--- title: LenelS2 OnGuard slug: uNgA-lenels2-ong createdAt: 2026-08-04T07:07:50.000Z --- # Integration Guide ::Image[]{src="https://api.archbee.com/api/optimize/cIIINwBBlIs0Au1Y_bwqP/zKkPr2Rtrv3Wk8LBLx1Aj_lenels2-onguard-splash-card.png" size="60" width="780" height="310" position="flex-start" alt="LenelS2" sha="6146cd0d921c128d3c0070552558bb0ce5506da7" initialPath="/assets/integration-guide/lenels2-onguard/lenels2-onguard-splash-card.png" githubPath="docs/assets/integration-guide/lenels2-onguard/lenels2-onguard-splash-card.png" showCaption="false"} :::hint{type="info"} This integration connects Sine with LenelS2 OnGuard, enabling visitor and access data to flow between the two systems so that credentials and access permissions stay synchronized. It allows organizations to manage visitor access directly through their existing OnGuard access control infrastructure, reducing manual credential administration. This guide is intended for system integrators and IT administrators responsible for configuring and maintaining the connection between Sine and OnGuard. ::: # Overview Sine integrates with LenelS2 OnGuard to automatically provision and revoke visitor access credentials, with simplified connectivity for on-premise deployments through Sine Secure Bridge. The integration supports Sine QR Code credentials, which visitors can use via QR codes printed on badges or sent via SMS, and Physical Assets credentials, which let you manage physical cards such as HID proximity cards in Sine and assign them to visitors on check-in. # How It Works Sine integrates with LenelS2 OnGuard to synchronize visitor credentials with your access control infrastructure in real time. When a visit is approved in Sine, the corresponding credential is provisioned or activated in LenelS2 OnGuard, and access is automatically revoked in OnGuard when the visitor checks out. Select your preferred check-in method below. ::::::Tabs :::::Tab{title="QR Code"} Visitors are issued a Sine QR Code credential that can be scanned at compatible readers to request entry through LenelS2 OnGuard-controlled doors. ::Image[]{src="/assets/integration-guide/lenels2-onguard/cloud-to-onprem-qr-flow.png" size="120" position="flex-start" alt="cloud-to-onprem-qr-flow" initialPath="/assets/integration-guide/lenels2-onguard/cloud-to-onprem-qr-flow.png" githubPath="docs/assets/integration-guide/lenels2-onguard/cloud-to-onprem-qr-flow.png" showCaption="false"} **Check-in Flow:** ::::WorkflowBlock :::WorkflowBlockItem The visitor initiates check-in through Sine via kiosk, mobile app, web, or a printed QR poster. ::: :::WorkflowBlockItem Sine provisions a unique QR code credential, scoped to the visitor's assigned access groups for the duration of their visit. ::: :::WorkflowBlockItem Once the visit is approved following security and compliance checks, Sine activates the QR code credential in LenelS2 OnGuard. ::: :::WorkflowBlockItem The QR code is delivered to the visitor via SMS or displayed on their printed badge. ::: :::WorkflowBlockItem The visitor presents the QR code at a reader with QR/barcode scanning support, and the door unlocks. ::: :::: **Check-out Flow:** ::::WorkflowBlock :::WorkflowBlockItem The visitor checks out via the Sine app, kiosk, by notifying a host, or by exiting the geofence area. ::: :::WorkflowBlockItem Sine revokes the QR code credential in LenelS2 OnGuard, preventing any further entry attempts with that code. ::: :::: ::::: :::::Tab{title="Physical Assets"} Visitors are issued a physical access card managed as a Sine asset, which is provisioned as a credential in LenelS2 OnGuard for the duration of the visit. ::Image[]{src="https://api.archbee.com/api/optimize/cIIINwBBlIs0Au1Y_bwqP/lEqoLxcmEqabVBrsJjVMP_cloud-to-onprem-assets-flow.png" size="120" position="flex-start" alt="cloud-to-onprem-assets-flow" sha="423f335322524171aabced987d8a6e5b768ca682" initialPath="/assets/integration-guide/lenels2-onguard/cloud-to-onprem-assets-flow.png" githubPath="docs/assets/integration-guide/lenels2-onguard/cloud-to-onprem-assets-flow.png" showCaption="false"} **Check-in Flow:** ::::WorkflowBlock :::WorkflowBlockItem The visitor initiates check-in through Sine via kiosk, mobile app, web, or the reception desk. ::: :::WorkflowBlockItem