Require invitation identity
- Type
- invitation_require_identity
- Category
- Invitations
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegrationDevice
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — PIN, photo, and verified phone are optional.
Each flag is combined with OR across applicable rows (any true flag wins). Create and update reject the request when a required field is missing — they do not clamp. Photo means a host-attached media slot named photo. PIN is 4–8 digits and is stored hashed on the invite. A verified phone requires a phone contact on the invitation; the phone OTP is scoped to that invite. At redemption, missing PIN, photo, or verified phone still blocks the open. A share (short-term TTL link) cannot carry identity, so creating a share is rejected while any of these flags applies. At least one flag must be true.
When it is enforced
Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.
Where to set it
Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| require_pin | boolean | No | — | When true, the host must set a 4–8 digit PIN (hashed on the invite). |
| require_photo | boolean | No | — | When true, the host must attach a photo media slot named photo. |
| require_verified_phone | boolean | No | — | When true, the invitation must name a phone contact and the guest must complete invite-scoped OTP before use. |
| output | string or integer | No | — | Device policies only. One output of the device, as the device reports it (PalGate `1` or `2`, a Shelly, Tasmota, or Waveshare channel index). When set, the policy binds only actions on that output; when omitted, every output of the device. An output that is not one of the device’s outputs, or `output` on an organization or integration policy, is rejected. If an action’s output cannot be identified, an output-scoped policy denies it. |
How overlapping rows combine
Most-restrictive: boolean OR of each flag across applicable rows. Disabled rows never block. Reject missing identity, do not clamp.
Example
Creating an invitation without a PIN or invitee phone is rejected. A guest who has not verified the phone cannot redeem the link.
{ "require_pin": true, "require_photo": false, "require_verified_phone": true}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Require invitation justification (invitation_require_justification)
- Invitation allowed days (invitation_allowed_days)
- Approval threshold (approval_threshold)
Typed configuration
Section titled “Typed configuration”The OpenAPI contract names this object InvitationIdentityPolicyConfig:
{ "require_pin": true, "require_photo": false, "require_verified_phone": true, "output": "main"}At least one requirement must be true. Applicable rows combine each flag with logical OR; missing required invitation identity is rejected rather than silently omitted.