Connectors

/admin/connector: Connectors in the menu

A connector is Omaya's link to another product: the mail server that carries its emails, the Telegram bot that posts its alerts, the gateways that send it readings, the Home Assistant it switches lights through. Each one is set up once, on this page, by an administrator. After that it is used by rules and apps without anyone thinking about it again.

This page walks through every connector on the list, field by field, in the order the form shows them. At Northwind Tower the examples are Aisha Rahman's: she is the Facilities Manager and sets the connectors up; Ravi Kumar, the Operations Lead, is the one who wants to be told.

Which connector do you need?

Connector	What it is for	Who needs it	Section
SMTP Email	Sending email from your own mail server	Anyone who wants emails to come from their own domain	SMTP Email
SMS	Text messages through Twilio, Synchroweb, Genusis or any HTTP SMS API	Alerts to phones without a data connection	SMS
WhatsApp	WhatsApp messages through the Synchroweb WhatsApp Business gateway	Alerts to people who live in WhatsApp	WhatsApp
Telegram	Messages to a Telegram chat, group or channel through your own bot	Teams that coordinate in Telegram; Visitor approvals in a chat	Telegram
IoT Gateway (MQTT)	BLE, WiFi, LoRa and telemetry gateways publishing to Omaya's broker	Every site with gateways that speak MQTT	IoT gateways
IoT Gateway (HTTP)	The same, posted over HTTPS	Gateways or network servers that can only POST	IoT gateways
IoT Gateway (TCP) · (UDP)	Raw socket connections from custom or legacy hardware	Rare; your Omaya provider will tell you if you need one	TCP and UDP
Smart Home Bridge (Matter / HA)	Reading sensors from, and switching things through, Home Assistant	Sites with Matter, Zigbee or Z-Wave devices in Home Assistant	Smart Home Bridge
S3 Cloud Export	Copying scheduled report files into an AWS S3 bucket	Organisations that archive reports in S3	S3 Cloud Export
Outbound Webhooks	Posting events to a system of yours the moment they happen	Integrators: SIEM, ticketing, chat tools	Outbound Webhooks
External CMMS	Copying Omaya's work orders into another maintenance system	Sites that already run a CMMS	External CMMS
ERP	Where the Warehouse app re-pulls items, partners and orders each night	Warehouse app users with an ERP	ERP
Access Control (Gate / Lift)	Granting a visitor's card on check-in and revoking it on check-out	Visitor app sites with turnstiles, gates or lifts	Access Control
Identity Provider (Singpass / MyDigital ID)	Letting visitors prove who they are with a national digital ID	Visitor app sites that verify IDs	Identity Provider

Room calendars (Google Workspace and Microsoft 365) are connected from the Meeting Room app, not from this page: see Linking room calendars.

How the page works

Every connector is set up the same way. Learn it once here; each section below only lists what is different.

Every connector is set up the same way. The form differs; the page, the Active switch, Save and the row's Test do not.

Who can see it

The Connectors menu item needs the View Config permission. Each kind of connector then needs its own permission, set on System → Roles under Connectors. A kind you have no permission for is not shown at all, neither in the list nor under Add Connector, so if a connector in this guide is missing, ask whoever manages roles.

Permission on System → Roles	Connectors it shows
SMTP (Email) Connector	SMTP Email
SMS Connector	SMS
WhatsApp Connector	WhatsApp
Telegram Connector	Telegram
MQTT Gateway Connector	IoT Gateway (MQTT)
HTTP Gateway Connector	IoT Gateway (HTTP)
TCP Gateway Connector · UDP Gateway Connector	IoT Gateway (TCP) · IoT Gateway (UDP)
Matter Bridge Connector	Smart Home Bridge (Matter / HA)
S3 Cloud Export Connector	S3 Cloud Export
Outbound Webhooks & ERP Connectors	Outbound Webhooks, ERP
External CMMS, Access Control & Identity Provider Connectors	External CMMS, Access Control (Gate / Lift), Identity Provider (Singpass / MyDigital ID)

What is on the page

At the top: the heading Connectors, How Omaya takes data in and sends messages out, and whether each one is getting through., and the Add Connector button.

Under it, four tiles count your connectors by how they are doing:

Tile	What it counts
Working	Receiving data, or working when last used. Includes connectors that are set up but not used yet
Quiet	Switched on, but nothing has arrived for 15 minutes or more
Failing	The last attempt failed
Off	Switched off

Click a tile to show only those connectors. A line above the list says, for example, Showing connectors that are quiet., or No connectors are failing right now. Click Show all, or the same tile again, to see every connector.

Then the connectors, one row each, in four groups:

Group	What is in it
Data in	Gateways, LoRa servers and smart-home bridges that send readings to Omaya. IoT Gateway (MQTT, HTTP, TCP, UDP) and Smart Home Bridge
Alerts out	Where rules and reports send messages. SMTP Email, SMS, WhatsApp, Telegram and Outbound Webhooks
Business systems	ERP, maintenance, access control and sign-in. ERP, External CMMS, Access Control and Identity Provider
Storage	Where scheduled reports are copied. S3 Cloud Export

A group with nothing set up is not shown. Each row has the connector's name (the name you gave it, or its kind, numbered when there are several of the same kind, such as Telegram #2), its kind under the name, its state and a status line (see Read the list), and three buttons: Test, the settings button (a gear) and the bin to delete it. Click the connector's name or the settings button to open its form; the steps in this guide call this opening the connector. With nothing saved yet the page says No integrations yet and Click "Add Connector" to set up your first integration.

Read the list

Each row says whether the connector is getting through, not only whether it is switched on.

State	What it means	Status line, for example
Receiving	A gateway connector had a message in the last 15 minutes, or a Smart Home Bridge read Home Assistant in the last 30 minutes	Last message 12s ago · 8,640 in 24 h · Last read 2m ago
Working	Its last use worked	Last used 3h ago · 41 sent
Ready	Switched on and set up, but not used yet	Set up, not used yet
Quiet	Switched on, but a gateway connector has had nothing for 15 minutes, or a Smart Home Bridge has not read Home Assistant for 30 minutes	Last message 2h ago · 310 in 24 h · No messages since tracking began · Not read yet
Failing	Its last attempt went wrong and nothing has worked since	Failing since 20m ago: followed by the error
Off	Active is off	Switched off

Receiving, Working and Ready all count under the Working tile. A long status line is cut short; point at it to read all of it. Failing covers, for example, a work order the CMMS refused, an S3 upload that failed or a Home Assistant poll that went wrong.

