|
Term |
Meaning |
|---|---|
|
Access unit |
A tenant-scoped business access target, such as a door, gate, zone, group, or logical access point. It can be assigned to an identity or visit. |
|
AIS |
Access Integration Service. The HID service that carries ICAP-driven integration work to connected PACSs. It can provide a unified integration path, but does not own ICAP's canonical business data. |
|
Card credential |
A physical-card credential stored separately from the person to whom it is assigned. |
|
Card type |
A tenant-scoped business classification for card credentials that can map to PACS-specific card formats. |
|
Credential |
An ICAP-managed means of identifying a person at an access point. Current types are card and PIN credentials. |
|
Custom field / extension field |
A tenant-defined, typed value stored in an entity's |
|
External ID |
A client-supplied business correlation key/value, separate from ICAP's generated resource ID. |
|
HID Authentication Service |
The HID authentication service that issues the bearer token used to access ICAP, subject to environment configuration. |
|
ICAP |
Identity, Credential and Access Provider: the HIS service that persistently stores and owns the tenant-scoped core access data described here. It can act as the master system of record for data it owns. |
|
Identity |
A durable person record for someone who may require ongoing physical access. It is not an authenticated API user. |
|
JIT |
Just-in-Time. An access or provisioning mechanism (part of the PACS propagation feature) where user accounts, credentials, or access permissions are created, assigned, or activated dynamically at the exact moment of need (such as upon first authentication or visitor check-in), rather than being pre-provisioned statically in advance. |
|
|
The HTTP request header carrying ICAP's current raw numeric resource version for a guarded write. |
|
PACS |
Physical Access Control System. An external system that enforces access and may be connected to ICAP through AIS. |
|
PACS mapping |
The correlation between an ICAP access object or credential type and a remote PACS identifier or format. |
|
PACS transaction |
A record of work requested against a PACS through AIS. It helps track asynchronous downstream progress. |
|
Personal share |
A one-time offer of selected identity or visitor data from one tenant to another. It does not transfer ownership or continuously synchronize records. |
|
PIN credential |
A numeric credential whose value is accepted on create but omitted from ordinary read responses. |
|
Role |
A tenant-scoped collection of permission identifiers. |
|
Role assignment |
The binding of one external user ID to one role in one tenant. |
|
Soft delete |
A lifecycle operation that hides a resource from ordinary reads while retaining a stored record and lifecycle metadata. |
|
Source of truth / system of record |
The authoritative persistent record for a data domain. ICAP is the source of truth for tenant-scoped access data it owns, except where a PACS is configured as the periodic import source for a category. |
|
Tenant |
The top-level ICAP data-isolation, configuration, and authorization boundary. |
|
Visit |
A scheduled or operational context for temporary physical access. |
|
Visit participant |
The assignment of a visitor to a visit, including that participant's attendance status. |
|
Visitor |
A reusable person record for a temporary attendee. Access is managed in visit context. |