--- title: UniFi On Prem API Integration on Truto slug: unifionprem category: Security canonical: "https://truto.one/integrations/detail/unifionprem/" --- # UniFi On Prem API Integration on Truto **Category:** Security **Status:** Beta ## Unified APIs ### Unified User Directory API - **Groups** — Groups are a collection of users in the source application. In some applications, they might also be called Teams. - **Users** — The User object represents a User. ## MCP-ready AI tools Truto exposes 109 tools for UniFi On Prem that AI agents can call directly. - **create_a_uni_fi_on_prem_user** — Register a new user in UniFi Access. Returns the created user object including its id, first_name, last_name, user_email, employee_number, onboard_time, status, and assigned access policies. Required: first_name, last_name. - **update_a_uni_fi_on_prem_user_by_id** — Update a user's details in UniFi Access by id. Returns the updated user object including its id, first_name, last_name, user_email, employee_number, onboard_time, status, and assigned access policies. Required: id. - **get_single_uni_fi_on_prem_user_by_id** — Get a single UniFi Access user by id. Returns the full user object including its id, first_name, last_name, user_email, employee_number, onboard_time, status, access policies, NFC cards, license plates, PIN code, and touch pass. Required: id. - **list_all_uni_fi_on_prem_users** — List all UniFi Access users with pagination. Returns each user's id, first_name, last_name, user_email, employee_number, onboard_time, status, access policies, NFC cards, license plates, PIN code, and touch pass. Optional: expand to include access policies. - **uni_fi_on_prem_users_assign_access_policy** — Assign or replace access policies for a UniFi Access user. Pass an array of access policy IDs to set the user's assigned policies; pass an empty array to remove all policies. Returns an empty 204 response on success. Required: user_id, access_policy_ids. - **uni_fi_on_prem_users_assign_nfc_card** — Assign an NFC card to a UniFi Access user by providing the card token. Use force_add to overwrite a card already assigned to another user. Returns a success confirmation with no data payload. Required: user_id, token. - **uni_fi_on_prem_users_unassign_nfc_card** — Unassign an NFC card from a UniFi Access user by providing the card token. Returns a success confirmation with no data payload. Required: user_id, token. - **uni_fi_on_prem_users_assign_pin_code** — Assign a PIN code to a UniFi Access user for unlocking doors. Returns a success confirmation with no data payload. Required: user_id, pin_code. - **uni_fi_on_prem_users_unassign_pin_code** — Unassign the PIN code from a UniFi Access user. Returns a success confirmation with no data payload. Required: user_id. - **uni_fi_on_prem_users_list_access_policies** — List the access policies assigned to a UniFi Access user, including policies inherited from the user's group unless filtered. Returns: id, name, resources, schedule_id. Required: user_id. - **delete_a_uni_fi_on_prem_user_by_id** — Delete a UniFi Access user by id. Returns an empty 204 response on success. Required: id. - **uni_fi_on_prem_users_search** — Search UniFi Access users. Returns matching user records including id, first_name, last_name, full_name, email, user_email, status, email_status, alias, avatar_relative_path, employee_number, nfc_cards, onboard_time, phone, pin_code, and username. - **uni_fi_on_prem_users_assign_touch_pass** — Assign a suspended or inactive Touch Pass to a specific user in UniFi Access. Returns the Touch Pass object including id, card_id, status, user_id, user_name, and user_email. Required: user_id, touch_pass_id. Requires UniFi Access version 3.2.20 or later. - **uni_fi_on_prem_users_unassign_touch_pass** — Unassign a Touch Pass from a specific user in UniFi Access. Returns the Touch Pass object with id, card_id, card_name, status, last_activity, bundles, and user fields after unassignment. Required: user_id. Requires UniFi Access version 3.2.20 or later. - **uni_fi_on_prem_users_batch_assign_touch_passes** — Batch assign unassigned Touch Passes to users in UniFi Access using their email addresses. Returns an array of Touch Pass objects with id, card_id, card_name, status, last_activity, bundles, and user assignment details. Required: ids. Requires UniFi Access version 3.2.20 or later. - **uni_fi_on_prem_users_assign_license_plate** — Assign one or