Gateway connectors (MQTT, HTTP, TCP and UDP) also show a small bar chart: messages per hour over the last 24 hours, oldest on the left. A gap in the bars is an hour in which nothing arrived. Messages are counted only from the day this counting was added to Omaya, so an older connector with no traffic since then says No messages since tracking began.

A gateway connector is never shown as Failing: Omaya can only see whether messages arrive, so a gateway that has stopped sending shows as Quiet.

Test a connector

Test on a row checks the connector without sending anything to anyone and without adding any readings.

1. Go to Connectors (/admin/connector).
2. On the connector's row, click Test. The row shows Checking….
3. A list of checks opens under the row. Each has a tick (passed), a warning triangle (worth a look), a cross (failed) or an information sign.

Check	Which connectors	What it tells you
Switched on	All	It is on., or It is off, so nothing goes through it.
Token	MQTT and HTTP gateways	Has a token., or No token: open its settings and save it once to create one.
Port	TCP and UDP gateways	TCP: Omaya is listening on port …, or Nothing is listening on port …: ask your Omaya administrator to start the listener for it. UDP: Gateways send to port … on this server.
Message broker	MQTT gateways	Reachable (… ms)., or Not reachable: …
Where gateways publish	MQTT gateways	The topic this connector listens on. Compare it with the topic set in the gateway
Receiving address	HTTP gateways	Answers at … with the address the gateway must post to, or Answered HTTP …
Messages arriving	All gateways	Last message … ago; … in the last 24 hours. A warning adds Check the gateway is powered and still pointed at this connector.
Home Assistant	Smart Home Bridge	Whether Omaya can reach Home Assistant with the saved address and token, or No address or access token saved.
Last read	Smart Home Bridge	Readings last taken … ago., or No readings taken yet.
Settings	All others	Saved., or Nothing saved yet.
Last use	All others	Last worked … ago (… times)., or Not used yet.
Send a real test	SMTP Email, SMS, WhatsApp, Telegram, S3 Cloud Export	Open its settings and use the test there: it needs a recipient.
Last error	Any connector whose last attempt failed	When it failed and the error

To prove a message really reaches someone, open the connector and use the test button in its form, as each section below describes. If the check cannot run, the row says The check could not run. Try again.

Troubleshooting a quiet gateway connector.

1. Click the Quiet tile to list the connectors that have gone quiet.
2. Look at the bar chart on the row: bars that stop at a certain hour show when messages stopped.
3. Click Test on the row.
4. If Message broker fails (MQTT), the problem is on the Omaya side: tell your Omaya provider.
5. If Messages arriving warns, check the gateway: it has power and a network connection, and its server settings match this connector. For MQTT, compare the gateway's topic with Where gateways publish; for HTTP, compare its URL with Receiving address. A token that was rotated must be updated on every gateway.
6. Check it worked: after the gateway sends again, click Test once more. Messages arriving shows a tick, and after a page refresh the row reads Receiving with Last message …s ago.

Add a connector

1. Go to Connectors (/admin/connector).
2. Click Add Connector (top right). A panel opens on the right headed Add Connector, Select an integration to configure. The kinds are grouped the same way as the list (Data in, Alerts out, Business systems, Storage), each with a one-line description of what it is for, and … set up beside the ones you already have.
3. Click the kind you want. The panel changes to that connector's form, always blank: this always starts a new one. To change an existing connector, click its name or its settings button in the list instead.
4. Read How to connect … at the top of the form. It is open until the connector has been saved once, then folds away; click it to open it again.
5. Switch Active on. Every new connector starts with Active off, and an inactive connector is saved but never used.
6. Fill in the fields as the section for that connector below describes.
7. Click Save. A message confirms it in the top-right corner, the panel closes, and the connector's row appears in its group.
8. Open it again and use the test button in its form (it is called Test Connection, Test, Check Port, Test pull or Test & upload sample file depending on the connector). On some connectors the test button only appears once the connector has been saved. Test on the row is a separate, read-only check: see Test a connector.

If a required field is missing, Save does nothing to the connector: the panel stays open and the problem is shown at the top of the form and under the field.

Addresses Omaya calls

The Outbound Webhook, Smart Home Bridge, External CMMS, ERP and Access Control (HTTP) connectors give an address that Omaya's server calls. It must be a public internet address. A private, local or link-local one (10.x, 192.168.x, 127.0.0.1, 169.254.x, localhost, or a name that points to one) is refused on Save and on Test with This address points inside our network, so Omaya can't call it. The check is made again each time Omaya calls the address, for every connector that calls out, not only when it is saved. Omaya does not follow redirects to these addresses: a test shows the 3xx answer as it is, so give the final address. On an installation inside your own network, where these systems are on the same LAN, the operator can allow private addresses (OMAYA_ALLOW_PRIVATE_URLS=true).

Passwords, tokens and secrets

A secret you have saved is never shown back. The box shows dots, and some forms add ✓ credential set (rotate to change) under it. Leave the dots alone to keep the saved value; type over them to replace it. There is no way to read a saved secret out of Omaya, so keep your own copy where you keep passwords.

Several of the same kind

You can add more than one of most connectors, for example a second email server as a backup. Where Omaya needs just one (to send a rule's email, SMS, WhatsApp or Telegram message), it uses the oldest active one of that kind; for WhatsApp, an active one with Set as Default = Yes comes first. To switch to another, make it the only active one.

Turn off, or delete

Switching Active off and saving keeps every setting and stops the connector being used: the quickest way to stop messages while you work out what is wrong.

To delete, click the bin icon on the connector's row (or Delete at the bottom of the form). Delete Integration? asks you to confirm: This action cannot be undone. The integration and its settings will be removed. Rules that used the connector are not changed; their messages are skipped until another connector of that kind is active.

SMTP Email

Sends Omaya's email through your own mail server: rule actions, scheduled reports, Security Watch alerts, Visitor passes and admin invitations.

Without this connector, email still goes out through your Omaya provider's own mail service. Set one up when you want mail to come from your own domain and to appear in your own mail server's logs.

Before you start

Get these from your email provider or IT team:

You need	Gmail / Google Workspace	Microsoft 365	Most other providers
Host	smtp.gmail.com	smtp.office365.com	Your provider's SMTP host
Port	587	587	465 or 587
Encryption	STARTTLS (TLS)	STARTTLS (TLS)	SSL/TLS on 465, STARTTLS (TLS) on 587
Login	The full address and an App Password	The mailbox address and its password, with SMTP AUTH on	As your provider says

Gmail: make an App Password. Google refuses your normal password here.

