Prohibit master-door invitations
- Type
- prohibit_master_door_invites
- Category
- Invitations
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegrationDevice
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — master doors may be granted on invitations.
Rejects create or update if any granted portal resolves to a listed OpenApp device id. Ids are OpenApp device ULIDs, never client-forged hardware identifiers. Combination unions the id lists so a parent can name building master doors that no child can invite to. Org and integration rows bind members and residents; org admins are exempt unless applies_to includes admin. Device-tier rows bind everyone.
When it is enforced
Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.
Where to set it
Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| master_door_ids | string[] | Yes | — | Non-empty array of OpenApp device ULIDs that invitations must not grant. |
| applies_to | string[] | No | adminmemberresidentall | Principal kinds this row binds, as a non-empty array of admin, member, resident, all. Other kinds, a bare string, and empty arrays are rejected. `all` matches every kind this policy can bind. A caller is every kind it is at once, and a row binds when any of them is listed. When omitted, the default applies. Default: Org/integration: member and resident (admins exempt). Device-tier: everyone, including admins. |
| output | string or integer | No | — | Device policies only. One output of the device, as the device reports it (PalGate `1` or `2`, a Shelly, Tasmota, or Waveshare channel index). When set, the policy binds only actions on that output; when omitted, every output of the device. An output that is not one of the device’s outputs, or `output` on an organization or integration policy, is rejected. If an action’s output cannot be identified, an output-scoped policy denies it. |
How overlapping rows combine
Union of master_door_ids across applicable rows. Reject, do not drop doors.
Example
An invitation that includes the building’s listed master door is rejected even if other doors on the invite are allowed.
{ "master_door_ids": [ "01ARZ3NDEKTSV4RRFFQ69G5FAV" ]}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Own-listing doors only (restrict_to_own_listing_doors)
- Max doors per invitation (max_doors_per_invite)
Typed configuration
Section titled “Typed configuration”The OpenAPI contract names this object ProhibitMasterDoorInvitesPolicyConfig:
{ "master_door_ids": ["01ARZ3NDEKTSV4RRFFQ69G5FAV"], "output": "main"}master_door_ids is a non-empty list of OpenApp device ULIDs. An invitation granting any listed door is rejected.