more license plate numbers to a specific user in UniFi Access. Returns an empty response on success. Required: user_id. UniFi Access version 3.3.10 or later is required. - **uni_fi_on_prem_users_unassign_license_plate** — Unassign a specific license plate number from a user in UniFi Access. Returns an empty response on success. Required: user_id, license_plate_id. UniFi Access version 3.3.10 or later is required. - **uni_fi_on_prem_users_upload_profile_picture** — Upload a profile picture for a user in UniFi Access. Returns: avatar_url. Required: user_id. Only supported for local users; UI Account users must update their picture through the UI Account interface. UniFi Access version 3.3.10 or later is required. - **create_a_uni_fi_on_prem_user_group** — Create a new user group in UniFi Access. Returns: id. Required: name. - **list_all_uni_fi_on_prem_user_groups** — List all user groups in UniFi Access. Returns: id, name, full_name, up_id, up_ids. - **get_single_uni_fi_on_prem_user_group_by_id** — Get a single user group by id in UniFi Access. Returns: id, name, full_name, up_id, up_ids. Required: id. - **update_a_uni_fi_on_prem_user_group_by_id** — Update a user group by id in UniFi Access. Returns: id, name, full_name, up_id, up_ids. Required: id, name. - **delete_a_uni_fi_on_prem_user_group_by_id** — Delete a user group by id in UniFi Access. Returns an empty 204 response on success. Required: id. - **uni_fi_on_prem_user_groups_assign_user** — Assign users to a user group in UniFi Access by supplying an array of user identity IDs in the request body. Returns a success confirmation with no data payload. Required: user_group_id. - **uni_fi_on_prem_user_groups_unassign_user** — Remove users from a user group in UniFi Access by supplying an array of user identity IDs in the request body. Returns a success confirmation with no data payload. Required: user_group_id. - **uni_fi_on_prem_user_groups_list_all_users** — List all users across UniFi on-premises user groups, including users in subgroups. Returns: id, first_name, last_name, full_name, email, user_email, status, email_status, employee_number, phone, username, alias, avatar_relative_path, onboard_time. - **uni_fi_on_prem_user_groups_assign_access_policy** — Assign access policies to a UniFi on-premises user group by providing the access policy IDs. Returns an empty 204 response on success. Required: user_group_id, access_policy_ids. - **uni_fi_on_prem_user_groups_list_access_policies** — List the access policies assigned to a user group in UniFi Access. Returns each policy's id, name, resources (door groups and doors), and schedule_id. Required: user_group_id. - **create_a_uni_fi_on_prem_visitor** — Create a new visitor in UniFi Access with personal details, visit schedule, and door access resources. Returns: id, first_name, last_name, status, schedule_id, resources, nfc_cards, license_plates, pin_code, schedule. Required: first_name, last_name. - **get_single_uni_fi_on_prem_visitor_by_id** — Get a single UniFi Access visitor by id. Returns: id, first_name, last_name, status, schedule_id, resources, nfc_cards, license_plates, pin_code, schedule. Required: id. - **list_all_uni_fi_on_prem_visitors** — List all visitors in UniFi Access. Returns: id, first_name, last_name, status, schedule_id, resources, nfc_cards, license_plates, pin_code, schedule. Supports optional status filtering, keyword prefix search on visitor names, and expandable related objects. - **update_a_uni_fi_on_prem_visitor_by_id** — Update a visitor in UniFi Access by id. Returns: first_name, id, last_name, nfc_cards, license_plates, pin_code, resources, schedule, schedule_id, status. Required: id. Status change is not supported. - **delete_a_uni_fi_on_prem_visitor_by_id** — Delete a visitor in UniFi Access by id. If the is_force query parameter is set, physically deletes the visitor; otherwise updates the visitor to canceled status. Returns an empty 204 response on success. Required: id. - **uni_fi_on_prem_visitors_assign_nfc_card** — Assign an NFC card to a visitor in UniFi Access by providing the card token. Returns a success response with no data payload. Required: visitor_id, token. - **uni_fi_on_prem_visitors_unassign_nfc_card** — Unassign an NFC card from a visitor in UniFi Access by providing the card token. Returns a success response with no data payload. Required: visitor_id, token. - **uni_fi_on_prem_visitors_assign_pin_code** — Assign a PIN