​

Kisi Access Control Integration

​

Overview

​

Key Features

• Cloud-based management: Manage access through Kisi’s web platform and mobile app
• Mobile access: Customers can use the Nexudus Passport app to unlock doors remotely
• Automatic provisioning: Access is granted and revoked automatically based on plan changes, bookings, and pass assignments
• Check-in tracking: Door unlock events automatically check customers in/out
• Group-based permissions: Map your inventory (passes, resources) to Kisi groups
• Booking-based temporary access: Automatic access during reservation windows
• Booking guest access: Customers added as booking guests receive access during booking periods

​

Integration Type

​

Capabilities

​

How It Works

​

Access Control Model

• Users represent individuals in the system (mapped to Nexudus customers)
• Groups define collections of locks (doors) that users can access
• Role Assignments link users to groups with specific permissions
• Locks are individual access points managed by Kisi controllers
• Places organize locks within your Kisi account

​

Multi-Door Support

1. In Kisi, create a group (e.g., “24/7 Building Access”)
2. Add the relevant locks to that group in Kisi
3. In Nexudus, map your pass/resource to that group
4. Customers with that pass automatically get access to all locks in the group

​

Prerequisites

1. Active Kisi account with administrator access
2. Kisi API token obtained from your Kisi account settings
3. Kisi system configured with lock controllers installed and online
4. Groups created in Kisi for different access levels (e.g., 24/7 access, business hours only)
5. Nexudus location configured with plans, passes, and resources

​

Obtaining Your Kisi API Token

1. Log in to your Kisi account at web.getkisi.com
2. Go to Settings > API
3. Generate a new API token or copy your existing token
4. Keep this token secure - you’ll need it for the Nexudus integration

​

Configuration

​

Step 1: Connect to Kisi

1. In the Nexudus dashboard, go to Settings > Integrations
2. Find Kisi in the list and click to expand the settings
3. Enable the Enable Kisi integration toggle
4. Enter your Kisi API Token in the API token field
5. (Optional) Configure No access policy - choose whether to suspend or delete user accounts when they lose all access
6. (Optional) Enable Notify customers by email if you want Kisi to send welcome emails (not recommended)
7. Click Save to establish the connection

​

Step 2: Configure Presence Tracking (Optional)

1. In the Presence Tracking section, you’ll see all locks from your Kisi account
2. For each lock, choose an action:
   • Nothing: Door access is tracked in Kisi but doesn’t affect Nexudus
   • Check In: Unlocking this door checks the customer in
   • Check Out: Unlocking this door checks the customer out
   • Toggle: Unlocking switches between checked in and checked out

• Set the main entrance to Check In
• Set the exit door to Check Out
• Set internal doors to Nothing (access granted but doesn’t affect presence)

​

Step 3: Map Passes to Groups

1. In the Passes section, you’ll see all passes configured for this location
2. For each pass, select the Kisi access group that customers should be assigned to when they hold that pass
3. Leave blank if a pass should not grant physical access

• When a customer has an active contract on a plan that includes passes, they automatically receive those passes
• If the pass is mapped to a Kisi group, the customer is added to that group
• When the pass expires or is consumed, access is revoked
• Time-limited passes (e.g., day passes with validity windows) automatically grant and revoke access at the appropriate times

​

Step 4: Map Resources to Groups

1. In the Resources section, you’ll see all resources configured for this location
2. For each resource, select the Kisi access group required to access that space
3. Leave blank if resource bookings should not grant physical access

• When a customer books a resource, Nexudus grants them access 15 minutes before the booking starts
• Access is automatically revoked when the booking ends
• If the booking is cancelled, access is removed immediately
• Booking guests: If a customer is added as a guest to a booking, they also receive access during the booking window

​

Step 5: Save Configuration

1. Review all mappings to ensure they’re correct
2. Click Save to apply the configuration
3. Nexudus will immediately start provisioning access for customers based on the new mappings

​

How Access is Managed

​

When Access is Granted

1. Contract starts: Customer begins a contract on a plan → receives passes included in that plan → assigned to corresponding Kisi groups
2. Pass activated: Customer receives a pass directly (not via a contract) → assigned to the mapped Kisi group
3. Booking created: Customer books a resource → granted access to resource’s group 15 minutes before booking start time
4. Booking guest added: Non-customer is added as a guest on a booking → granted access to resource’s group for the booking duration
5. Check-in with pass: Customer checks in with a pass that grants access → maintains access during the check-in session

​

When Access is Revoked

1. Contract ends or cancelled: Customer loses passes from that contract → removed from corresponding Kisi groups
2. Pass expires: Pass validity ends or usage is consumed → removed from mapped Kisi group
3. Booking ends or cancelled: Booking time expires or is cancelled → access to resource’s group is removed
4. Customer deactivated: Customer account is deactivated → all Kisi access removed (user suspended or deleted based on configuration)
5. Check-in expires: If customer checks out, temporary access may be revoked

​

Access Update Timing

• Immediate updates: Contract changes, pass assignments, and customer deactivations trigger access updates within seconds
• Booking lead time: Booking access is granted 15 minutes before the booking start time
• Background processing: Access updates are queued in background jobs with 5-second debouncing to batch rapid changes
• Event processing: Door unlock events are synced approximately every 9 minutes for check-in tracking

​

No Access Behavior

• The user’s access_enabled flag is set to false in Kisi
• User record remains in Kisi but cannot unlock doors
• Access can be re-enabled if customer regains access
• Recommended for most use cases