1. Sign in to the Google account that will send the mail.
2. Go to Google Account → Security, turn on 2-Step Verification if it is not on already.
3. In 2-Step Verification, open App passwords, give it a name such as Omaya, and click Create.
4. Google shows a 16-letter password once. Copy it; it goes in SMTP Password.

Microsoft 365: allow SMTP for the mailbox. In the Microsoft 365 admin centre: Users → Active users, select the mailbox, Mail tab, Manage email apps, tick Authenticated SMTP, Save changes. Your organisation may also have turned SMTP authentication off for everyone, and Microsoft has been retiring password sign-in for it. If your IT team will not allow it, ask them for an SMTP relay instead: a host and port that accept mail from Omaya's server without a login. Leave SMTP Username and SMTP Password empty in that case.

Use a mailbox for sending only

At Northwind Tower Aisha uses alerts@northwind.example, not her own mailbox. If she leaves, the alerts keep working, and replies to alerts do not land in a personal inbox.

Set it up

1. Connectors → Add Connector → SMTP Email.
2. Switch Active on.
3. Fill in the form, top to bottom:

Field	What to put	Example
Name	Optional. A label for the card. Must not be the same as another email connector's name	Alerts
SMTP Host *	The server's host name or IP address, no https://	smtp.gmail.com
SMTP Port	The port. Starts at 587	587
Encryption	How the connection is protected. STARTTLS (TLS) (the usual choice, port 587) upgrades the connection and refuses to send if the server cannot. SSL/TLS (port 465) is encrypted from the first byte. None never encrypts: only for an internal relay, usually on port 25. Starts at STARTTLS (TLS)	STARTTLS (TLS)
SMTP Username	The login, usually the full email address. Empty for a relay with no login	alerts@northwind.example
SMTP Password	The password or App Password. The eye button shows what you typed	(the App Password)

4. Click Advanced Configuration to open the rest. From Address is required and is in here:

Field	What to put	Example
SSL Verification	Yes. Choose No only for a server reached by IP address or with a self-signed certificate	Yes
From Address *	The sender address. It must be one the login is allowed to send as, usually the same mailbox; anything else is refused by the server or lands in spam. The box starts with noreply@example.com: change it	alerts@northwind.example
From Name	The name people see beside the address. Starts as Omaya	Northwind Tower
CC	Optional. Addresses copied on every email Omaya sends through this connector, separated by commas	facilities@northwind.example

5. Click Save. You should see SMTP settings saved successfully.

Check it works

1. Open the connector again: click its name in the list.
2. Click Test Connection. A box opens: Test SMTP Connection.
3. Type your own address and click Send.
4. Test email sent successfully. means the server accepted it. Check the inbox, and the spam folder. The subject is SMTP Test: Succeed and the email reads Succeed! This is a test email from Omaya.

The test uses what is in the form at that moment, so you can test a change before saving it.

What uses it

• Rule actions with the channel Email (Your first rule).
• Scheduled report deliveries.
• Security Watch alerts, Visitor passes and notifications, and admin invitations.

Questions and problems

SMTP Host is required. / From Address is required. The test was run with that box empty. From Address is under Advanced Configuration.

The test shows "authentication failed" or "535". The username or password is wrong. For Gmail, it must be an App Password, not the account password. For Microsoft 365, Authenticated SMTP is off for the mailbox or for the organisation.

"Connection refused", "timed out" or "Connection could not be established". The host or port is wrong, or a firewall stops Omaya's server reaching the mail server on that port. Port 465 with Encryption set to STARTTLS (TLS) (or 587 with SSL/TLS) also fails this way: match them.

"Unable to connect with STARTTLS" or a message that the server does not support STARTTLS. Encryption is STARTTLS (TLS) but the server does not offer it. Use the port and encryption your provider gives; choose None only for an internal relay that has no encryption at all.

The test says sent, but nothing arrives. Look in spam. Then check From Address: a sender the login may not use is often accepted and then dropped.

A certificate error. The server is reached by IP address, or uses a self-signed certificate. Use its proper host name; if that is not possible, set SSL Verification to No.

The name has already been taken. Another email connector has that Name.

SMS

Sends text messages for rule actions and Security Watch alerts.

Before you start

Pick the operator, then collect what that operator needs:

Operator	Choose it when	You need
Twilio	You want international pay-as-you-go	Account SID, Auth Token and a Twilio number
Synchroweb	You have a Synchroweb SMS account (Malaysia)	The API key Synchroweb issued
Genusis	Genusis is your SMS provider	Their URL, client ID, username and private key
Generic	Any other SMS provider with an HTTP API	The API address, method and the names of its parameters

Twilio, step by step.

1. Sign up or sign in at twilio.com and open the Console.
2. On the console home page, under Account Info, copy the Account SID (starts with AC) and the Auth Token (click to reveal).
3. Go to Phone Numbers → Manage → Buy a number, pick a number with SMS capability in a country that can send to yours, and buy it.
4. A trial account sends only to numbers you have verified: add Ravi's mobile under Phone Numbers → Manage → Verified Caller IDs, or upgrade the account. Some countries also need the sender registered before messages are delivered; Twilio's console says so for your number.

Set it up

1. Connectors → Add Connector → SMS.
2. Switch Active on.
3. Type a Name if you want one (optional), then choose the Operator. The fields below it change with the operator.

Twilio

Field	What to put	Example
Twilio Phone No	The number you bought, with + and country code	+13603206925
Twilio SID	The Account SID	AC0123…
Twilio Password	The Auth Token	(from the console)

Synchroweb

Field	What to put
API Key	The key Synchroweb issued

Genusis

Field	What to put
Genusis URL	The URL Genusis gave you for sending
Client ID	Your client ID
Username	Your API username
Private Key	The private key Genusis gave you (not your password)

Generic

Field	What to put	Example
Request Method	GET or POST, as the provider's API says	POST
Full URI	The address to send to	https://sms.example.com/api/send
Message	The name of the parameter that carries the text	message
Phone Number	The name of the parameter that carries the number	to
Headers	Any header the API needs, such as its key	Authorization: Bearer abc123
Custom Body	Fixed extra fields, as name:value, separated by commas	sender:NORTHWIND, type:text
Body Format	Form Data or JSON, as the API expects	JSON

4. Advanced Configuration holds SSL Verification. Leave it on Yes unless the provider's API uses a self-signed certificate.
5. Click Save. You should see SMS settings saved successfully.

Check it works

1. Open it and click Test Connection. Send Test SMS opens.
2. Pick the country code (the list offers +60, +1, +44, +91, +62, +65, +66, +84, +855, +673, +95 and +856), type the rest of the number without it, and click Send.
3. Success reads SMS sent to [601…] id: […] with status: …. The message on the phone carries the same id, so you know it is this test.