code to a UniFi Identity visitor so the visitor can unlock doors. The PIN code must first be generated via the /api/v1/developer/pin_codes endpoint. Returns a success response with no data payload. Required: visitor_id, pin_code. - **uni_fi_on_prem_visitors_unassign_pin_code** — Unassign the PIN code from a visitor in UniFi Access. Returns an empty 204 response on success. Required: visitor_id. - **uni_fi_on_prem_visitors_assign_qr_code** — Assign a QR code to a visitor in UniFi Access. Returns an empty 204 response on success. Required: visitor_id. UniFi Access version 3.3.10 or later required. - **uni_fi_on_prem_visitors_unassign_qr_code** — Unassign (remove) a QR code from a visitor in UniFi Access. Returns an empty 204 response on success. Required: visitor_id. UniFi Access version 3.3.10 or later required. - **uni_fi_on_prem_visitors_assign_license_plate** — Assign one or more license plate numbers to a visitor in UniFi Access. Returns an empty 204 response on success. Required: visitor_id and a request body containing a list of license plate numbers. UniFi Access version 3.3.10 or later required. - **uni_fi_on_prem_visitors_unassign_license_plate** — Unassign a license plate number from a visitor in UniFi Access. Returns an empty 204 response on success. Required: visitor_id, license_plate_id. UniFi Access version 3.3.10 or later required. - **create_a_uni_fi_on_prem_access_policy** — Create a new access policy in UniFi Access. Returns: id. Required: name, schedule_id. - **update_a_uni_fi_on_prem_access_policy_by_id** — Update a UniFi access policy by id, modifying only the fields supplied in the request body. Returns the string 'success' confirming the update. Required: id. All body fields (name, resource, schedule_id) are optional — omit any that do not need to change. - **delete_a_uni_fi_on_prem_access_policy_by_id** — Delete a UniFi access policy by id. Returns an empty 204 response on success. Required: id. - **get_single_uni_fi_on_prem_access_policy_by_id** — Get a single UniFi Access access policy by id. Returns: id, name, resources, schedule_id. Required: id. - **list_all_uni_fi_on_prem_access_policies** — List all UniFi Access access policies. Returns each policy with id, name, resources (doors and door groups), and schedule_id. - **create_a_uni_fi_on_prem_holiday_group** — Create a new holiday group in UniFi Access with a name and an optional list of holidays. Returns the created holiday group including its id, name, description, is_default, template_name, and holidays array. Required: name. - **update_a_uni_fi_on_prem_holiday_group_by_id** — Update a holiday group in UniFi Access by id, including its name, description, and holidays. Returns the updated holiday group including its id, name, description, is_default, template_name, and holidays array. Required: id, name. - **delete_a_uni_fi_on_prem_holiday_group_by_id** — Delete a holiday group in UniFi Access by id. Returns a success confirmation string. Required: id. - **get_single_uni_fi_on_prem_holiday_group_by_id** — Get a UniFi Access holiday group by id. Returns: id, name, is_default, description, holidays, template_name. Required: id. - **list_all_uni_fi_on_prem_holiday_groups** — List all holiday groups in UniFi Access. Returns: id, name, description, count. - **create_a_uni_fi_on_prem_schedule** — Create a door access schedule in UniFi Access. Returns the created schedule including its id, name, type, is_default, weekly schedule, holiday_group_id, holiday_group, and holiday_schedule. Required: name, week_schedule. - **update_a_uni_fi_on_prem_schedule_by_id** — Update a door access schedule in UniFi Access by id. Returns the updated schedule including its id, name, type, is_default, weekly schedule, holiday_group_id, holiday_group, and holiday_schedule. Required: id. - **get_single_uni_fi_on_prem_schedule_by_id** — Fetch a door access schedule in UniFi Access by id. Returns the schedule including its id, name, type, is_default, weekly schedule, holiday_group_id, holiday_group, and holiday_schedule. Required: id. - **list_all_uni_fi_on_prem_schedules** — List all door access schedules in UniFi Access on-premises. Returns each schedule with id, name, type, is_default, status, holiday_group_id, weekly time slots, holiday_group, and holiday_schedule. - **delete_a_uni_fi_on_prem_schedule_by_id** — Delete a door access schedule in UniFi Access on-premises by id. Returns an empty 204 response on