Allegion Developer Portal
Allegion Developer Portal
This document is intended to be consumed by partners who have already implemented and are familiar with No-Tour for plastic credential integration.
Schlage Mobile Access Credentials allow the physical access credential cards or fobs normally carried by a patron to be replaced with a mobile credential that is embedded in the patron’s mobile phone. These mobile credentials use Bluetooth Low Energy to communicate with ENGAGE™ Mobile enabled devices. Some Physical Access Control Solution (PACS) providers have built their own patron mobile app and have consumed the Schlage Mobile Access SDK which allows the Schlage Mobile Access Credential to be managed through the PACS patron mobile app. Other PACS, who have not developed a patron mobile app, utilize the Schlage Mobile Access Application to manage the Schlage Mobile Access Credentials.
Below is a table that outlines the core functionality of the Schlage Mobile Access software products.
| Capability | Mobile Credential | No-Tour Basic | API Only Basic |
|---|---|---|---|
| Best in Class Security | Yes | Yes | Yes |
| Communication Technology Used | BLE | BLE | BLE |
| Allows Partner to Build their Own App | Yes | Yes | |
| Allows Partner to leverage Schlage Mobile Access Application | Yes | ||
| Allows No-Tour Capability via Mobile App | Yes | Yes | |
| Unlimited No-Tour Updates | Yes | Yes | |
| Only one Active No-Tour Update Allowed, per User, per Lock | Yes | Yes | |
| Timing and Availability | September 2020 | July 2021 | November 2023 |
| Distribution Channel | Direct to Software Partner | Direct to Software Partner | Direct to Software Partner |
“Mobile Credential” is intended for customers that do not need the functionality of No-Tour.
“No-Tour Basic” builds upon the “Mobile Credential” API by providing basic No-Tour functionality. With “No-Tour Basic” patrons can be given access to an unlimited number of doors; however, a patron may only use No-Tour capabilities for that patron. Patron A cannot carry Patron B’s updated access rights. In “No-Tour Basic” the 11-sector limit that exists in the plastic credential world is now removed.
With the addition of No-Tour capability for mobile credentials, the property administrator is no longer required to tour the door for access updates or use an enrolment reader to program the mobile credentials. The access updates (commands/No Tour Payloads) can be retrieved on the patron’s phone and presented to the lock.
Patrons with Schlage Mobile Access Credentials that utilize No-Tour functionality will no longer need to use physical credentials to gain access to their assigned doors, however software partners may choose to continue to use plastic credentials as-is.
|
Lock Model |
Firmware Version |
|
LEBMB/LEBMS/LEBMD |
03.08.06 |
|
NDEB |
03.08.06 |
|
BE467B/FE410B |
04.09.02 |
|
CTE |
01.06.04 |
|
MTB11/MTB15/MTKB15 |
60.47.18 |
Every request made to the Mobile Credential API must include your subscription key for the "alle-subscription-key" property in the HTTP request header.
To find your subscription key, click on your profile link on the top of this page as seen in this screenshot:
Your profile page provides access to subscription keys for all corresponding product subscriptions.
To see a subscription key for a product, click on “show” next to the key.
To regenerate a subscription key, click on the regenerate text next to the key.
To get an authentication token a POST call is made with username and password. The authentication token expires in 10 hours.
Sample request:
curl -v -X POST "https://api.allegion.com/SMC/Authentication/Tokens"
-H "Content-Type: application/json"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii "{
"username": "xxxxxxxx",
"password": "xxxxxxxx"
}"
The response from the POST call above will be a 200 (OK) with Token, Token Type and Expiry created in the response. The Token from the response must be sent in the HTTP Authorization Header in any authenticated API request.
Sample response:
{
"token": “xxxxxxxxxx”,
"tokenType": “Bearer”,
"expiresIn": 86400
}
Refer to ‘Authentication Token API’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
Before we get into the details of how to create No-Tour Payloads, let us understand how to work with mobile credentials.
The first thing you'll need to begin working with Mobile No-Tour APIs is a mobile credential. No-Tour Payloads will be associated to a mobile credential created for a given User ID.