What uses it

• Rule actions with the channel SMS. The action's To (phone) box takes the number; write it with its country code.
• Security Watch alerts.

Questions and problems

Please enter a valid phone number. The number box was empty or too short.

Twilio: "The 'To' number … is not a valid phone number" or "unverified". A trial account can only send to verified numbers. Verify it in Twilio, or upgrade.

Twilio credentials not configured (sid, token, or from number missing). One of the three Twilio boxes is empty.

The test failed with the provider's own message. That message is the operator's reply: a wrong key, no balance, or a sender not registered. Fix it on the provider's side.

Generic: the provider says a parameter is missing. Message and Phone Number are the names the API expects, not the values. Check them against the provider's documentation, letter for letter.

WhatsApp

Sends WhatsApp messages through the Synchroweb WhatsApp Business gateway, for rule actions and Security Watch alerts. Messages are not sent from your own WhatsApp account.

Before you start

You need an application on the Synchroweb WhatsApp gateway: an App ID (starts app_) and an App Secret. Synchroweb issues both once your account and sending number are set up; ask your Omaya provider if you do not have them. Sending is prepaid, so the account also needs credit.

Set it up

1. Connectors → Add Connector → WhatsApp.
2. Switch Active on.

Field	What to put	Example
Name	Optional label	Security
App ID *	The application id	app_1a2b3c4d5e6f7g8h
App Secret *	The secret	(from Synchroweb)
Set as Default *	Yes sends through the Synchroweb device, and makes this the one Omaya uses when you have several. No leaves the Synchroweb device out	Yes
Credit Balance	Not a setting. Click Check to see the balance on the gateway

3. Advanced Configuration holds SSL Verification; leave it on Yes.
4. Click Save: WhatsApp settings saved successfully.

Check it works

1. Click Check beside Credit Balance. Credit balance: … means the App ID and secret are right. With no credit, sending fails.
2. Click Test Connection. Test WhatsApp Connection opens.
3. Pick the country code, type the number without it, click Send. The phone gets This is a test message from Omaya. If you received this message, your WhatsApp integration is working correctly.

What uses it

• Rule actions with the channel WhatsApp. Put the number in To (phone) with its country code: 60123456789 for 012-345 6789 in Malaysia. A leading +, spaces and dashes are fine (+60 12-345 6789); Omaya sends digits only.
• Security Watch alerts and Visitor notifications.

Questions and problems

App ID and App Secret are required. Fill both before Test or Check.

Please enter a phone number. The test number box is empty.

The balance check fails. The App ID or secret is wrong, or the application is not active on the gateway: ask Synchroweb.

The test fails although the balance is fine. The number is not on WhatsApp, or it was typed with the country code twice. The selected code is added for you.

Telegram

Posts messages to a Telegram chat, group or channel through a bot you create. Free, and the quickest way to put alerts in front of a team.

The token identifies the bot; the chat id says where it posts. Telegram does not show a chat's id anywhere in its apps, which is why the page finds it for you.

Before you start: create the bot

1. In Telegram, search for @BotFather (the one with the blue tick) and open the chat.
2. Send /newbot.
3. Give it a display name, such as Northwind Alerts.
4. Give it a username that ends in bot, such as northwind_alerts_bot.
5. BotFather replies with a token like 123456789:AAH…. Copy all of it. If you lose it, send /token to BotFather to see it again.

Then put the bot where the messages should go:

• A group: open the group, Add members, search for the bot's username, add it. Send any message in the group afterwards.
• A channel: add the bot as an administrator of the channel.
• Yourself: open the bot's chat and press Start.

Set it up

1. Connectors → Add Connector → Telegram.
2. Switch Active on.

Field	What to put	Example
Name	Optional label	Facilities
Bot Token *	The token from BotFather	123456789:AAH…
Default Chat ID	Optional. The chat to send the test to. Rules do not use it: each rule names its own chat	-1001234567890

3. To fill Default Chat ID, click Find chat IDs beside it. Omaya asks your bot which chats it is in and lists them under Chats your bot can see — click one to use it. Click the group. A group's id is a negative number.
4. Click Save: Telegram settings saved.

Check it works

1. Click Test Connection (it works before saving too, with the token in the form). Send Test Telegram Message opens with the default chat id filled in (or use the search button beside the box to find one).
2. Click Send. Success reads Test message sent via @northwind_alerts_bot. and the chat gets This is a test message from Omaya…
3. With the chat id box empty, the test only checks the token: Token valid — connected to @northwind_alerts_bot. Enter a chat ID to send a test message.

What uses it

• Rule actions with the channel Telegram: fill Chat ID and Message.
• Visitor approvals in a company's Telegram chat (Visitor Management).

For example, Aisha's rule Server Room too warm has a Telegram action with Chat ID -1001234567890 (the Northwind Facilities group) and MessageServer Room at {{value}} °C.

Questions and problems

The Bot Token field is required. Test Connection and Find chat IDs need the token in the form first.

Invalid bot token. The token is mistyped or was revoked in BotFather. Copy it again, all of it, including the part before the colon.

The bot has not been added to any chat yet, or nothing happened in the last 24 hours. Telegram only keeps a bot's recent activity for a day. Add the bot to the group, send a message there, and click Find chat IDs again.

This bot has a webhook registered, so Telegram will not list its chats. The bot is also used by another service. Create a separate bot for Omaya, or find the id another way (below).

Finding the id another way. In a browser, open https://api.telegram.org/bot<your token>/getUpdates after sending a message in the group, and look for "chat":{"id":-100…. Treat that address like a password: it contains the token.

"Bad Request: chat not found". The chat id is wrong, or the bot is not in that chat (or was removed). "Forbidden: bot was blocked by the user". The person blocked the bot or never pressed Start.

Messages stopped after a group became a supergroup. Telegram gives the group a new id starting -100. Find it again and update the rules.

IoT Gateway (MQTT)

The usual way gateways send readings to Omaya: BLE, WiFi and LoRa gateways, and edge boxes forwarding meters and UPS readings. Each connector gets its own topic with a secret token in it.

Set it up

1. Connectors → Add Connector → IoT Gateway (MQTT).
2. Switch Active on.

Field	What to put	Example
Connector Name *	A label	Dusun — Level 3
Gateway Vendor *	The make, which decides how Omaya reads the messages: Dusun, Aruba, Minew, Mikrotik, Kiwire (NMS), ChirpStack (LoRa) or Generic / Other	Dusun
Protocol *	What the gateway hears: BLE, WiFi, LoRa / LoRaWAN, or Telemetry (meters, UPS, cooling through an edge gateway)	BLE (Bluetooth Low Energy)

3. Click Save: Gateway connector created. Until then the form says A unique MQTT topic token will be generated on save.
4. Open it again. It now shows the MQTT Topic with a copy button, and the broker's Host and Port (and a username and password if your broker uses them). Put these three or four values into the gateway.

