This article is for IT and security teams reviewing the Sign In App integration with Paxton Net2 before it is set up. It explains what the integration reads from your Net2 system, what it changes, and what Sign In App keeps.
For setup steps, see On-Premise Access Control.
A note on terms: Net2 calls them access levels. In Sign In App they appear on the Access rules tab, and as the Access level you choose when you give a visitor a credential. They are the same thing.
Part 1: Overview
Summary
The integration gives visitors temporary access through your existing Net2 setup. When a visitor is given a credential, Sign In App creates a Net2 user record for them, adds their card or QR token, and gives them access to one of your existing access levels. When the visit ends, it takes that access away again.
The integration only reads your doors, readers, access levels, token types, departments, door groups, time zones and operators. It never creates, changes or deletes them, and it never deletes a Net2 user.
What Sign In App reads from Net2
Net2 version, to check your server is supported.
Access levels: the name and ID of each one. You choose which of these can be given to visitors.
Token types: the name and ID of each one, so a card is registered with the right type.
Readers: the name and ID of each one. Only used if tap to sign in is turned on.
Users: whether a Net2 user already exists with the visitor's email address. With tap to sign in, also the first name, last name and email of the person whose card was used.
Access events: only successful card reads ("access permitted"), and only the card number, time, reader and event ID. Denied reads are ignored. Only used if tap to sign in is turned on.
What Sign In App changes in Net2
A user record for the visitor, with first name, last name, phone and email. The email is stored in user custom field 9, which is how Sign In App finds the record again. No department, PIN, photo, start date or expiry date is set on the user.
A token on that user: the card number of the credential you assigned, or a QR number generated by Sign In App, with its token type.
Temporary access (Net2 v6.7 SR3 and later) to one of your existing access levels, with an expiry date and time. The expiry is 24 hours unless you set a different one. Access starts as soon as it is assigned.
When the visit ends, Sign In App removes the token and revokes the temporary access. This happens:
at the expiry time,
when the visitor signs out, if you have turned that option on, or
when an admin returns the credential in Sign In App.
Net2 also enforces the expiry itself, so access ends on time even if Sign In App cannot reach your server.
Before you start: staff and existing Net2 users
Matching email addresses. If a visitor's email address already belongs to a Net2 user, such as a staff member, Sign In App uses that user instead of creating a new one. Their first name, last name and phone are updated to match Sign In App.
Revoking temporary access. When Sign In App ends a visit, Net2 revokes all temporary access for that user, not only the access Sign In App gave.
To avoid surprises, keep staff on permanent access levels rather than temporary access, and avoid giving a visitor record the same email address as a staff member.
Net2 v6.05 SR2 to v6.6
These versions do not have temporary access, so the integration uses the user's door permission set instead. Everything else in this article applies to both version ranges.
When the visit starts, Sign In App reads the user's current access levels, saves a copy, and replaces them with the access level for the visit. The user record, token and email handling are the same as above.
When the visit ends, Sign In App puts the saved access levels back, so the user has exactly what they had before, and removes the token.
Net2 does not track an end time on these versions. Sign In App ends the access at the expiry time. If Sign In App cannot reach your server at that moment, the access stays in place until the connection is restored.
Existing users: if a visitor's email matches a Net2 user who already has access levels, those levels are swapped for the visit level during the visit and restored afterwards. This is another reason to keep staff and visitor email addresses separate.
What Sign In App never changes
Doors, door groups, readers, controllers, access levels, time zones, token types, departments, operators, alarm settings, user photos and PINs. Sign In App reads some of these, but never creates, edits or deletes any of them.
Sign In App never deletes a Net2 user. After a visit, the user record stays in Net2 with no token and no temporary access.
What Sign In App stores
Information | Where it comes from | Details |
Connection details | Entered by you during setup | Server address, operator username and password. The password is stored encrypted (AES-256-GCM). |
Access levels | Copied from Net2 | Name and Net2 ID. Updated when you refresh the provider in Sign In App. |
Token types | Copied from Net2 | Name and Net2 ID. |
Readers | Copied from Net2, plus your settings | Name and Net2 ID from Net2. You choose the site and direction (sign in or sign out). Only used for tap to sign in. |
Credentials | Entered by you | Name, card number and type of each card you register, or the generated QR number. While a credential is assigned, the Net2 token ID is also kept. |
Visitors | From Sign In App | First name, last name, email and phone, plus their Net2 user ID. |
Assignments | Created by Sign In App | Which credential was given to which visitor, with which access level, for which visit, and when it starts and expires. |
Access events | Not stored | Events are processed as they arrive. Only the ID of the last event handled is kept, for 24 hours, so the same event is not processed twice. A tap creates a sign in or sign out in Sign In App with the person's name, email, time and site. The card number and door are not recorded. |
Saved access levels (Net2 v6.05 SR2 to v6.6 only) | Created by Sign In App, copied from Net2 | For each active visit: the Net2 user, the access level given for the visit, the access levels the user had before, and when access was given. Used to restore the user when the visit ends, then removed. |
When a credential, access level or the whole integration is removed, the related records are marked as deleted and are no longer used.
Tap to sign in
Tap to sign in is optional. When it is turned on, Sign In App checks Net2 for new card reads every five seconds. When a card is used on a reader you have linked to a site, Sign In App looks up who holds that card and signs them in or out, depending on how you set up that reader. Nothing is written to Net2 for this feature.