success. Required: id. - **uni_fi_on_prem_credentials_generate_pin_code** — Generate a new PIN code in UniFi Access for unlocking doors. Returns the generated PIN code as a string, which can then be assigned to a user or visitor via the pin_codes assignment endpoints. The PIN code length must meet the system's preset requirements. - **uni_fi_on_prem_credentials_enroll_nfc_card** — Create an NFC card enrollment session by waking up a UA reader in UniFi Access. Returns: session_id. Required: device_id. - **uni_fi_on_prem_credentials_get_nfc_enrollment_status** — Poll a UniFi Access UA reader to fetch the NFC card enrollment status and generated card tokens for a given session. Returns: card_id, token. Required: session_id. This is a polling endpoint — until enrollment completes the response data may be a simple status string rather than the card_id/token object. - **uni_fi_on_prem_credentials_delete_nfc_enrollment_session** — Delete an NFC card enrollment session in UniFi Access. Returns an empty 204 response on success. Required: session_id. - **uni_fi_on_prem_credentials_download_qr_code_image** — Download a QR code image for a credential in UniFi Access. Returns: card_id, token. Required: qr_code_id. - **get_single_uni_fi_on_prem_nfc_card_by_id** — Get a single NFC card in UniFi Access by its token. Returns: token, display_id, status, alias, card_type, note, user_id, user_type, user. Required: id. - **list_all_uni_fi_on_prem_nfc_cards** — List all NFC cards in UniFi Access, optionally filtered by alias. Returns: token, display_id, status, alias, card_type, note, user_id, user_type, user. Optional: alias. - **delete_a_uni_fi_on_prem_nfc_card_by_id** — Delete an NFC card in UniFi Access by its token. Returns a success confirmation. Required: id. - **update_a_uni_fi_on_prem_nfc_card_by_id** — Update an NFC card in UniFi Access. Returns the updated card object including token, display_id, status, alias, card_type, note, user_id, user_type, and user. Required: id. Requires UniFi Access version 3.1.30 or later. - **uni_fi_on_prem_nfc_cards_import_third_party** — Import third-party NFC card IDs into UniFi Access by uploading a CSV file. Returns an array of imported card records, each containing alias, nfc_id, and token. An empty token indicates the import failed for that record. Required: file (CSV with NFC IDs in uppercase hexadecimal and optional unique aliases). Duplicate aliases cause the import to fail. Requires UniFi Access v3.3.10 or later. - **list_all_uni_fi_on_prem_touch_passes** — List all Touch Passes in UniFi Access, optionally filtered by status. Returns: id, card_id, card_name, status, last_activity, activated_at, expired_at, user_id, user_name, user_email, user_status, user_avatar, bundles. - **uni_fi_on_prem_touch_passes_search** — Search Touch Passes in UniFi Access by a condition such as card ID or user name. Returns: id, card_id, card_name, status, last_activity, activated_at, expired_at, user_id, user_name, user_email, user_status, user_avatar, bundles. Required: condition. Requires UniFi Access version 3.2.20 or later. - **uni_fi_on_prem_touch_passes_list_assignable** — List all suspended or inactive Touch Passes available for reassignment in UniFi Access. Returns: id, card_id, card_name, status, last_activity, activated_at, expired_at, user_id, user_name, user_email, user_status, user_avatar, bundles. Requires UniFi Access version 3.2.20 or later. - **update_a_uni_fi_on_prem_touch_pass_by_id** — Update a Touch Pass in UniFi Access by modifying its card name, changing its status (ACTIVE or SUSPENDED), or unbundling devices. Returns: id, card_id, card_name, status, activated_at, expired_at, last_activity, user_id, user_name, user_email, user_avatar, user_status, bundles. Required: id. - **get_single_uni_fi_on_prem_touch_pass_by_id** — Get detailed information about a specific Touch Pass in UniFi Access by id. Returns: id, card_id, card_name, status, activated_at, expired_at, last_activity, user_id, user_name, user_email, user_avatar, user_status, bundles. Required: id. - **uni_fi_on_prem_touch_passes_purchase** — Purchase new Touch Passes in UniFi Access. Returns the purchased pass object including id, card_id, card_name, status (INACTIVE), last_activity, bundles, and unassigned user fields (user_id, user_name, user_email, user_avatar, user_status). Required: count. A valid payment method must be configured in the Access web application before using this