Check it works

Test publishes a sample message on your topic and reports Test packet published to broker (…). That proves the broker is reachable from Omaya; it does not prove your gateway is. The real check is the gateway itself: within a minute of its first message it shows as online under Device → Gateway, and the connector's row on the Connectors page reads Receiving with Last message … ago. If it stays Quiet, click Test on the row: see Test a connector.

Rotate Token gives the connector a new topic. The old one stops working at once (Rotate the MQTT token? The old topic stops working immediately.), so update every gateway right after.

Gateway setup, the topic format, payloads and troubleshooting are in Connecting a gateway over MQTT, with per-model guides under Hardware.

IoT Gateway (HTTP)

For gateways and LoRaWAN network servers that can post over HTTPS but not publish over MQTT.

1. Connectors → Add Connector → IoT Gateway (HTTP).
2. Switch Active on. Fill Connector Name *, Gateway Vendor * (the same list as MQTT) and Protocol * (BLE, WiFi, BLE + WiFi (mixed) or LoRaWAN).
3. Save: HTTP gateway connector created.
4. Open it again: the Ingest Endpoint shows the URL to POST to, the header Content-Type: application/json, and the token. Copy the URL into the gateway.
5. Test asks the endpoint from Omaya itself: Endpoint reachable (… ms). Ready to accept packets.

Rotate Token changes the URL; the old one answers 401 from then on. What the gateway must send is in Publishing over HTTPS instead.

IoT Gateway (TCP and UDP)

Raw socket connections for custom hardware and legacy devices. Each connector listens on its own port, and a listener for that port has to be started on the Omaya server, which only your Omaya provider can do. Ask them before you choose these.

Field	TCP	UDP
Connector Name *	A label	A label
Device Vendor *	The make (same list as above)	The make
TCP Port * / UDP Port *	9000–9999. Starts at 9602	9000–9999. Starts at 9601
Packet Framing * (TCP)	Newline-delimited (one JSON object per line) or Length-prefixed (4-byte big-endian length header)
Packet Format * (UDP)		JSON or MessagePack

Each connector needs a port no other TCP (or UDP) connector on the server uses, in your organisation or any other. If the port is taken, Save stops with Port … is already used by …: pick another.

After Save, the connector's form shows the Host, Port and the shared secret (an HMAC-SHA256 key) that the device signs each packet with. Check Port says TCP listener is running on port … (or UDP listener on port … is running and responded to the echo.) when the listener is up. Nothing is listening on port … or No confirmation from a UDP listener on port … means it has not been started yet: send your Omaya administrator the port number, as the form also says under the connection details. Rotate Secret replaces the secret, and devices with the old one are refused.

Smart Home Bridge (Home Assistant)

Brings Home Assistant into Omaya, both ways. Sensors in Home Assistant (Matter, Zigbee, Z-Wave, anything it supports) become Omaya devices with readings, and lights, switches, locks, blinds, air-conditioning and scenes become things a rule can switch.

Mapping is the step people miss. Saving the connector only proves Omaya can reach Home Assistant; nothing is read or switched until entities are mapped.

Before you start

• Home Assistant must be reachable from Omaya's server, over the internet. A Home Assistant on a home or office network behind a router needs a public HTTPS address (Home Assistant Cloud, or a reverse proxy) or a tunnel. Its local name, such as homeassistant.local, will not work from outside.

• A long-lived access token. In Home Assistant:

  1. Click your name at the bottom of the left sidebar to open your profile.
  2. Open the Security tab (on older versions, scroll to the bottom of the profile page).
  3. Under Long-lived access tokens, click Create token, name it Omaya, click OK.
  4. Copy the token now. Home Assistant shows it once.

  The token can do whatever that Home Assistant user can. A user made for Omaya, without administrator rights, is the safer choice.

Set it up

1. Connectors → Add Connector → Smart Home Bridge (Matter / HA).
2. Switch Active on.

Field	What to put	Example
Connector Name *	A label	Northwind HA
Home Assistant URL *	The address you use in the browser, with the port, without /api and without a slash at the end	https://ha.northwind.example
Long-Lived Access Token *	The token	eyJ0eXAiOiJKV1Qi…
Poll interval (seconds) *	How often Omaya reads the latest values. 5 to 3600; 30 is the usual choice	30
Skip SSL certificate verification (self-signed HA cert)	Leave off. See Questions and problems	off

3. Click Save: Smart Home Bridge connector created.

Check it works

Open it and click Test connection. The result stays under the buttons: Connected. … means the URL and token work. Home Assistant responded with HTTP 401. Check the URL and access token. means the token is wrong.

Saving only proves Omaya can reach Home Assistant. Nothing is read or switched until you map entities.

Map entities

A Home Assistant device, such as a multi-sensor, has several entities: temperature, humidity, battery, occupancy. On the Mappings page you group the entities of one physical device, and each group becomes one Omaya device.

1. On the connector's form, click Manage entity mappings. (The button is greyed out until the connector has been saved.) The page Entity mappings opens.
2. Click Fetch entities from Home Assistant. Two lists appear:
   • Suggested devices: entities grouped by the device Home Assistant says they belong to.
   • Available Home Assistant entities: every entity not yet in a device, with Entity ID, Name, Domain and Current state. Type in Filter by entity_id, name, domain… to narrow it.
3. Either click Use this group on a suggested device, or tick entities in the list yourself and click Create device from N selected….
4. Create device from selected entities opens:

Field	What to put	Example
Device name *	What the device is called in Omaya	L3 Meeting Room
Entity ticks	Untick any entity you do not want (Select all / Deselect all)	light.l3_meeting_room, sensor.l3_meeting_room_temperature
Start enabled (poll on next tick)	Leave ticked	on

5. Click Create device. The page reloads and the device is listed under Active devices.
6. Give the new device a zone. Go to Device → Sensor (/admin/manage/device), open the device, set its zone (Level 3 → Meeting Room 3A), save. A device with no zone raises a configuration alert, … is sending data … but has no zone or venue, so its readings are being dropped.

Each device under Active devices has a switch to stop and start reading it, a pencil to rename it (the Omaya device is renamed too), and a bin to deactivate it. Deactivating keeps the Omaya device and its history.

Poll now on the connector's form reads every mapping at once and says Polled N mapping(s). …; useful after mapping, rather than waiting for the interval.

