What the Access Credential Object Is
The Access Credential object, defined in Clause 12.35 of ANSI/ASHRAE 135-2024, is how a BACnet device represents a credential used to authenticate and authorize a request for access. A credential is owned by an Access User and is a container of related authentication factors (a card, a PIN, a biometric), each of which can be enabled or disabled individually.
The rights the credential carries are set by referencing Access Rights objects, each reference individually enabled or disabled. Credential_Status reports whether the credential is valid for authentication, derived from its own properties or set by an external process. A credential can be restricted by activation and expiry dates, a number of days or uses, or an absentee limit, and it can be exempted from checks such as passback or occupancy enforcement. It can also be flagged to trace, so any point that recognizes it generates a TRACE access event. This object has no intrinsic-reporting properties.
Where You’ll See It
- Issued cards and PINs. Each badge or credential issued to a person is one Access Credential object referencing that user and the rights it carries.
- Time-limited access. A contractor badge uses
Activation_TimeandExpiration_Timeto become valid and then expire automatically. - Investigations. A credential with
Trace_Flagset produces a TRACE event at every reader that sees it, so security can follow its movement.
Required Properties
Clause 12.35 requires every Access Credential object to provide these properties. Datatypes are the spec’s names: Unsigned is an integer, INTEGER a signed integer, and the BACnet-prefixed types are structured values defined by the standard.
| Property | Datatype | What it holds |
|---|---|---|
Object_Identifier | BACnetObjectIdentifier | The object’s type and instance number, unique within the device |
Object_Name | CharacterString | The human-readable point name, unique within the device |
Object_Type | BACnetObjectType | Always access-credential for this object |
Global_Identifier | Unsigned | A shared identifier for the credential when represented in several devices. Writable |
Status_Flags | BACnetStatusFlags | Four health flags: in-alarm, fault, overridden, out-of-service |
Reliability | BACnetReliability | Names the reason whenever the fault flag is set |
Credential_Status | BACnetBinaryPV | Whether the credential is currently valid for authentication |
Reason_For_Disable | BACnetLIST of BACnetAccessCredentialDisableReason | Why the credential is disabled, if it is |
Authentication_Factors | BACnetARRAY[N] of BACnetCredentialAuthenticationFactor | The card, PIN, or biometric factors that make up the credential |
Activation_Time | BACnetDateTime | When the credential becomes valid |
Expiration_Time | BACnetDateTime | When the credential stops being valid |
Credential_Disable | BACnetAccessCredentialDisable | The disable state applied to the credential |
Assigned_Access_Rights | BACnetARRAY[N] of BACnetAssignedAccessRights | The Access Rights objects this credential carries |
Property_List | BACnetARRAY[N] of BACnetPropertyIdentifier | The list of properties this instance actually implements |
Optional Properties
The properties integrators meet most are the usage-limit group (Days_Remaining, Uses_Remaining, Absentee_Limit), the last-use fields (Last_Access_Point, Last_Access_Event, Last_Use_Time), and Trace_Flag. Audit_Level and Auditable_Operations are the audit-logging controls added in 135-2024.
| Property | Datatype | Group |
|---|---|---|
Description | CharacterString | General |
Days_Remaining | INTEGER | Access model |
Uses_Remaining | INTEGER | Access model |
Absentee_Limit | Unsigned | Access model |
Belongs_To | BACnetDeviceObjectReference | Access model |
Last_Access_Point | BACnetDeviceObjectReference | Access model |
Last_Access_Event | BACnetAccessEvent | Access model |
Last_Use_Time | BACnetDateTime | Access model |
Trace_Flag | BOOLEAN | Access model |
Threat_Authority | BACnetAccessThreatLevel | Access model |
Extended_Time_Enable | BOOLEAN | Access model |
Authorization_Exemptions | BACnetLIST of BACnetAuthorizationExemption | Access model |
Reliability_Evaluation_Inhibit | BOOLEAN | Fault detection |
Audit_Level | BACnetAuditLevel | Auditing |
Auditable_Operations | BACnetAuditOperationFlags | Auditing |
Tags | BACnetARRAY[N] of BACnetNameValue | Tagging and profile |
Profile_Location | CharacterString | Tagging and profile |
Profile_Name | CharacterString | Tagging and profile |
Related Objects
- Access User: the person, group, or asset that owns this credential.
- Access Rights: the rule sets this credential references to decide where it may go.
- Credential Data Input: the reader that captures the authentication factor this credential is matched against.
What Chipkin Provides
The Access Credential object, including its authentication-factor container and validity model, is a first-class object type in the CAS BACnet Stack. Talk to us about modeling your device’s points.