API. - **uni_fi_on_prem_spaces_get_door_group_topology** — Fetch the door group topology in UniFi Access, showing the hierarchical arrangement of door groups including the building (all doors) and custom access groups. Returns: id, name, type, resources. - **create_a_uni_fi_on_prem_door_group** — Create a new door group in UniFi Access. Returns: id, type. Required: group_name, resources. The group name must be globally unique. - **get_single_uni_fi_on_prem_door_group_by_id** — Get a single UniFi Access door group by id. Returns: id, name, type, resources. Required: id. - **update_a_uni_fi_on_prem_door_group_by_id** — Update a UniFi Access door group by id. Returns: id, name, type, resources. Required: id. - **list_all_uni_fi_on_prem_door_groups** — List all door groups in UniFi Access. Returns each group's id, name, type, and resources. The list does not include groups of type building. - **delete_a_uni_fi_on_prem_door_group_by_id** — Delete a UniFi Access door group by id. Returns: success. Required: id. - **get_single_uni_fi_on_prem_door_by_id** — Get a single UniFi Access door by id. Returns: id, name, full_name, type, door_lock_relay_status, door_position_status, floor_id, is_bind_hub. Required: id. - **list_all_uni_fi_on_prem_doors** — List all UniFi Access doors. Returns: id, name, full_name, type, door_lock_relay_status, door_position_status, floor_id, is_bind_hub. - **uni_fi_on_prem_doors_remote_unlock** — Remotely unlock a UniFi Access door by door_id. Returns a success acknowledgment string confirming the door unlock. Required: door_id. If either actor_id or actor_name is provided, both must be included. - **uni_fi_on_prem_doors_set_temporary_locking_rule** — Set a temporary locking rule for a UniFi Access door by door_id. Returns: type, ended_time. Required: door_id, type. UniFi Access 1.24.6 or later required. - **uni_fi_on_prem_doors_get_locking_rule** — Fetch the current locking rule for a UniFi Access door by door_id. Returns: type, ended_time. Required: door_id. UniFi Access 1.24.6 or later required. - **uni_fi_on_prem_doors_set_emergency_status** — Set the emergency status (lockdown and/or evacuation) for a specific door in UniFi Access. Returns a success acknowledgment string. Required: door_id. - **uni_fi_on_prem_doors_get_emergency_status** — Fetch the current emergency status for a specific door in UniFi Access. Returns: lockdown, evacuation. Required: door_id. - **list_all_uni_fi_on_prem_devices** — List UniFi Access devices. Returns: id, name, type, alias. Pass refresh=true to bypass the device cache and fetch real-time info (may be slower). - **uni_fi_on_prem_devices_get_access_method_settings** — Fetch the current access method settings of a UniFi Access device. Returns: access_methods, device_id. Required: device_id. UniFi Access version 3.3.10 or later. - **uni_fi_on_prem_devices_trigger_doorbells** — Trigger doorbells on UniFi Access intercom devices. Optionally specify an intercom directory name via room_name to target a specific intercom, or set cancel to true to stop a previously triggered doorbell that is still ringing. Returns a success acknowledgment (the string "success" or null) indicating the doorbell trigger request was accepted. - **uni_fi_on_prem_devices_bulk_update** — Update the access method settings of a UniFi Access device, including NFC, Bluetooth tap/unlock/shake, PIN code, Face Unlock, QR code, and Touch Pass. Returns: access_methods, device_id. Required: device_id. Requires UniFi Access Version 3.3.10 or later. - **list_all_uni_fi_on_prem_system_logs** — List UniFi Access system logs filtered by topic, with optional time-range and actor filters. Returns each log entry including actor, authentication, event, target, and tag. Required: topic. - **uni_fi_on_prem_system_logs_export** — Export UniFi Access system logs to a CSV file filtered by topic and time range. Returns a success confirmation string. Required: topic, since, until, timezone. The since and until period cannot exceed one month. - **uni_fi_on_prem_system_logs_list_resources** — List resources in UniFi On-Prem system logs, returning access-policy-style records with their associated door groups/doors and schedule assignments. Returns: id, name, resources, schedule_id. - **uni_fi_on_prem_system_logs_list_static_resources** — List static resource policies (door groups and doors) recorded in UniFi On-Prem system logs. Returns: id, name, resources (each with id and