Skip to content
Developer

Smart locks and access

Connect Nuki, LOQED, QRLock, Comydo and your own locks through Home Assistant, Node-RED or n8n; who may open a lock and how access codes work.

vynst (inwendo ERP) controls doors, gates and cabinets through smart lock connections. A connection belongs to a provider and brings one or more locks. Members, trainers and staff open them in the vynst app. vynst checks each time whether the person may open the lock at that moment and records every attempt in the lock log.

Providers

Provider Mode How it works
Nuki bridge vynst talks to the Nuki Bridge on the local network (host, port, token)
Nuki web_oauth, web_api_token through the Nuki Web API, by sign-in or API token
LOQED loqed_web_api, loqed_bridge_api through the action URLs from the LOQED app
QRLock qrlock_api QRLock creates QR codes that the reader at the door checks
Comydo comydo_webhook a QR scanner at the door asks vynst whether the code is valid
Home Assistant ha_webhook locks from Home Assistant, see Home Assistant
Node-RED nodered_mqtt, nodered_push relays, door openers, Shelly and more from Node-RED, see Node-RED
n8n n8n_push locks from an n8n workflow, see n8n

A new provider only becomes active once you enter its credentials. There is no separate switch for it.

Setting up a connection

A superadmin creates connections in the admin area under SmartLock connections (SmartLock-Verbindungen), or via the API with POST /api/event/smart_lock_connection.json.

Field For Description
bridgeHost, bridgePort, bridgeToken Nuki Bridge address, port (default 8080) and token of the bridge
webClientId, webClientSecret Nuki Web, QRLock OAuth client from Nuki; for QRLock, the email and password of the QRLock account
webApiToken Nuki Web API token instead of sign-in
loqedLockId, loqedOpenUrl, loqedLatchUrl, loqedNightLockUrl, loqedStatusUrl LOQED action URLs from the LOQED app
bridgeHost QRLock optional own API address (default https://hms.qrlock.net/api)
scanDeviceIds Comydo, QRLock allowed readers; for Comydo, 12 hex characters each
scanWebhookSigningSecret Comydo key for signed scanner requests

Secret fields are stored encrypted and are never returned again. If you leave them empty when editing, they stay unchanged.

Then:

  1. Sync devices (Geräte synchronisieren) (POST …/smart_lock_connection/{id}/sync_devices.json): vynst fetches the provider’s locks.
  2. Each lock gets its access rules (see below).
  3. For Nuki Web with sign-in: GET …/{id}/oauth_login.json returns the sign-in address at Nuki.

Home Assistant, Node-RED and n8n create their connection themselves when you release locks there. Even then, nothing can be opened until an administrator syncs the devices in vynst and grants rights.

To try it without hardware, use the virtual locks for Node-RED.

Who may open?

vynst checks at every unlock whether at least one rule matches:

  • Self-service at the lock: certain people, roles or access tags. With event_smart_lock_logged_in_access_enabled, the access type “All logged-in users” applies to every signed-in person.
  • Room or object: the lock belongs to a bookable object with “Smart lock access allowed”.
  • Booking: trainers and participants of a booking may open the lock from about one hour before until one hour after the booking. The event type determines whether trainers and participants may do this.
  • Employment contract or contract group for staff.
  • Superadmin may always open.

Opening in the app and via the API

Call Purpose
GET /api/event/smart_lock/my_accessible.json locks the signed-in person may open
POST /api/event/smart_lock/{id}/unlock.json unlock
POST /api/event/smart_lock/{id}/lock.json lock
GET /api/event/smart_lock/{id}/status.json current state
POST /api/event/smart_lock/{id}/access_code.json create an access code for QR readers
GET /api/event/smart_lock_log lock log (administrators) 
curl --request POST https://your-instance.iw-erp.de/api/event/smart_lock/12/unlock.json \
  --header 'x-iw-jwt-token: <TOKEN>'

An API token can only open what its user would also be allowed to open in the app.

Access codes for QR readers

For Comydo, QRLock and Node-RED locks with a QR code, the app shows a code that the reader at the door checks:

  • A code is valid for 300 seconds. vynst stores only its hash.
  • With QRLock, the QRLock API creates the code.
  • With Comydo, the scanner sends {"device_id": "…", "content": "…"} to /api/event/smart_lock_webhook/comydo.json and receives {"success": true} or an error. It authenticates with the connection’s token (bearer, basic password or the Auth-Key header), or it signs the request: Hash is an HMAC-SHA256 over the Auth-Key, Timestamp and the SHA-256 of the content, and the request may be at most 300 seconds old.

Other access methods

  • Digital member card: its QR code is checked with /api/cp/validate_profile_card.json.
  • Card readers and turnstiles from Gantner report to the attendance lists via webhook.
  • Check-in at a reader through Node-RED or Home Assistant, see those pages.

API

The endpoints are listed under Smart home and automation, under SmartLock, SmartLockConnection and SmartLockLog.