What is kept from Home Assistant. Besides sensor readings, Omaya records:

• Lights and switches: on or off, as switch_on, and each channel of a multi-gang switch as switch_on_1 to switch_on_4. Reports → Door & State, with What set to Lights & switches, shows how long each was on, and when.
• Air-con: on or off, and its mode and fan mode as states, beside its set-point.
• Battery voltage, when an entity reports it, as battery_mv. It feeds the Tag Health and Battery reports.

All of these can be used in a rule.

Use it in a rule

The rule action Home Assistant (Matter / Smart Home) has these fields, in this order:

Field	What to put
Home Assistant Connector *	The Smart Home Bridge connector. Only active ones are listed
Domain *	The kind of thing: Light, Switch, Lock, Cover (blind/curtain), Climate (AC), Fan, Input Boolean, Media Player, Scene, Select, Number, Button, Vacuum or Siren
Action *	What to do. The list depends on the domain: a light offers turn_on, turn_off, toggle
Entity *	The thing itself. Only entities in an enabled mapping are offered; the line under it says how many, and that Unmapped HA entities are hidden by design.
Extra parameters (optional)	Extra settings as JSON, such as {"brightness": 200} for a light or {"temperature": 22} for the air-conditioning

Aisha's example, switch the meeting-room lights off ten minutes after the last person leaves: watch the zone Meeting Room 3A; condition Area Empty For (radar) greater than 9; action Home Assistant → Light → turn_off → light.l3_meeting_room.

Questions and problems

The Entity list is empty, with "No active matter-bridge mappings for this connector yet." Nothing is mapped. Map the entity on the Mappings page first.

"No mapped entities matched the actionable domains (light/switch/lock/cover/...)." Only sensors are mapped. Add the light or switch to a device on the Mappings page.

Save the connector with a valid URL and token first. Shown by Fetch entities when the connector has no URL or token saved.

HTTP 401 on Test. The token is wrong, was deleted in Home Assistant, or its user was removed. Create a new one and paste it over the dots.

Test times out or cannot connect. Omaya's server cannot reach the URL. Open the same URL from a phone on mobile data, not on your office WiFi: if it does not load there, Omaya cannot reach it either.

Self-signed certificate. Tick Skip SSL certificate verification and save. It applies to everything Omaya does with that Home Assistant: Test connection, the regular readings, Fetch entities from Home Assistant, rule actions, device commands and OAIA. Test connection uses the box as it is in the form, so you can try it before saving. A real certificate (Home Assistant Cloud, or Let's Encrypt on a reverse proxy) is still the better fix.

The device is mapped but shows no readings. It has no zone (step 6 above), or its switch under Active devices is off.

S3 Cloud Export

Copies the files of scheduled reports into an AWS S3 bucket, so they are kept in your own storage as well as emailed.

Once Active and Auto-export scheduled reports to S3 are both on, every report scheduled under System → Schedule Report is uploaded to the bucket as well as emailed: the same CSV or PDF, in a folder per schedule under the prefix, such as reports/weekly-presses-12/button-press-2026-10-13.csv. Switch Auto-export off and the bucket is only written by the test.

Before you start: a bucket and a key

In the AWS console:

1. S3 → Create bucket. Choose a name (lowercase letters, numbers, dots and dashes only, e.g. northwind-omaya-reports) and a region (e.g. Asia Pacific (Singapore) ap-southeast-1). Leave Block all public access on.
2. IAM → Users → Create user, name it omaya-export. Do not give it console access.
3. On the user, Add permissions → Create inline policy, JSON tab, and paste (with your bucket's name):

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::northwind-omaya-reports/*" },
    { "Effect": "Allow", "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::northwind-omaya-reports/*" },
    { "Effect": "Allow", "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::northwind-omaya-reports" }
  ]
}

s3:PutObject is the only one exports need, and the only one Test needs. s3:DeleteObject lets Test remove its test file afterwards. s3:ListBucket fills Recent S3 uploads. Leave out the last two if you prefer; the test then leaves its file behind and the list stays empty. 4. Security credentials → Create access key, choose Application running outside AWS, and copy the Access key ID and Secret access key. AWS shows the secret once.

Set it up

1. Connectors → Add Connector → S3 Cloud Export.
2. Switch Active on.

Field	What to put	Example
Name	Optional label	Report archive
AWS Region *	The bucket's region code (suggestions appear as you type). Starts as ap-southeast-1	ap-southeast-1
Bucket name *	The bucket name exactly	northwind-omaya-reports
Key prefix (folder)	Optional folder inside the bucket. Starts as reports/	omaya/reports/
Access Key ID	The access key id	AKIA…
Secret Access Key	The secret	(from AWS)
Auto-export scheduled reports to S3	On uploads every scheduled report here after it is emailed. Starts on	on

3. Click Save: S3 settings saved.

Check it works

Click Test & upload sample file. Omaya writes a small file named like omaya-test-20261013-091500.txt into the prefix with what is in the form, saved or not, and deletes it again: S3 OK — wrote … and deleted it again. If the key may not delete, the file stays and the message says so. Refresh exports lists what is in the bucket under Recent S3 uploads (this needs s3:ListBucket).

Then schedule a report under System → Schedule Report; when it is next sent, its file appears in the bucket. If the upload fails, the email still goes, and the schedule's last error starts with S3: and the reason.

Questions and problems

Missing the bucket. (or region, access key, secret key) The box is empty and nothing is saved for it either.

AccessDenied: Access Denied. The policy is missing s3:PutObject, or names a different bucket.

Reports are emailed but nothing reaches the bucket. The connector is not Active, or Auto-export scheduled reports to S3 is off.

Not Found / NoSuchBucket, or "the bucket you are attempting to access must be addressed using the specified endpoint". The bucket name is wrong, or the region is not the bucket's region.

The bucket format is invalid. The bucket name may only have lowercase letters, numbers, dots and dashes.

Outbound Webhooks

Posts events to a system of yours the moment they happen: a SIEM, a ticketing tool, a chat tool, the Warehouse app's ERP.

1. Connectors → Add Connector → Outbound Webhooks. The panel lists your webhooks (No webhooks yet at first).
2. Click New webhook.
3. Fill in:

Field	What to put	Example
Name *	A label	Northwind ticketing
URL *	The address that receives the POST. Must be reachable from Omaya's server; use HTTPS	https://tickets.northwind.example/hooks/omaya
Event types this webhook subscribes to	Tick the events you want. All, None and Flip help; leave everything unticked to receive every event. Events from an app you do not have are marked module not installed	rule.fired
Active	On	on

4. Click Save. Webhook secret opens with the signing secret. Copy it now: Save this somewhere safe — you can't see it again. Your endpoint uses it to check the X-Omaya-Signature header.
5. On the webhook's card, click Test. Delivered — HTTP 200 in … ms means your endpoint answered; Failed: … gives the reason.