type), schedule_id. - **uni_fi_on_prem_identity_send_invitations** — Send UniFi Identity invitations to invite users to join UniFi Identity in unifionprem. Returns an array of invitation results containing error_code, error_msg, user_email, and user_id for any failed invitations; an empty array indicates all invitations succeeded. Required: user_id and email for each invitation entry. - **uni_fi_on_prem_identity_list_available_resources** — List available UniFi Identity resources in unifionprem grouped by type. Returns: ev_station, vpn, wifi. Accepts an optional resource_type filter. - **uni_fi_on_prem_identity_assign_user_resources** — Assign UniFi Identity resources to a user in unifionprem by specifying a resource type and list of resource IDs. Returns an empty 204 response on success. Required: user_id, resource_type, resource_ids. - **uni_fi_on_prem_identity_list_user_resources** — List the UniFi Identity access policies (resources) assigned to a specific user in unifionprem. Returns: id, name, resources, schedule_id. Required: user_id. Requires UniFi Access 1.24.6 or later. - **uni_fi_on_prem_identity_assign_group_resources** — Assign UniFi Identity resources to a user group in unifionprem. Returns an empty response on success (data is null). Required: user_group_id, resource_type, resource_ids. - **uni_fi_on_prem_identity_list_group_resources** — Fetch the UniFi Identity resources assigned to a user group in unifionprem. Returns: ev_station, vpn, wifi, camera. Required: user_group_id. - **uni_fi_on_prem_notifications_fetch_websocket** — Fetch real-time notifications from UniFi Access via WebSocket, receiving events such as doorbell rings and doorbell status changes. Returns: channel, token, device_id, device_type, device_name, door_name, controller_id, floor_name, request_id, clear_request_id, in_or_out, create_time, reason_code, door_guard_ids, connected_uah_id, room_id, host_device_mac, remote_call_request_id. UniFi Access… - **uni_fi_on_prem_webhooks_list_events** — List supported webhook events in UniFi Access. Returns: event, description. Some events require UniFi Access version 3.3.10 or later. - **list_all_uni_fi_on_prem_webhooks** — List webhook endpoints configured in UniFi Access. Returns: id, endpoint, name, events, secret, headers. - **create_a_uni_fi_on_prem_webhook** — Create a webhook endpoint in UniFi Access to receive event notifications. Returns: id, endpoint, name, events, secret, headers. Required: name, endpoint, events. - **update_a_uni_fi_on_prem_webhook_by_id** — Update an existing webhook endpoint in UniFi Access by id. Returns: id, endpoint, name, events, secret, headers. Required: id, name, endpoint, events. - **delete_a_uni_fi_on_prem_webhook_by_id** — Delete a webhook endpoint in UniFi Access by id. Returns an empty 204 response on success. Required: id. - **uni_fi_on_prem_webhooks_allow_owner** — Allow a webhook endpoint owner to receive webhook events in UniFi Access. Returns a success confirmation string. Required: endpoint_id. - **uni_fi_on_prem_api_server_upload_certificate** — Upload an HTTPS certificate to the UniFi Access API server on port 12445 in unifionprem. Returns the string 'success' on completion. Required: key, cert. Restarting the Access application is necessary to apply the changes. - **uni_fi_on_prem_api_server_delete_certificate** — Delete the HTTPS certificate from the UniFi Access API server on port 12445 in unifionprem. Returns the string 'success' on completion. Restarting the Access application is necessary to apply the changes. - **list_all_uni_fi_on_prem_group_users** — List users directly assigned to a user group in UniFi Access, excluding users in any subgroups. Returns: id, first_name, last_name, full_name, alias, email, email_status, employee_number, phone, onboard_time, status, user_email, username, avatar_relative_path. Required: user_group_id. ## How it works 1. **Link your customer's UniFi On Prem account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach UniFi On Prem.