​

Gallagher Access Control Integration

​

Overview

​

Key Features

• On-premises control: Your Command Centre server remains on your local network
• Cloud gateway connectivity: Gallagher’s cloud service bridges Nexudus to your on-premises server
• Multi-region support: Cloud gateway available in US and AU regions for optimal performance
• Automatic provisioning: Access is granted and revoked automatically based on plan changes, bookings, and pass assignments
• Check-in tracking: Use access zone events to automatically check customers in/out
• RFID card support: Multiple RFID cards per customer with configurable card types
• Group-based permissions: Map your inventory (passes, resources, desks) to Gallagher access groups
• Booking-based temporary access: Automatic access during reservation windows
• PIN code support: Optional user code (PIN) for enhanced security

​

Integration Type

​

Capabilities

​

How It Works

​

Access Control Model

• Cardholders represent individuals in the system (mapped to Nexudus customers)
• Access Groups define collections of doors that cardholders can access
• Access Zones are physical areas monitored for check-in/check-out events
• Cards are physical RFID credentials assigned to cardholders
• Divisions organize cardholders within your Gallagher account

​

Multi-Door Support

1. In Gallagher Command Centre, create an access group (e.g., “24/7 Access”)
2. Add the relevant doors to that group in Gallagher
3. In Nexudus, map your pass/resource/desk to that group
4. Customers with that pass automatically get access to all doors in the group

​

Prerequisites

1. Gallagher Command Centre server installed and operational at your location
2. Cloud gateway configured — Gallagher must set up the cloud gateway connection to your on-premises server
3. API key obtained from Gallagher (used for authentication through the cloud gateway)
4. Division ID — The identifier for your organizational division
5. Card Type ID — The card type to use when provisioning cards
6. Region selection — US or AU based on your cloud gateway region
7. Gallagher system configured with access groups and access zones
8. Nexudus location configured with plans, passes, and resources

​

Configuration

​

Step 1: Request Cloud Gateway Setup from Gallagher

1. Contact Gallagher support and request cloud gateway setup for Nexudus integration
2. Provide your details: Share your on-premises Command Centre server information
3. Select region: Choose US or AU based on your location (affects latency)
4. Receive credentials: Gallagher will provide:
   • API key for authentication
   • Division ID
   • Card Type ID
   • Confirmation that the cloud gateway is configured and ready

​

Step 2: Connect Nexudus to Gallagher

1. In the Nexudus dashboard, go to Settings > Integrations
2. Find Gallagher in the list of integrations
3. Enable the Enable Gallagher integration toggle
4. Enter the connection details provided by Gallagher:
   • API Key: Your Gallagher Command Centre API key
   • Region: Select US or AU based on the cloud gateway region configured by Gallagher
   • Division ID: The numeric ID of your division in Gallagher
   • Card Type ID: The ID of the card type to use when creating cards
   • Issue Level: The security level for cards (typically 0 for standard access)
5. Click Save to establish the connection

​

Step 3: Configure Presence Tracking (Optional)

1. In the Presence tracking section, you’ll see all access zones from your Gallagher system
2. For each zone, choose an action:
   • Nothing: Zone access is tracked in Gallagher but doesn’t affect Nexudus
   • Check In: Accessing this zone checks the customer in
   • Check Out: Accessing this zone checks the customer out
   • Toggle: Accessing switches between checked in and checked out

• Set the main entrance zone to Check In
• Set the exit zone to Check Out
• Set internal zones to Nothing (access granted but doesn’t affect presence)

​

Step 4: Map Passes to Access Groups

1. In the Passes section, you’ll see all passes configured for this location
2. For each pass, select a Gallagher access group from the dropdown
   • The dropdown shows all access groups available in your Gallagher system
   • Access groups are automatically retrieved when you save the connection settings
3. Leave blank if a pass should not grant physical access

• When a customer has an active contract on a plan that includes passes, they automatically receive those passes
• If the pass is mapped to a Gallagher access group, the customer is added to that group
• When the pass expires or is consumed, access is revoked
• Time-limited passes (e.g., day passes with validity windows) automatically grant and revoke access at the appropriate times