Each card also has Pause / Resume, Edit and a bin. Recent deliveries (last 20) shows each delivery's status, HTTP code and time taken, and Event-type catalog lists every event you can subscribe to. To change the secret, delete the webhook and create it again.

What a delivery contains, how to verify the signature and how retries work are in Being told when something changes and Webhook events. A rule can also post to a URL directly with its Webhook (HTTP POST) action, without a webhook here.

External CMMS

Copies every work order Omaya opens into your existing maintenance system, and closes it there when it is closed in Omaya. Work orders come from the Facility Management app, so it must be on.

What Omaya sends

Omaya speaks one contract, Generic REST, to the Base URL. The form shows it in a box under CMMS Configuration:

• A new work order: POST <Base URL>/work-orders, with a JSON body carrying external_id (Omaya's id for it), title, description, priority (1_critical to 4_low), status, category, due_at and created_at.
• When it is done or cancelled in Omaya: PATCH <Base URL>/work-orders/<id>/close, where <id> is the id (or sys_id) your system returned, with status and note.
• Every request carries Authorization: Bearer <token>, and X-Project-Id when Project / scope id is set.

ServiceNow, Fiix, UpKeep and most other CMMS products do not have those two addresses as they come. Your CMMS administrator (or an integration tool) needs to provide them and turn them into the product's own calls. Plan that before you set the connector up.

Set it up

1. Connectors → Add Connector → External CMMS.
2. Switch Active on.

Field	What to put	Example
Connector Name *	A label	Maintenance system
Base URL *	The address the two calls above are made under, without a slash at the end. Omaya adds /work-orders	https://cmms-bridge.northwind.example/api
Project / scope id (optional)	Sent as the X-Project-Id header when set	FAC-NWT
Bearer token *	An API token for a user allowed to create and update work orders	(from your CMMS)

3. Click Save: External CMMS connector created.
4. Open it and click Test in the form. It makes an authenticated request to the Base URL and shows what came back under the buttons, such as HEAD https://… → HTTP 200 OK, or HTTP 401 Unauthorized — the token is wrong or lacks rights. with the start of the reply. A 404 can be fine when nothing lives at the Base URL itself; the work orders go to /work-orders.

Check it works

Raise a test work order in Facility Management (Test — please ignore) and check it appears in your CMMS. Close it in Omaya and check it closes there.

Under the buttons the form shows how the last copy went: Last sync succeeded … or Last sync failed …: … with the reason, and how many succeeded and failed.

When the CMMS is down. A push that gets no answer, a timeout, 429 or a 5xx is tried again after about 1, 5, 15 and 60 minutes. A push the CMMS refuses outright (401, 403, 404, a rejected body) is not retried: fix the token or the address, then raise the work orders it missed by hand. Meanwhile the connector's row shows Failing.

ERP

Used by the Warehouse app. Your ERP normally pushes items, partners and orders to Omaya's API and hears back through Outbound Webhooks. This connector adds a nightly safety net: the addresses where Omaya can re-pull items, partners and open orders, so anything a lost message left behind is corrected.

The top of the form repeats how the three routes fit together, with your API address and organisation id. API keys are created under My Profile → API keys.

1. Connectors → Add Connector → ERP.
2. Switch Active on (One ERP per organisation: the first active one is used.).

Field	What to put	Example
Connector Name *	A label	AutoCount — HQ
ERP system	For your records: Generic REST (JSON), AutoCount, SQL Account, SAP Business One, Odoo, NetSuite or Other	AutoCount
Items URL	Optional. Where the ERP lists items as JSON	https://erp.northwind.example/api/omaya/items
Partners URL	Optional. Suppliers and customers	https://erp.northwind.example/api/omaya/partners
Open orders URL	Optional. Open orders	https://erp.northwind.example/api/omaya/orders?status=open
Header	The name of the header your ERP wants for its key. Letters, numbers and dashes	Authorization
Value	The key, sent in that header	Bearer 7f3c…
Re-pull every night at 02:30 (site time)	Tick to run the re-pull nightly	on
Also send a warehouse.movement webhook for every stock movement	Usually off	off

3. Click Save: ERP connector created.
4. Open it and click Test pull. It fetches each address and reports, for example, Items: HTTP 200, 412 rows · Partners: HTTP 200, 38 rows · Orders: HTTP 200, 17 rows. Nothing is imported by the test.

Each address must answer a JSON list, or {"data": [...]}, in the same shape the Warehouse API takes; the Warehouse page has the shapes.

Questions and problems. This address points inside our network, so Omaya can't call it. The address is private or local; Omaya pulls over the internet, so an ERP inside your network should push to the API instead. Omaya can't find …: the host name does not exist publicly. HTTP 401 or 403: the Header or Value is wrong. not a JSON list: the address answers, but not with a list. No pull URLs set: the ERP pushes to the API only. That works; nothing to test here. is not an error.

Access Control (Gate / Lift)

Used by Visitor Management: when a visitor with an access card is checked in, the card is granted access on the gates, turnstiles or lift; on check-out it is revoked. Every active access connector hears each check-in and check-out, so a turnstile and a lift can both be on.

Set it up

1. Connectors → Add Connector → Access Control (Gate / Lift).
2. Switch Active on.
3. The top of the form:

Field	What to put	Example
Connector Name *	A label	Lobby turnstiles
What it opens	Gate / door, Turnstile, Lift or Other	Turnstile
Floors every visitor gets	For a lift: the lobby and shared floors. Each host company's own floors (set in the Visitor settings, under the company) are added to these	G, L1
System *	MicroEngine xPortalNet, Generic HTTP (webhook) or Generic MQTT. The fields below change with it	MicroEngine xPortalNet

MicroEngine xPortalNet. First ask the access-control administrator for the server's address and one or more API logins (API3, API4…). The API allows one session per login, so several logins let Omaya keep working while another system is connected.

Field	What to put	Example
Server host *	The xPortalNet server's address. Its API ports (17201–17211) are fixed by the product	10.20.0.15
API logins *	One username:password per line	API3:… and API4:… on two lines
Door controllers	The controller ids the card is pushed to after each change, separated by commas	0001, 0002
Door access right on check-in	The xPortalNet access-right id for visitors. Starts as 0009	0009
…and on check-out	Usually the "no access" right. Starts as 0000	0000
Check out visitors when the gate records their exit	On if the gate records exits: every five minutes each visitor on site with a card is checked, and an exit after their check-in checks them out	on

Generic HTTP (webhook). For any other system that can take a web request.

