#### Version 1.0.5 Updated: **Nov 2025** > [!Note] > This guide has been updated to reflect the new 2024-25> **Brivo Access** web interface. > The previous guide has screenshots related to **Brivo Onair**. From the **XProtect Management Client** select [Access Control], right click and [Create new...] ![[z_img/8ea910d0752abdaae269ef0360e50f9f_MD5.jpeg]] Here are the steps to get what you need for each setting. 1. [[#Name]] 2. [[#Integration plug-in]] 3. [[#Brivo Authentication URL]] 4. [[#Brivo API URL]] 5. [[#Brivo Event Callback URL]] 6. [[#Error E-mail]] 7. [[#Event Proxy Address]] 8. [[#User]] 9. [[#Password]] 10. [[#API Key]] 11. [[#API Client IO]] 12. [[#API Client Secret]] # General settings ## Name: We recommend using "**Brivo Access**" this name is visible in the XProtect Management Client under Access Control and XProtect Smart Client. When logging into the XProtect Smart Client you will see the below. ![[z_img/1cd9613b82a0dee1d38649728efe3011_MD5.jpeg]] ## Integration plug-in: This is the option required to connect to Brivo Access. ![[z_img/57c451036079b196793863024ff4f969_MD5.jpeg]] ## Brivo Authentication URL: This option is default and does not require editing. ![[z_img/7fabe92c75b836403ed1f6198ba26252_MD5.jpeg]] ## Brivo API URL: This option is default and does not require editing. ![[z_img/6abd93d6288b4fe2ce0faebf87ed635a_MD5.jpeg]] ## Brivo Event Callback URL: > [!note] > This is not needed for the initial connection, this can be updated later. Door states and event will not be processed without this, but you can pull the site configuration to get started. This relates to the Brivo Event Proxy installer. This is the external access URL Brivo Access cloud API uses this to send system events. ![[z_img/73a6d79aa080e5975b99aa1e8ef04adb_MD5.jpeg]] [PublicIP] needs to be edited, this should be updated to the external public IP address for this site. See firewall configuration in the product user guide. All communication to the Event Callback URL is in HTTP. The Brivo Event Proxy does not need to be installed on the XProtect Management Server, in some cases this would be installed on a DMZ networked server [What is a DMZ Network]([What Is a DMZ Network and Why Would You Use It? | Fortinet](https://www.fortinet.com/uk/resources/cyberglossary/what-is-dmz)) . ### Firewall setup This needs doing before you can fill out this section. This might need to involve the customers IP department. > [!note] > See the Firewall setup guide PDF [Link](https://orbnetsyscom.sharepoint.com/:b:/s/ORBNETPublic/IQApeYqHEQuZRYcldT0HwOWBATRIvgFVYjp5rRqbZkeQm24?e=QTq0lN&download=1) ### Test your connection In most cases this is best tested from outside the customers network, some Firewalls stop loopback connections from internal requests to the public IP. Take http://publicIP:43323/orb-briv-proxy/eventcallback/ update the [PublicIP] and remove from the link "eventcallback/" http://publicIP:43323/orb-briv-proxy/ Test with this to see that this part is working. ![[z_img/d273afcb1ed93468b07553d7e81565d7_MD5.jpeg]] ## Error E-mail: This will provide error emails when the Brivo Access cloud API is unable to post to the Event Proxy hosted onsite. This could be because a server is offline or the internet connection is down. This should most cases be a email address for the security integrator. This is a donotreply address so maybe not best for a ticket system. You could also use a plus email address to provide an additional site reference, example: [email protected] ([What is Plus Addressing]([Plus Addressing in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online)) Example of the email you will receive. ![[z_img/803a5071aa3d3c8dc391cc00c2530204_MD5.jpeg]] ## Event Proxy Address: This is related to the [[#Brivo Event Callback URL]] however instead of for external connections this relates to the local network connections. The Brivo Event Proxy does not need to be installed on the XProtect Management Server, in some cases this would be installed on a DMZ networked server [What is a DMZ Network]([What Is a DMZ Network and Why Would You Use It? | Fortinet](https://www.fortinet.com/uk/resources/cyberglossary/what-is-dmz)) ### When installed on the XProtect Management Server. https://localhost:43324/orb-briv-proxy/ This is a **SelfSignedCert**, hence the waning that is some, this is used to encrypt communications to the XProtect Event Service for