​

Step 5: Map Resources to Access Groups

1. In the Resources section, you’ll see all resources configured for this location
2. For each resource, select a Gallagher access group from the dropdown
3. Leave blank if resource bookings should not grant physical access

• When a customer books a resource, Nexudus grants them access 15 minutes before the booking starts
• Access is automatically revoked when the booking ends
• If the booking is cancelled, access is removed immediately

​

Step 6: Map Desks/Units to Access Groups

1. In the Desks / Offices section, you’ll see all desks from your floor plans
2. For each desk, select a Gallagher access group from the dropdown
3. Leave blank if desk assignments should not grant physical access

• When a desk is added to a customer’s contract, they receive access to the mapped group
• Access is granted when the contract starts and revoked when it ends
• Team billing support: If a customer uses team billing (merged billing), they also receive access to desks included in the paying member’s contracts

​

Step 7: Save Configuration

1. Review all mappings to ensure they’re correct
2. Click Save to apply the configuration
3. Nexudus will immediately start provisioning access for customers based on the new mappings

​

How Access is Managed

​

When Access is Granted

1. Contract starts: Customer begins a contract on a plan → receives passes included in that plan → assigned to corresponding Gallagher access groups
2. Pass activated: Customer receives a pass directly (not via a contract) → assigned to the mapped Gallagher access group
3. Booking created: Customer books a resource → granted access to resource’s group 15 minutes before booking start time
4. Desk added to contract: Desk is added to an active contract → customer receives access to the desk’s mapped group
5. Booking guest added: Non-customer is added as a guest on a booking → granted access to resource’s group for the booking duration

​

When Access is Revoked

1. Contract ends or cancelled: Customer loses passes from that contract → removed from corresponding Gallagher access groups
2. Pass expires: Pass validity ends or usage is consumed → removed from mapped Gallagher access group
3. Booking ends or cancelled: Booking time expires or is cancelled → access to resource’s group is removed
4. Desk removed from contract: Desk is removed from contract → access to desk’s group is revoked
5. Customer deactivated: Customer account is deactivated → all Gallagher access removed

​

Access Update Timing

• Immediate updates: Contract changes, pass assignments, and customer deactivations trigger access updates within seconds
• Debouncing: Rapid changes to the same customer are batched together (5-second delay) to prevent excessive API calls
• Booking lead time: Booking access is granted 15 minutes before the booking start time
• Background processing: Access updates are queued in background jobs to handle high volumes efficiently
• Distributed locking: Prevents concurrent updates to the same customer across multiple servers

​

RFID Card Management

1. Go to Operations > Customers
2. Select the customer
3. In their profile, enter card IDs in the Access Card ID field
4. Separate multiple cards with commas: 123456,789012,345678
5. Optionally, set a PIN code in the Access PIN Code field (if enabled)
6. Save the customer profile

• No card: Cardholder exists in Gallagher but cannot unlock doors (no physical credentials)
• Card assigned: Customer can use physical RFID card to unlock doors
• PIN code set: Customer can use user code (PIN) if the feature is enabled
• Card removed: Physical access is revoked (cardholder record remains in system)

• Card Type: Configured globally using the Gallagher.CardType setting
• Issue Level: Configured globally using the Gallagher.IssueLevel setting (default: 0)
• User Code (PIN): Enable by setting Gallagher.SetUserCode to true

​

Troubleshooting

​

Monitoring Integration Errors

​

Business Checkup Dashboard

1. Go to Home > Important Items in the dashboard, or
2. Navigate directly to dashboard.nexudus.com/dashboards/checkup
3. Look for the Access Control Integration tile
4. If there are errors, the tile will be displayed in red

​

What Gets Flagged

• Authentication failures: Invalid or expired API keys
• Provisioning errors: Failed attempts to create or update customer access
• Configuration issues: Missing or invalid access group mappings
• Synchronization problems: Delays or failures in updating access permissions
• Event processing errors: Issues reading or processing access zone events

• The customer affected
• The nature of the problem
• When the error occurred
• Suggested actions to resolve it

