Create an access scan

Módulo Credentials

POST/access-scansaccessScans.create

A credential scan at an access point, validated against the Access Grid. Creates an access scan. Requires `Idempotency-Key`; a replay returns the original response. The organization is derived from the credential or the parent row, never from the body.

Requiere la capacidad credentials.scan.write.
Alcances de OAuth: credentials.
Envía el encabezado Idempotency-Key. Una repetición con la misma clave devuelve la respuesta original.
Estados de error: 400, 401, 409, 422, 429. Los errores son detalles de problema RFC 9457.

Cuerpo de la solicitud: AccessScanCreate

accessScans.create: AccessScanCreate
Campo	Tipo	Obligatorio	Descripción
zone_id	string (uuid)	Sí	Identifier of the zone.
credential_id	string (uuid)	Sí	Identifier of the credential.
device_scanned_at	string (date-time) \| null	No	When the device scanned, for a scan made offline.
offline_result	"Granted" \| "Denied" \| null	No	What the device decided offline.

{
  "zone_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "credential_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "device_scanned_at": "2026-10-08T14:30:00Z",
  "offline_result": "Granted"
}

Respuesta 201: AccessScan

accessScans.create: AccessScan
Campo	Tipo	Obligatorio	Descripción
id	string (uuid)	Sí	Identifier of the access scan.
org_id	string (uuid)	Sí	Identifier of the owning organization, derived from the parent row and never accepted from the caller.
created_at	string (date-time)	Sí	When the row was created.
created_by	string (uuid) \| null	Sí	Identifier of the person who created the row; null when a seed, platform or system process created it.
updated_at	string (date-time)	Sí	When the row was last updated.
updated_by	string (uuid) \| null	Sí	Identifier of the person who last updated the row; null when a seed, platform or system process updated it.
zone_id	string (uuid)	Sí	Identifier of the zone.
credential_id	string (uuid)	Sí	Identifier of the credential.
scanned_at	string (date-time)	Sí	When the scan happened.
result	"Granted" \| "Denied"	Sí	The database's decision for the scan.
project_id	string (uuid)	Sí	Identifier of the project of the credential, copied from it.
device_scanned_at	string (date-time) \| null	Sí	When the device scanned, for a scan made offline.
offline_result	"Granted" \| "Denied" \| null	Sí	What the device decided offline.

{
  "id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "created_at": "2026-10-08T14:30:00Z",
  "created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "updated_at": "2026-10-08T14:30:00Z",
  "updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "zone_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "credential_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "scanned_at": "2026-10-08T14:30:00Z",
  "result": "Granted",
  "project_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "device_scanned_at": "2026-10-08T14:30:00Z",
  "offline_result": "Granted"
}

Ejemplos de código

curl -X POST "$XOS_BASE_URL/access-scans" \
  -H "Authorization: Bearer $XOS_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"zone_id":"0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f","credential_id":"0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f","device_scanned_at":"2026-10-08T14:30:00Z","offline_result":"Granted"}'

const { data } = await xos.accessScans.create({
    "zone_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
    "credential_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
    "device_scanned_at": "2026-10-08T14:30:00Z",
    "offline_result": "Granted"
  });

response = xos.access_scans.create({"zone_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", "credential_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", "device_scanned_at": "2026-10-08T14:30:00Z", "offline_result": "Granted"})

xos access-scans create --data '{"zone_id":"0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f","credential_id":"0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f","device_scanned_at":"2026-10-08T14:30:00Z","offline_result":"Granted"}'