plugin communication. The certificated is Valid for 5 years. Note the port **43324** is different to the external connection as one uses HTTP (**43323**) the other uses HTTPS. http://locahost:43323/orb-briv-proxy/ also works. ![[z_img/d581381ef71b390babc35cf8de726133_MD5.jpeg]] Click [Advance] then [Continue to localhost (unsafe)] ![[z_img/75b4666b6e97c1cf2436c99d15a76bda_MD5.jpeg]] This shows the service is up and available. ## When installed on a DMZ network or elsewhere Update "**localhost**" to the IP address of the server you are connecting to. Test from the XProtect Management server with the full address. ![[z_img/fc1a5edc6adb1d5bd45544f432e9554c_MD5.jpeg]] This shows the service is up and available. ## User: We recommend creating a dedicated user for the XProtect Access connection. https://access.brivo.com/dashboard/ Click [Account] in the top right of the page, a dropdown dialogue will show. Click [Copy] for the **Admin ID**. This is used as the username for API connections not the email address. ![[z_img/2fa94194ce2c6b44ffe136f36a3db799_MD5.jpeg|400]] Example: ``` xrdm345-cAvFq ``` ## Password: Same as for the user account, this is the password you use for connection to the Brivo Access dashboard alongside the email address. ## API Key: Please contact your Brivo dealer for access to the **API Account Access Agreement Form** to gain access to this API key. There is a tiered API calls price list for this, this is based around the number of doors and how busy a site is (high event count). The API Key is a standard GUID, this is a Unique Identifier used to make API connections from a Brivo Access account to the Brivo API. Here is an example: ``` a6c05772-1d18-46f6-94e0-e5e314480cf3 ``` Here is an example email that you should receive, once the API key has been setup. Highlighted in red it the API key. ![[z_img/99d6ee23296718e61dc20c27419e0ec4_MD5.jpeg]] ## API Client IO: To generate this, you will need to be logged into a **Super Admin** account. Only this account type has access to the [**Marketplace**]. ![[z_img/88e4b352ca290402dfbec668181e5225_MD5.jpeg|350]] Select from the top right of the Marketplace page [Generate API Token] ![[z_img/459ff71db1220cbc75bd4ebf10e26e5c_MD5.jpeg|600]] >[!note] >For customers with more than one site we recommend creating a separate API Token for each site. This will provide better reporting for you API key. For this token use the below settings; - Application Name (*User defined*) - Application Description (*User defined*) - Application Type (**Password**) - Redirect URI (**Blank**) - Click [**Save**] ![[z_img/39306529866ea5b30a6c50ee834c96ba_MD5.jpeg|400]] Now you need to go to [Enabled] ![[z_img/6ced4aea44baff13b51403c19cfec07c_MD5.jpeg|600]] Pick the generated **API Token** from the list. ![[z_img/6e422ef7ff08d8998f6867a696584d81_MD5.jpeg|600]] At the bottom of the next page is the **Client ID** and **Client Secret**. Use these for the General Settings [API Client ID] and [API Client Secret] ![[z_img/7027aded20f915f9d8ccf360c8b982dd_MD5.jpeg|600]] ## API Client Secret: See above [[#API Client IO]] # Complete Here is a complete version as an example. ![[z_img/1d44310a7b8b8467fa6745e791678559_MD5.jpeg]] Note the additional fields. 13. Door relock time (ms): 14. Hours before user cache invalidation: 15. Cardholder image override enabled: ## Door relock time (ms): Default value **2500** ms. This relates to unlock commands sent by the API user and the time specified to the unlock time. ## Hours before user cache invalidation: Default value **1** Hour. This invalidates the cardholder list so any changes made within an hour can be refreshed. Each request for cardholders uses API requests, for larger sites with many users this would be better with a longer duration. ## Cardholder image override enabled: Default option enabled (ticked). Within the Cardholder list in XProtect Access we have the option to use custom user photos. These are only used in XProtect Access. The plugin does not sync these photos with Birvo Access. ![[z_img/ebaab845355adee91595b670cfb42a27_MD5.jpeg|250]] # Troubleshooting ## Check active connection to Brivo service from Milestone ![[z_img/cdae542a324f49fbedfa1fd00e840862_MD5.jpeg]] Using PowerShell; ``` powershell Test-NetConneciton auth.brivo.com -Port 443 ``` ``` powershell Test-NetConneciton api.brivo.com -Port 443 ``` The result should show **TcpTestSucceeded**