AI agents and automation overview

If you are building an AI agent, integration script, or retrieval pipeline around physical access, OpenApp exposes the same capabilities through several surfaces. Pick the one that matches who runs the code and how much typing you need.

This guide is for developers and agent authors automating doors, gates, guest access, intercom flows, and building operations — not for end users operating the dashboard alone.

Sectors: private home · shared apartment building · office (incl. coworking) · short-term rental · hotel · campus · locker / parcel matrix — see Model by sector (canonical list and playbook links).

Surfaces at a glance

Surface	Best for	Auth	Notes
HTTP API	Any language, curl proofs, codegen	API key (X-API-Key)	Canonical contract; see API reference and OpenAPI JSON.
Official SDKs	Production services in Python, Rust, Go, TypeScript	API key on client	Shared core for Python/Rust/Node; see SDK overview.
OpenApp Scripting	Bulk provisioning, CI, repeatable building setup	Scripting API + org context	Rhai DSL; see Scripting reference.
MCP server	Cursor / Claude / ChatGPT tool use	Hosted: OAuth or API key; local: API key	Hosted at POST /api/v1/mcp (no scripting tools), or a local stdio / HTTP server. MCP server setup.

Decision guide

Use the HTTP API directly when you need a minimal dependency, are generating a client from OpenAPI, or are proving connectivity before adding an SDK.

Use an SDK when you want typed models, consistent retries and errors, and maintainable integration code in a supported language.

Use OpenApp Scripting when you are provisioning many integrations, devices, or policies in one shot (campus rollouts, scripted demos, migration jobs).

Use MCP when the consumer is an interactive coding agent that should discover orgs, entities, audit events, and actions through tools rather than reading raw OpenAPI. On hosted MCP, what an agent may do is set by the credential’s roles, the agent’s tool allow-list, and its confirmation mode. The local @openapp/mcp-server additionally keeps write tools off until OPENAPP_MCP_ALLOW_WRITES=1.

Safety and policy

Physical actions (switchable.open, public portal open, invite execute) have real-world effects. Automations should:

• Require explicit entity or invite identifiers — never guess ids.
• Respect org policies and roles; use X-Org where the API requires organization context.
• Prefer human confirmation for unlock actions in agent UIs unless policy explicitly allows unattended automation.
• Log correlation ids from ApiErrorResponse for support and audit follow-up.
• Every switchable.* action through the API is audited as entity.action.succeeded or entity.action.denied, attributed to the agent, API key, or user. See Query access and audit activity.

See Build an agent that controls physical access for a concrete setup path.

Task guides

Goal	Guide
STR portfolio (mixed hardware + PMS)	Short-term rental portfolio access
Boutique hotel (unified vs split-stack)	Boutique hotel access playbook
Shared apartment building	Shared apartment building access
Time-bound guest / rental access	Create a time-bound guest invitation via API
Virtual intercom at the door	Virtual intercom — directory, call, unlock
PMS / SIS / IWMS / VRMS bridge, PMS connector	Integrate OpenApp with your existing software
Site people and listing delegation	Manage site people and listing members
PalGate gate / garage	Open a gate with PalGate Cloud
Tasmota / ESP opener	Make a Tasmota ESP an OpenApp opener
Home Assistant bridge	Bridge Home Assistant entities
Audit / compliance signals	Query access and audit activity
Locker / parcel release	Release a locker compartment
MCP server (Cursor / Claude Desktop)	MCP server setup
Voice / ChatGPT / Alexa / Siri	Voice control
ChatGPT Custom GPT	ChatGPT Custom GPT
Access policies (curfews, holds)	Policies
First door open	Open the door with the HTTP API
WhatsApp door command	WhatsApp door commands

Comparisons and positioning

Question	Guide
OpenApp vs Seam	OpenApp vs Seam
OpenApp vs RemoteLock (STR)	OpenApp vs RemoteLock
OpenApp vs ButterflyMX	OpenApp vs ButterflyMX
OpenApp vs Latch	OpenApp vs Latch
OpenApp vs legacy intercom	OpenApp vs legacy intercom
OpenApp vs Brivo	OpenApp vs Brivo
Hotel Salto/Brivo split-stack	OpenApp vs Salto/Brivo hospitality
Unified platform vs split-stack	Unified access platform vs split-stack
Build vs buy (Home Assistant)	OpenApp + Home Assistant access control

Machine-readable index

Crawlers and RAG pipelines can start from docs llms.txt or the product narrative at openapp.house/llms.txt. The extended index is llms-full.txt.

Named agents, copilot, and event skills

• Agents are first-class org principals (dashboard Organization resources → Agents) with confirmation mode, scoped credentials, and actor_kind=agent in audit. A scoped credential reaches only the routes and roles in its scope, can’t manage API keys or agents, read integration secrets, or run scripting, and gets 403 otherwise. An agent’s allowed_entity_ids is intersected with the key’s entity list; an agent with no list is not entity-restricted, so set one.
• Operator copilot uses the same MCP-equivalent tools with review-before-commit (Enrich pattern).
• Event skills (POST /orgs/{org_id}/skills) run as the agent principal when an audit event of a listed type is recorded—including pms.reservation.* events from the PMS connector. Packaged Cursor/Claude skills: packages/openapp-skills/.