​

Security Considerations

​

Data Shared with Gallagher

• Customer data: First name, last name
• Description: Format NX-{customerId} (used to link records between systems)
• RFID cards: Card IDs from the Access Card ID field
• User Code: PIN code from the Access PIN Code field (if enabled)
• Division: Organizational division for the cardholder

• Email addresses
• Phone numbers
• Billing information
• Payment details
• CoCloud gateway**: API key authenticates through Gallagher’s cloud gateway, which securely connects to your on-premises server
• HTTPS encryption: All communication uses HTTPS (TLS)
• No scheme prefix: API key sent directly in the Authorization header value
• Regional endpoints: API calls routed to US or AU cloud gateway based on configuration
• No firewall changes: Cloud gateway connects outbound from your server to Gallagher’s cloud, requiring no inbound firewall rules

​

API Authentication

• API Key: Header-based authentication using custom API key
• HTTPS encryption: All communication uses HTTPS (TLS)
• No scheme prefix: API key sent directly in the Authorization header value
• Regional endpoints: API calls routed to US or AU endpoints based on configuration

​

External ID Management

• Description field: Format NX-{customerId} (e.g., NX-12345)
• Lookup method: Cardholders retrieved by searching the description field
• Uniqueness: Description ensures each Nexudus customer maps to one cardholder

​

Related Documentation

• Access Control Overview
• Passes Configuration
• Plans & Contracts
• Resource Bookings
• Check-ins

​

Best Practices

​

Access Group Organization

• ✅ Good: “24/7 Access”, “Business Hours”, “Meeting Rooms”, “Private Offices”
• ❌ Avoid: “Hot Desk Plan”, “Dedicated Desk Plan” (these are billing products, not access types)

​

Multi-Location Management

• Each location can map to the same or different access groups
• The integration handles multiple locations mapping to the same groups automatically
• Use clear naming in Gallagher to distinguish between locations if needed

​

Division Structure

• Use divisions in Gallagher to organize cardholders by location or organizational unit
• All cardholders from a Nexudus location will be created in the configured division
• Ensure access groups are accessible from the division you specify

​

Card Type Configuration

• Configure a default card type that matches your physical RFID cards
• Use the same card type across all customers unless you have specific security requirements
• Set the issue level appropriately based on your security policies

​

User Code (PIN) Support

• Enable user codes only if your Gallagher deployment supports them
• SeDeployment**: On-premises Command Centre server with cloud gateway
• Base URL: https://commandcentre-api-us.security.gallagher.cloud or https://commandcentre-api-au.security.gallagher.cloud
• Authentication: Header Value Authentication (API key in Authorization header)
• API Format: JSON
• Content Type: application/json
• Regional routing: US or AU based on Gallagher.Region setting
• Gateway connection: Cloud API acts as secure proxy to your on-premises server
• Network requirements: Outbound HTTPS connection from Command Centre server to Gallagher cloud (no inbound ports required)

{
  "firstName": "John",
  "lastName": "Doe",
  "description": "NX-12345",
  "authorised": true,
  "usercode": "1234",
  "division": {
    "href": "https://commandcentre-api-us.security.gallagher.cloud/api/divisions/1"
  },
  "cards": [
    {
      "number": "123456",
      "type": {
        "href": "https://commandcentre-api-us.security.gallagher.cloud/api/card_types/1"
      },
      "issueLevel": 0
    }
  ],
  "accessGroups": [
    {
      "accessGroup": {
        "id": "10",
        "name": "24/7 Access",
        "href": "https://commandcentre-api-us.security.gallagher.cloud/api/access_groups/10"
      },
      "href": "..."
    }
  ]
}

{
  "firstName": "John",
  "lastName": "Doe",
  "authorised": true,
  "usercode": "1234",
  "cards": {
    "add": [
      {
        "number": "789012",
        "type": {
          "href": ".../api/card_types/1"
        },
        "issueLevel": 0
      }
    ],
    "remove": [
      {
        "href": ".../api/cards/456"
      }
    ]
  },
  "accessGroups": {
    "add": [
      {
        "accessGroup": {
          "href": ".../api/access_groups/20"
        }
      }
    ],
    "remove": [
      {
        "href": ".../api/cardholders/1/access_groups/10"
      }
    ]
  }
}