Field	What to put	Example
URL *	Where check-ins (and check-outs) are sent	https://access.northwind.example/omaya
Method	POST or PUT	POST
URL for check-out	Blank sends check-outs to the URL above, told apart by "event" and the X-Omaya-Event header
Extra headers	One Name: value per line, such as the system's API key	X-Api-Key: 9b1e…

Generic MQTT. Omaya publishes each check-in and check-out on its own MQTT broker for a bridge on your site to pick up.

Field	What to put	Example
Topic	Blank uses omaya-access/{tenant}/{connector}. {tenant}, {connector} and {event} are filled in. It must not start with omaya/	omaya-access/northwind/lobby

For both generic systems:

Field	What to put
Signing secret	A secret your system uses to check the message came from Omaya. HTTP gets X-Omaya-Signature: sha256=<HMAC of the body>; MQTT messages are wrapped as {"body": "…", "signature": "sha256=…"}. Anyone can publish on the broker, so a bridge should refuse unsigned grants
Body template	Blank sends Omaya's own JSON. Or write your system's own, using the placeholders listed under the box; it must be valid JSON once filled in
Only for visitors given an access card	Off sends every check-in, with the badge and card number when there are any

A body template for a controller that wants action, card and floors:

{"action":"{{event}}","card":"{{card_no}}","floors":{{floors}}}

The placeholders are {{event}}, {{connector}}, {{tenant}}, {{visit_uid}}, {{stay_uid}}, {{visitor_name}}, {{visitor_company}}, {{host_companies}}, {{host_name}}, {{card_no}}, {{tag_mac}}, {{floors}} (a JSON list, so no quotes round it), {{floors_csv}}, {{valid_from}}, {{valid_until}} and {{sent_at}}.

4. At the bottom, Timeout (seconds): 2 to 60, starting at 10.
5. Click Save: Access control connector created.

Check it works

Open it and click Test in the form.

• MicroEngine: Logged in. N controller(s) responding. is right. Logged in, but controller(s) not responding: … names the controllers to check.
• Generic: Omaya sends a sample check-in and shows Sample sent — … or Failed — … with the reason.

Then do a whole visit: register a test visitor with a card number, check them in at the desk, try the card on the turnstile, check them out, try it again.

Questions and problems. At least one username:password line is required.: MicroEngine needs a login. The body template is not valid JSON once filled in: usually quotes round the floors placeholder, or a missing comma. Topics under omaya/ belong to gateway ingestion — pick another root, e.g. omaya-access/. says what to do. Card granted but the door does not open: the Door controllers list is missing that door's controller.

Identity Provider (Singpass / MyDigital ID)

Lets a visitor prove who they are with a national digital identity instead of typing an ID number. It is used by the Visitor app's ID-first registration, once ID verification is set to the provider under Your Apps → Visitor (Visitor settings).

Start with the Simulator: it needs nothing outside Omaya and lets you walk the whole ID-first flow before a real provider is ready.

Before you start

• Singpass (Singapore): register as a relying party on the Singpass Developer Portal, as a Singapore-registered entity (UEN). The sandbox needs no approval; production does. You get a client id, and a purpose id per use case.
• MyDigital ID (Malaysia): go through MyDigital ID's relying-party onboarding to get a client id and secret.
• Another OpenID Connect provider: a client id and secret, and its issuer address.

Set it up

1. Connectors → Add Connector → Identity Provider (Singpass / MyDigital ID).
2. Switch Active on (The active connector is the one the Visitor app offers on its ID step.).

Field	What to put	Example
Connector name *	A label	Singpass
Provider *	Singpass (Singapore), MyDigital ID (Malaysia), Other OpenID Connect provider, or Simulator (demo / testing)	Singpass (Singapore)
Environment *	Sandbox, Test / staging or Production. The simulator is sandbox only	Sandbox

3. Under Relying party:

Field	Used by	What to put
Client id	all but the simulator	From the provider
Purpose id	Singpass	From the developer portal
Client authentication	MyDigital ID, OpenID Connect	Client secret, or Private key JWT (our signing key)
Client secret	MyDigital ID, OpenID Connect	From the provider
Scopes	all	Singpass: uinfin name (add email mobileno nationality if approved). Others: openid profile

4. Provider endpoints (MyDigital ID and OpenID Connect): leave blank to use the provider's known addresses for the environment. For another OpenID Connect provider, fill Issuer (discovery); the rest is read from it. Person URL override (Singpass) is blank unless Singpass tells you otherwise.
5. What the provider calls things (MyDigital ID and OpenID Connect): Name claim, ID number claim (dotted paths work, such as person.name.value) and ID type it returns (IC / NRIC, Passport or Other). Blank uses the usual names.
6. Our keys: leave Generate the key pair on save ticked.
7. Click Save: Identity provider connector created.
8. Open it again. It now shows a JWKS URL (give this to the provider) and a Redirect URL (register with the provider). Register both in the provider's portal.

Check it works

Click Test. Reached Singpass (sandbox); N provider key(s) published. The next step is a real sign-in from the ID step. (or Reached … at … for the others) means Omaya can talk to the provider. Then set ID verification in the Visitor settings and register yourself on the visitor registration page.

Questions and problems. Client id and a generated key pair are required.: fill Client id and save with the key box ticked. The simulator is for the sandbox only.: set Environment to Sandbox. Could not reach …: the provider address is wrong for the environment, or the provider is down. Ticking Generate a new key pair on save later replaces the keys, and the provider must fetch the JWKS again before sign-ins work.

When a connector stops working

Rules fired, but nothing arrived. On Monitor → Live Monitor → Rules, each action of a firing shows sent, skipped (it needs a connector and none of that kind is active) or failed. Skipped: switch the connector on. Failed or sent but never received: open the connector and run its test with the same address or chat id the rule uses.

It worked yesterday. Someone switched Active off, a password or token was changed on the other side (a Gmail App Password revoked, a Home Assistant token deleted, a bot token regenerated in BotFather), or the other product's account ran out of credit. Run the test: the message it shows comes from the other product.

A gateway connector shows Quiet. Nothing has arrived on it for 15 minutes. Click Test on its row and follow Troubleshooting a quiet gateway connector.

A connector shows Failing. Point at its status line to read the error, then open the connector, correct what the error points to and run the test in its form.

A connector is missing from the list. Your role lacks its permission (see Who can see it).

See also

Your first rule · Being told when something changes · Connecting a gateway over MQTT · Linking room calendars · Visitor Management · Warehouse