Part 2: Technical reference
Requirements
A supported Net2 version. Choose the provider in Sign In App that matches your server:
Paxton Net2 (v6.7 SR3 and later)
Paxton Net2 (v6.05 SR2 to v6.6)
Each provider checks the Net2 version when it connects and refuses a server outside its range.
The Net2 Local API enabled in the Net2 Server Configuration Utility, with the Local API service running on the Net2 server.
The Local API licence provided by Sign In Solutions, imported using the Local API Configuration Utility. The licence identifies the integration to Net2 and must allow the custom query endpoint.
A Net2 operator account for the integration. We recommend a dedicated operator. In Sign In App, enter the operator's first and last name as the username. The operator needs permission to:
read access levels, token types, users and events
run custom queries
create and update users
add and remove user tokens
grant and revoke temporary access (v6.7 SR3 and later), or read and write user door permission sets (v6.05 SR2 to v6.6).
It does not need any rights over doors, readers, access levels or operators.
A network connection from Sign In App to the Local API, using one of these:
Tunnel: the Sign In Solutions tunnel installed on the Net2 server connects to the Local API on
https://localhost:8443(v6.7 SR3 and later) orhttp://localhost:8080(v6.05 SR2 to v6.6).Direct: Sign In App connects to the server URL you enter during setup. Include the port in the URL if your Local API is not on the default port. The connection uses HTTPS for v6.7 SR3 and later, and HTTP for v6.05 SR2 to v6.6.
Net2 Local API calls
These are all the Net2 Local API calls the integration makes.
Method | Endpoint | Used for | Effect in Net2 |
POST | /api/v1/authorization/tokens | Sign in as the integration operator (password grant, then refresh token) | None. Session only. |
GET | /api/v1/serverSettings/version | Check the Net2 version (v6.7 SR3 and later) | Read |
GET | /api/v1/versions | Check the Net2 version (v6.05 SR2 to v6.6) | Read |
GET | /api/v1/accesslevels | List access levels | Read |
GET | /api/v1/users/token/types | List token types | Read |
GET | /api/v1/customquery/querydb | The three read-only queries listed below | Read |
GET | /api/v1/events | Read access events (tap to sign in only) | Read |
GET | /api/v1/users/{id} | Read one user's name and email (tap to sign in only) | Read |
POST | /api/v1/users | Create the visitor's user record | Write: creates a user |
PUT | /api/v1/users/{id} | Update the visitor's name or phone | Write: updates a user |
POST | /api/v1/users/{id}/tokens | Add the card or QR token to the user | Write: adds a token |
DELETE | /api/v1/users/{id}/tokens/{tokenId} | Remove that token when the visit ends | Write: removes a token |
POST | /api/v1/temporaryAccess/users/{id} | Give temporary access to one access level, with an expiry (v6.7 SR3 and later) | Write: temporary access |
DELETE | /api/v1/temporaryAccess/users | Revoke the user's temporary access (v6.7 SR3 and later) | Write: temporary access |
GET | /api/v1/users/{id}/doorpermissionset | Read the user's current access levels before a visit (v6.05 SR2 to v6.6) | Read |
PUT | /api/v1/users/{id}/doorpermissionset | Set the visit access level, then restore the previous levels when the visit ends (v6.05 SR2 to v6.6) | Write: user access levels |
On v6.05 SR2 to v6.6, the two door permission set calls replace the temporary access calls.
The integration never calls endpoints for doors, door groups, departments, readers, controllers, time zones, operators, PINs, photos or deleting users, on any version.
Database queries
These are the only queries sent through the custom query endpoint. All three are read-only SELECT statements over Net2's SDK views.
Find an existing user by email:
SELECT userID FROM UsersEx WHERE Field9_50 = '<email>'List readers:
SELECT peripheralID, serialNumber, peripheralName FROM sdk.PeripheralNames WHERE peripheralType = 1Find who holds a card that was used:
SELECT userID FROM sdk.Cards WHERE cardNumber = <number>
Fields used from each response
Response | Fields used |
Authorisation tokens | access_token, refresh_token, expiry |
Server version | The version string only |
Access levels | id, name |
Token types | key, value |
Readers query | peripheralID, peripheralName |
User by email or by card | userID |
User record | firstName, lastName, custom field 9 (email) |
Events | id, eventType and eventDescription (to keep successful reads only), cardNo, eventTime, peripheralID, deviceName. User name fields, door group and address are not used. |
Create user, create token | id only |
What is sent when writing
Call | Body |
Create or update user | firstName, lastName, telephone, isAlarmUser: false, customFields: [{ id: 9, value: <email> }] |
Add token | tokenType, tokenValue (the card or QR number), isLost: false |
Give temporary access | accessLevelId (an existing level), expiryDateTime |
Revoke temporary access | The user ID |
Write door permission set (v6.05 SR2 to v6.6) | The permission set exactly as read, with its access levels replaced by the visit level, or by the saved levels when the visit ends |
Timing
Access levels, token types and readers are read when you refresh the provider in Sign In App, not continuously.
Access events are read every five seconds, only for connections with tap to sign in turned on, up to 25 events at a time. When tap to sign in is first turned on, earlier events are skipped and reading starts from the newest event.
Access ends at the expiry set when the credential was assigned, 24 hours by default.
On v6.7 SR3 and later, Net2 enforces the expiry itself, and Sign In App also removes the token and revokes the access.
On v6.05 SR2 to v6.6, Sign In App ends the access by restoring the previous door permission set and removing the token.