The following call will create a mobile credential:
Sample request:
curl -v -X POST "https://api.allegion.com/SMC/credentials/mobile"-H "Authorization: Bearer {Token}"-H "Content-Type: application/json"-H "Accept: application/json;version=1"-H "alle-subscription-key: {subscription key}"
--data-ascii "{
"UserId": "1a8e4e48-3727-4eb6-a8a5-a99384ff4a9b",
"CardFormat": "48X",
"CardNumber": 1,
"FacilityCode": 20,
"IssueCode": 1,
"CredSector": 1,
"Attributes": {
"SiteId": "123456",
"SiteName": "My Site Name"
}
}"
The response from the POST call above will be a 201 (CREATED) with Credential ID created in the response.
Sample response:
{
"credentialId": "00000000-0000-0000-0000-000000000000"
}
Refer to ‘Create Credential API’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
You may end up having credentials that you want to delete when you remove the patron. Use the API to delete the unused mobile credential. Depending on the pricing you choose, you may be charged for each active credential, so it is important to delete un-used credentials.
To delete a mobile credential, you can use a DELETE call, specifying the User ID or Credential ID in the URL:
Sample request:
curl -v -X DELETE "https://api.allegion.com/SMC/credentials/mobile/{credentialId}"
-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the DELETE call above will be a 204 (NO CONTENT) with an empty response, and the credential will be deleted.
Sample response: Empty
Refer to ‘Delete Credential’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
Sample request:
curl -v -X DELETE "https://api.allegion.com/SMC/credentials/mobile/users/{userId}"
-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the DELETE call above will be a 204 (NO CONTENT) with an empty response, and the credential will be deleted.
Sample response: Empty
Refer to ‘Delete Credential by UserId’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
To begin working with mobile credentials for Tour or No-Tour access updates, let's first learn how to list existing mobile credentials. (If you have not already created a mobile credential, please see the Creating a mobile credential section.)
If you'd like to see the details of a mobile credential that have been created against a credential ID, you can make a GET mobile credential call by providing the Credential Id.
Sample request:
curl -v -X GET "https://api.allegion.com/SMC/credentials/mobile/{credentialId}"
-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the GET call above will be a 200 (OK) with the below response.
Sample response:
{
"credentialId": "00000000-0000-0000-0000-000000000000",
"userId": "00000000-0000-0000-0000-000000000000",
"payloadType": "string",
"rawData": "string",
"cardFormat": "string",
"cardNumber": 0,
"facilityCode": 0,
"issueCode": 0,
"isDownloaded": true,
"attributes": {}
}
Refer to ‘Get Credential API’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
If you'd like to see the details of mobile credentials that have been created for a patron, you can make a GET mobile credential call by providing the User Id.
Sample request:
curl -v -X GET "https://api.allegion.com/SMC/credentials/mobile/users/{userId}"-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the GET call above will be a 200 (OK) with the below response.
Sample response:
[
{
"credentialId": "00000000-0000-0000-0000-000000000000",
"userId": "00000000-0000-0000-0000-000000000000",
"payloadType": "string",
"rawData": "string",
"cardFormat": "string",
"cardNumber": 0,
"facilityCode": 0,
"issueCode": 0,
"isDownloaded": true,
"attributes": {}
}
]
Refer to ‘Get Credential By User ID API’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
If you'd like to see the list of existing mobile credentials that have been created, you can make a GET all mobile credential call.
Sample request:
curl -v -X GET "https://api.allegion.com/SMC/credentials/mobile”-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the GET call above will be a 200 (OK) with the below response.
Sample response:
[
{
"credentialId": "00000000-0000-0000-0000-000000000000",
"userId": "00000000-0000-0000-0000-000000000000",
"payloadType": "string",
"rawData": "string",
"cardFormat": "string",
"cardNumber": 0,
"facilityCode": 0,
"issueCode": 0,
"isDownloaded": true,
"attributes": {}
}
]
Refer to ‘Get All Credentials API’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
Now that you've created a mobile credential, you can start working on building No-Tour Payloads.
