

Credential Strategy

• Issue mobile credentials to all customers (automatic)
• Only issue physical cards when needed (reduces cost and management overhead)
• Use DESFire cards for higher security environments
• Use MIFARE CSN for faster access in low-security areas

• Use cloud keys instead of physical credentials
• Set appropriate expiration times based on visit duration
• For recurring visitors, consider converting them to temporary members

​

Entry Organization in OpenPath

• Group entries by access level (not by physical location)
• Create separate groups for different time restrictions (24/7 vs business hours)
• Use descriptive group names that indicate the access level
• Document which entries belong to which groups

​

Check-in Configuration

• Only enable check-in tracking on primary entrance readers
• Set exit readers to “Check Out” to automatically track departures
• Set interior readers to “Nothing” to avoid redundant check-ins
• Consider using “Toggle” for single-entry/exit locations

​

Technical Details

{
  "id": 12345,
  "externalId": "67890",
  "status": "active",
  "hasRemoteUnlock": true,
  "identity": {
    "firstName": "John",
    "lastName": "Doe",
    "email": "john@example.com"
  },
  "groups": [1, 2, 3]
}

if (cardNumber.Length == 14)
    credentialType = DESFire;  // Encrypted
else
    credentialType = MIFAREC SN;  // Fast

var signature = string.Join(",", groups.OrderBy(x => x));
coworker.SetAccessSignatureForProvider(eAccessSignatureProviderType.OpenPath, signature);