Once the visit is approved, Sine creates the visitor's pass, and the visitor requests a physical access card at reception. ::: :::WorkflowBlockItem Reception assigns an available physical card, such as an HID proximity card managed as a Sine asset, to the visitor's pass. ::: :::WorkflowBlockItem Sine provisions the assigned card and activates it as a credential in LenelS2 OnGuard, scoped to the visitor's assigned access groups for the duration of their visit. ::: :::WorkflowBlockItem Once LenelS2 OnGuard confirms the credential is active, Sine notifies reception that the card is ready to hand out. ::: :::WorkflowBlockItem Reception grants the visitor their access card. ::: :::WorkflowBlockItem The visitor presents the card at a compatible card reader, and LenelS2 OnGuard verifies the credential before signaling the door to unlock. ::: :::: **Check-out Flow:** ::::WorkflowBlock :::WorkflowBlockItem The visitor checks out via the Sine app, kiosk, or by notifying a host, and returns their physical access card to reception. ::: :::WorkflowBlockItem Reception unassigns the card from the visitor's pass in Sine. ::: :::WorkflowBlockItem Sine deactivates the credential in LenelS2 OnGuard, immediately disabling further access with that card. ::: :::: ::::: :::::: # Requirements ## Sine Requirements - **Integration enablement**: You need a Sine subscription with the LenelS2 OnGuard integration enabled. Additional fees may apply. ## LenelS2 OnGuard Requirements - **OnGuard server**: You need an OnGuard server with the LS OpenAccess service installed and licensed. The server must be reachable via the OpenAccess REST API, either through external network access or through the Sine Secure Bridge. - **API credentials**: You need an OnGuard system user, or a directory user (LDAP/Active Directory), with sufficient permissions to create and manage visitors, badges, and access level assignments. - **QR Reader**: If you plan to use QR codes for access, you need compatible QR access readers. Confirm compatible reader models with LenelS2 or your Access Control Integration Partner. A reader similar to [this one](https://www.amazon.com/LBS-Outdoor-Control-Wiegand26-Scanner/dp/B08BRTD547) is suggested. - **Credential pool**: If you plan to use physical access cards, you need an available credential pool. - **Testing environment**: You need a sandbox environment or a safe testing space to validate the integration before deploying it to production. - **Network connectivity**: Determine how you will connect Sine to your on-premise OnGuard system. - **Direct API access**: This method requires network firewall access to the OnGuard API from outside your network. - **Sine Secure Bridge**: This method requires installation of the Sine Secure Bridge agent to establish a secure, managed tunnel between your on-premise OnGuard system and Sine. # Configuration ## LenelS2 OnGuard Configuration ### Badge and Access Level Setup ::::WorkflowBlock :::WorkflowBlockItem **Badge type** — Ensure the badge type used for visitors has its `Badge ID Allocation Type` set to `Manual Entry`. If it is set to `Automatic`, OnGuard rejects any badge creation request that includes a Sine-generated badge number. ::: :::WorkflowBlockItem **Access levels** — Create the access levels in OnGuard that should be available for assignment to visitor badges. ::: :::WorkflowBlockItem **Badge statuses** — Confirm the badge statuses to use for pending and lost badges. `Active` is a fixed system status, while other statuses such as `Lost` and `Returned` are user-defined and can be reviewed in OnGuard under `Administration`. ::: :::: **Visitor UDF fields (optional)** - **Visit ID**: Sine's unique identifier for the visit. - **Company**: The visitor's company name, if provided at check-in. ## Sine Configuration ### General Setup ::::WorkflowBlock :::WorkflowBlockItem **Admin permissions** — Ensure you have `Team` or `Site Admin` permissions. These permissions are required to configure integrations. ::: :::WorkflowBlockItem **Log in** — Log in to the Sine admin dashboard at [https://dashboard.sine.co](https://dashboard.sine.co). ::: :::WorkflowBlockItem **Select site** — Navigate to the `Locations` tab and click on the site you want to configure