For a patron to receive a mobile no-tour command, they must first have a mobile credential assigned to them. The No-Tour payload can then be created against the Credential ID generated from creating the patron’s mobile credential.
For information on how to create the No-Tour payloads, please refer the documentation for No-Tour integration for plastic credentials or reach out to your Allegion Integration Engineer.
No-Tour Payloads can be created for a mobile credential for one or multiple devices and can be saved to Allegion Cloud using this endpoint.
You may end up having No-Tour Payloads that you want to update when you want to revise the access. In such scenario, save the updates again.
The request to save a No-Tour Payload can be made using a POST call, specifying Credential ID in the URL:
Sample request:
curl -v -X POST "https://api.allegion.com/SMC/credentials/mobile/{credentialId}/NoTour"
-H "Authorization: Bearer {Token}"
-H "Content-Type: application/json"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii "{
"NoTourPayloadDetails": [
{
"LockId": 1234,
"SerialNumber": "EjRWeJq83vEjRWeJq83vEg==",
"NoTourPayload": "123456789ABCDEF123456789ABCDEF123456789ABCDEF123456789ABCDEF123456789ABCDEF123456789ABCDEF123456"
}
]
}"
In the above sample:
Both LockId and SerialNumber are required in the request. The Lock processes the No-Tour Payloads received from the SDK. LockId is analogous to directory sector in the plastic world. SerialNumber is required to uniquely identify a Lock across the ENGAGE system.
The response from the POST call above will be a 201 (CREATED) with an empty response, and the No-Tour Payloads will be saved for a Credential ID..
Sample response: Empty.
You can create No-Tour Payloads against a credential for one or multiple devices/locks.
For example, Alex is a resident of Unit 101 in XYZ's multi-family residence. Alex needs access to the facility's main entrance (Door 1) and Unit 101 (Door 2). The facility administrator assigns Alex’s mobile credential access for Door 1 and Door 2.
In the above example, you can create No-Tour Payloads for Door 1 and Door 2 for Alex’s mobile credentials and save to Allegion Cloud. You cannot associate the No-Tour Payload of another resident of Unit 101 or another user of the facility's main entrance to Alex’s mobile credential.
Refer to ‘Save No-Tour Payloads for CredentialId API’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
You may end up having No-Tour Payloads that you want to delete when you want to revise the access. Please note that this can be performed before the patron has downloaded the latest updates (No-Tour Payloads) on the phone by calling in to the Allegion cloud. If the undesired access updates are downloaded on the patron’s phone, they will be presented to the device/lock on the next access attempt by the user.
One way of removing the undesired No-Tour payloads from the patron’s phone is by deleting the credential and the patron’s mobile application calls in to the Allegion cloud. This way, the patron’s mobile credential and the corresponding No-Tour Payloads are removed from the patron’s phone.
The request to delete No-Tour Payloads can be made using a DELETE call, specifying Credential ID in the URL:
Request template:
curl -v -X DELETE "https://api.allegion.com/SMC/credentials/mobile/{credentialId}/NoTour"
-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the DELETE call above will be a 204 (NO CONTENT) with an empty response, and the all No-Tour Payloads associated with the Credential ID will be deleted.
Sample response: Empty
Refer to ‘Delete No-Tour Payloads by Credential Identifier‘ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.
The request to delete No-Tour Payloads can be made using a DELETE call, specifying Device Serial Number in the URL:
Request template:
curl -v -X DELETE https://api.allegion.com/SMC/credentials/mobile/NoTour/Device/{deviceSerialNumber}"
-H "Authorization: Bearer {Token}"
-H "Accept: application/json;version=1"
-H "alle-subscription-key: {subscription key}"
--data-ascii ""
The response from the DELETE call above will be a 204 (NO CONTENT) with an empty response, and all the No-Tour Payloads associated with the Device Serial Number will be deleted.
Sample response: Empty
Refer to ‘Delete No-Tour Payloads by Device Serial Number’ in ‘SchlageTM Mobile Credentials’ product for detailed API method documentation.