Maintenance window
- Type
- maintenance_window
- Category
- Operational
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — no technician-only maintenance window.
Denies opens outside the remaining allowed roles while the local time is inside the window (midnight-wrapping, same as quiet hours). Combination intersects allowed_roles; empty intersection means nobody may open. Technician matching follows invite_creator_roles (listing technician or virtual-access technician suffix). When allowed_roles is omitted, the default is technician. Organization admins are always exempt. Active emergency free egress skips this deny.
When it is enforced
Evaluated when someone opens a door or gate or triggers an entity action. If this policy applies, the open is denied even when roles and grants would otherwise allow it.
Where to set it
Settings → Policies (org) or the integration Policies tab.
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| start | string | Yes | HH:MM | Inclusive start of the window as local `HH:MM` (00:00–23:59). May be later than end (midnight-wrapping, for example 22:30→06:00). |
| end | string | Yes | HH:MM | Inclusive end of the window as local `HH:MM`. At 06:00 the minute 06:00 is blocked and 06:01 is not. |
| allowed_roles | string[] | No | adminintegrations:updateresidenttechnician | Roles that may open during the window. Matching follows invite_creator_roles. Combination intersects lists. Default: ["technician"] |
| applies_to | string[] | No | agentapi_keyinvitationmemberresidentadminall | Principal kinds this row binds, as a non-empty array of agent, api_key, invitation, member, resident, admin, all. Other kinds, a bare string, and empty arrays are rejected. `all` matches every kind this policy can bind. A caller is every kind it is at once, and a row binds when any of them is listed. When omitted, the default applies. Default: Every caller. Org admins are exempt regardless. |
How overlapping rows combine
Most-restrictive: any applicable window that binds the actor may deny; allowed_roles are intersected. Empty intersection means nobody except org admins. Disabled rows never block.
Example
Between 01:00 and 05:00 only a technician or org admin can open. A resident or an invited guest is denied.
{ "start": "01:00", "end": "05:00", "allowed_roles": [ "technician" ]}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Quiet hours (quiet_hours)
- Who may invite (invite_creator_roles)
- Emergency lockdown (emergency_lockdown)