• The user is completely removed from Kisi
• User record must be recreated if customer regains access
• Use this option if you need to comply with data retention policies

​

Mobile App Experience

​

Setup for Customers

1. Customer downloads the Nexudus Passport app (iOS or Android)
2. Signs in with their Nexudus credentials
3. App detects Kisi integration is active
4. Customer can view available locks and unlock them remotely

​

Using Mobile Access

1. Customer opens the Nexudus Passport app
2. Navigates to Unlock Doors section
3. Views list of locks they currently have access to
4. Taps Unlock to remotely unlock a door

​

How It Works

1. App requests a device login token from Kisi via Nexudus API
2. Kisi creates a device login associated with the customer’s email
3. Customer can then use the app to unlock doors they have group access to
4. No physical credentials (cards, fobs) are required

​

Troubleshooting

​

Monitoring Integration Errors

​

Business Checkup Dashboard

1. Go to Home > Important Items in the dashboard, or
2. Navigate directly to dashboard.nexudus.com/dashboards/checkup
3. Look for the Access Control Integration tile
4. If there are errors, the tile will be displayed in red

​

What Gets Flagged

• Authentication failures: Invalid credentials or connection errors
• Provisioning errors: Failed attempts to create or update customer access
• Configuration issues: Missing or invalid group mappings
• Synchronization problems: Delays or failures in updating access permissions

• The customer affected
• The nature of the problem
• When the error occurred
• Suggested actions to resolve it

​

Auto-Disable on Authentication Failure

1. Generate a new API token in your Kisi account
2. Re-enable the integration in Settings > Integrations > Kisi
3. Enter the new API token and save

​

Security Considerations

​

Data Shared with Kisi

• Customer data: Full name, email address
• External ID: None (users are looked up by email)
• Notifications: Optional flag to send welcome emails from Kisi

• Phone numbers
• Billing information
• Payment details
• Contract specifics (only group assignments)
• Personal notes or custom fields

​

Network Security

• HTTPS encryption: All communication uses HTTPS (SSL/TLS)
• Bearer token authentication: API token sent with each request via Authorization header
• Rate limiting: Built-in rate limiting prevents API abuse (5 req/sec per org, 1 req/sec for events)
• Integration identifiers: Nexudus identifies itself to Kisi via custom headers

​

Credential Management

• No physical credentials: Kisi is mobile-first; no RFID cards or PINs
• Email-based identity: Users are identified and managed by email address
• Device logins: Mobile app access uses device-specific login tokens
• User passwords: Never shared with Nexudus; authentication is handled by Kisi

​

Advanced Configuration

​

Notification Settings

• Setting: Kisi.Notify (business setting)
• Default: false (no notifications)
• When enabled: Kisi sends welcome emails and enables password login for customers

​

Link Email Address

• Setting: Kisi.LinkEmail (business setting)
• Default: false
• When enabled: Customer email is used for Kisi login authentication

​

Place Filtering

• Setting: Kisi.CheckinPlaceId (business setting)
• Default: Empty (process all places)
• Format: Numeric place ID from Kisi

​

Rate Limiting Key

• Setting: Kisi.RateLimitingKey (business setting)
• Format: Organization identifier from Kisi
• Purpose: Ensures API rate limits are applied correctly across distributed servers

​

Related Documentation

• Access Control Overview
• Passes Configuration
• Plans & Contracts
• Resource Bookings
• Check-ins
• Nexudus Passport App

​

Best Practices

​

Group Organization

• ✅ Good: “24/7 Access”, “Business Hours”, “Meeting Rooms”, “Private Offices”
• ❌ Avoid: “Hot Desk Plan”, “Dedicated Desk Plan” (these are billing products, not access types)

​

Email Address Management

• Ensure customer email addresses are accurate and lowercase
• Kisi uses email as the primary identifier for users
• Duplicate emails will cause conflicts; ensure each customer has a unique email
• If a customer changes their email, update it in both Nexudus and Kisi

​

Booking Access Timing

• Resource access is granted 15 minutes before booking start time
• This lead time ensures customers can access the space even if they arrive early
• Consider this timing when scheduling back-to-back bookings

​

Event Processing Optimization

• Event processing runs approximately every 9 minutes
• Don’t expect instant check-ins from door unlocks; allow up to 10 minutes
• For time-sensitive scenarios, use manual check-in or other methods

​

Access Signature Optimization

• An access signature is a hash of all groups a customer should have access to
• If the signature hasn’t changed, Nexudus skips the update
• This optimization reduces API traffic and improves performance

​

Technical Details

{
  "id": 12345,
  "email": "customer@example.com",
  "name": "John Doe",
  "confirmed": true,
  "access_enabled": true,
  "password_flow_enabled": false,
  "otp_required_for_login": false,
  "groups_count": 2,
  "created_at": "2024-01-01T00:00:00Z",
  "updated_at": "2024-01-01T00:00:00Z"
}

{
  "id": 67890,
  "role_id": "group_basic",
  "group_id": 123,
  "user_id": 456,
  "notify": false
}

{
  "id": 123,
  "name": "24/7 Building Access",
  "place_id": 789
}

{
  "id": 456,
  "name": "Main Entrance",
  "place_id": 789,
  "action": 0
}

{
  "id": 11223344,
  "created_at": "2024-01-01T12:00:00Z",
  "actor_type": "User",
  "actor_id": 12345,
  "actor_name": "John Doe",
  "action": "unlock",
  "success": true,
  "object_id": 456,
  "references": [
    {"id": 789, "type": "Place"}
  ]
}