the integration for. ::: :::WorkflowBlockItem **Add integration** — In the Site menu, click the `Integrations` menu item. Click the `Add integration` button and select `LenelS2 OnGuard` from the list of available integrations. If the integration does not appear in the list, contact support. ::: :::WorkflowBlockItem **Name integration** — Enter a name for the integration. You can use any name, but choose one that helps you identify the integration's purpose. ::: :::: ### Connect to LenelS2 OnGuard ### Connection Method There are two ways to establish network connectivity to your on-premise LenelS2 OnGuard instance. Select your preferred method below. ::::::Tabs :::Tab{title="Sine Secure Bridge"} Sine Secure Bridge enables a secure, managed tunnel between Sine Cloud and your on-premise system's API. - **Enable Secure Bridge** — Switch `Use Sine Secure Bridge` on to display a dropdown list of your Secure Bridge tunnels. If you do not see the Sine Secure Bridge toggle, contact your Sine representative. ::: :::::Tab{title="Direct network connection"} Direct connection from Sine Cloud to your on-premise system's API. ::::WorkflowBlock :::WorkflowBlockItem **Base URL** — Enter the URL and port for your LenelS2 OnGuard server. For example, `https://your-lenels2-onguard-server.com/api:1234`. ::: :::WorkflowBlockItem **Ignore SSL Certificate Check** — Turn this setting ON if you are using a self-signed certificate, as the LenelS2 OnGuard integration will not be able to validate the certificate. If this toggle is not visible, contact your Sine representative. ::: :::: ::::: :::::: ### Authentication ::::WorkflowBlock :::WorkflowBlockItem **Credentials** — Enter the username and password for your LenelS2 OnGuard API User. ::: :::WorkflowBlockItem **Test Connection** — Click the `Test connection` button to confirm that your configuration is correct. Once you have successfully verified that Sine can connect to your LenelS2 OnGuard account, the Integration Settings section becomes available. ::: :::: ### Integration Settings ### Credential Configuration Controls the type of access control credential generated when the integration runs. Select your preferred credential type below. ::::::Tabs :::::Tab{title="Sine QR Code"} Generates and attaches a QR code to a visitor's pass. The integration runs when a pass is created or expired, or when the visitor checks out. ::::WorkflowBlock :::WorkflowBlockItem **Provision credentials on invitation** — By default, the visitor's credentials are provisioned on check-in. If you enable this toggle, the QR code provided to the visitor in their invitation email is provisioned in LenelS2 OnGuard and activated closer to the date of the visitor's invitation start time. This can provide a more seamless experience by provisioning car parking access or access to secure areas prior to the visitor's arrival. Note: if you enable this toggle and also want to provision credentials on check-in, you must create a separate integration. ::Image[]{src="https://api.archbee.com/api/optimize/cIIINwBBlIs0Au1Y_bwqP/lknRqPyfPLqAaxlybscZn_provision-on-invitation-toggle.png" size="75" position="flex-start" alt="provision-on-invitation-toggle" sha="08ccb35ca52a000d1f42178a90ae25edc1d030f3" initialPath="/assets/integration-guide/lenels2-onguard/provision-on-invitation-toggle.png" githubPath="docs/assets/integration-guide/lenels2-onguard/provision-on-invitation-toggle.png" showCaption="false"} ::: :::WorkflowBlockItem **Badge number range** — Specify the badge number range to use with QR code credentials. Sine randomly generates a new card number for visitors on check-in using the range you provide. The range must be supported by your access control card formats. ::: :::WorkflowBlockItem **Badge Style** — Select the style of printed badge to use when this integration runs. Some access control readers require a specially formatted Access badge style rather than the default name badge style. ::: :::WorkflowBlockItem **Send QR Code by SMS** — If the visitor's mobile number is available, send them a QR code credential by SMS. This can serve as a useful backup to a badge printer. ::: :::WorkflowBlockItem **Provision credential on check-in** — Select one or more visitor types for which the integration