** The Proxy API is a 1-to-1 mapping of the UniFi On Prem API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Automate physical access provisioning from HRIS** — HR and IT orchestration platforms can create UniFi users, assign them to role-based user groups, upload profile photos, and send Identity app invitations the moment an employee is hired — eliminating manual badge issuance on day one. - **Power visitor management with temporary credentials** — Front-desk and visitor management SaaS can create UniFi visitors, generate time-bound PIN codes, QR codes, or license plate entries tied to a schedule, and automatically revoke access when the visit ends. - **Link space bookings to door access** — Coworking and desk-booking platforms can assign access policies, NFC cards, or Touch Passes scoped to a booking window, so members only unlock the rooms and floors they've paid for during the exact time they've booked. - **Stream physical security events into SIEM and compliance tools** — Security monitoring platforms can consume UniFi webhooks and system logs to build audit trails of door access, detect anomalies, and trigger emergency lockdowns programmatically when a threat is identified. - **Enable remote door control for PropTech and delivery workflows** — Property management and delivery SaaS can remotely unlock doors, set temporary locking rules for events, and pre-provision license plates for expected vehicles — all without operators touching the UniFi console. ## What you can build - **Full credential lifecycle management** — Issue, assign, and revoke NFC cards, PIN codes, QR codes, Touch Passes, and license plates for both users and visitors from within your product's UI. - **Group-based access policy sync** — Create UniFi user groups mirroring your customer's org structure and bind them to access policies and schedules so permissions propagate automatically as membership changes. - **Remote unlock and emergency lockdown controls** — Surface one-click remote door unlock, temporary locking rules, and facility-wide emergency status toggles inside your security or operations dashboard. - **Real-time door and intercom event feeds** — Subscribe to UniFi webhooks and websocket notifications to react to doorbell rings, badge scans, and access denials in real time within your product. - **Unified identity resource assignment** — Assign physical access alongside network resources like WiFi, VPN, and EV charging to individual users or groups through a single onboarding flow. - **Compliance-ready audit log export** — Pull and export UniFi system logs on a schedule to power audit reports showing exactly who accessed which door, when, and with which credential. ## FAQs ### How do end users connect their UniFi On Prem controller to our product? Because UniFi On Prem runs on the customer's own hardware, users authenticate the integration by providing the controller's hostname/URL and an API token generated inside their UniFi console. Truto handles credential storage, refresh, and secure request routing so your app never touches the raw secrets. ### Can we manage both permanent employees and temporary visitors through the same integration? Yes. UniFi models these as separate resources — users (with groups, access policies, and NFC/PIN/Touch Pass credentials) and visitors (with time-bound PIN, QR, NFC, and license plate credentials). Truto exposes distinct endpoints for each so you can build the right workflow for each persona. ### Does the integration support real-time events like door unlocks or doorbell rings? Yes. UniFi On Prem supports both webhooks and a websocket notification channel. You can list available webhook events, register endpoints, and stream real-time signals such as intercom triggers and access attempts into your product. ### Can we sync users and groups using Truto's Unified User Directory API? Yes. UniFi users and user groups are mapped into Truto's Unified User Directory API, so if your product already integrates with other HRIS or directory providers through that unified schema, UniFi On Prem plugs in without additional modeling work. You can still call UniFi-specific endpoints directly when you need granular capabilities like credential assignment. ### What physical access operations can we trigger programmatically? You can remotely unlock doors, set temporary locking rules (e.g., hold-open for an event), toggle emergency lockdown status, retrieve the door group topology, and query per-door locking and emergency state — all via Truto endpoints. ### How do we handle credential enrollment flows like NFC cards? UniFi uses an enrollment session pattern for NFC. Truto exposes endpoints to start an NFC enrollment, poll its status, cancel the session, and then assign the resulting card to a user or visitor. PIN codes and QR codes can be generated directly and assigned in a single call.