should provision credentials in your access control system when the visitor checks in using Sine. Ensure that the `Host Selection Required` checkbox is ticked for any visitor types used in access control integrations. Without this setting, visitors would receive access credentials without requiring host approval. You can review which of your visitor types have Host Approval Required on the `General` tab of your site settings. ::: :::WorkflowBlockItem **Grace Period** — A visitor may use Sine to check out before leaving the location but may still need their credentials to exit. Set a grace period to ensure their access control credentials are not deprovisioned immediately after being checked out in Sine. ::: :::: ::::: :::::Tab{title="Physical Assets"} Activates a physical asset (e.g., HID card) in your LenelS2 OnGuard system. The integration runs when an asset is assigned, returned, or marked as lost. ::::WorkflowBlock :::WorkflowBlockItem **Asset type** — Select the asset type applicable to this integration. You can create new asset types on the assets page in the Sine Core Dashboard. ::Image[]{src="https://api.archbee.com/api/optimize/cIIINwBBlIs0Au1Y_bwqP/XcAEiQfIPF0cbUO-ifhhx_asset-types.png" size="75" position="flex-start" alt="asset-types" sha="9948c7af5630a38ed4cabebd9c506f0555d1785d" initialPath="/assets/integration-guide/lenels2-onguard/asset-types.png" githubPath="docs/assets/integration-guide/lenels2-onguard/asset-types.png" showCaption="false"} ::: :::WorkflowBlockItem **Lost asset badge status** — Select the status to assign to a cardholder's badge when the card is marked as lost in Sine. Choose an inactive status that disables the card and disallows access. If not set, the badge's deactivation date is set to the current time instead. ::: :::: ::::: :::::: ### Basic Configuration ::::WorkflowBlock :::WorkflowBlockItem **Directory** — Select the directory to authenticate against. The dropdown is populated automatically from your OnGuard system and defaults to the built-in internal directory. Choose your LDAP or Active Directory directory if one is configured. ::: :::WorkflowBlockItem **Badge type** — Select the visitor badge type to assign to visitors. The selected badge type must use the `Manual Entry` badge ID allocation type so that Sine-generated badge numbers are accepted. ::: :::WorkflowBlockItem **Access levels** — Select one or more OnGuard access levels to assign to visitor badges. ::: :::WorkflowBlockItem **Pending badge status** — Select the badge status that Sine assigns while a badge is pending. The badge remains in this status, and inactive, until the visitor's pass is approved or their invitation validity period begins. ::: :::: ### Field Mapping ::::WorkflowBlock :::WorkflowBlockItem **Visit ID field** — Optionally select an OnGuard visitor field (UDF) to store the Sine visit ID on the visitor record. ::: :::WorkflowBlockItem **Company field** — Optionally select an OnGuard visitor field (UDF) to store the visitor's company name on the visitor record. ::: :::: ### Messages - **Visitor failure message** — Enter the message to display to the visitor if the access control integration fails for any reason. ### Notifications - **Send integration failure notifications** — If the integration fails, you can enter one or more email addresses to be notified of the failure and its corresponding details. # Testing ::::WorkflowBlock :::WorkflowBlockItem **Create a test check-in** — Create a test visitor check-in using a visitor type configured for the integration. ::: :::WorkflowBlockItem **Verify credential provisioning** — Verify that the visitor profile is created in the vendor system and that credentials are provisioned correctly. ::: :::WorkflowBlockItem **Test credential access** — Test the credential at a compatible reader to ensure access is granted. ::: :::WorkflowBlockItem **Verify credential revocation** — Check out the test visitor and verify that access credentials are revoked after the configured grace period. ::: :::WorkflowBlockItem **Check failure notifications** — Monitor the integration failure notifications to ensure they are working correctly. ::: :::: *** *Need help? Contact Sine Support at* **[support@sine.co](mailto\:support@sine.co)**