{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/review-axis-credential-disablement-separately-from-validity-dates/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/",
        "slug": "review-axis-credential-disablement-separately-from-validity-dates",
        "url": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/review-axis-credential-disablement-separately-from-validity-dates/"
        },
        "title": "Review Axis credential disablement separately from validity dates",
        "summary": "Review credential enablement and its validity interval separately, including any narrower access-profile interval. A usable date range is not a complete credential acceptance record.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "advisory",
            "name": "Advisory"
        },
        "featured": false,
        "image": {
            "theme": "physical-security",
            "label": "Physical security",
            "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "access-control",
                "name": "Access Control",
                "url": "https://update.dsesecurity.com/topic/access-control/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-30T06:05:08+00:00",
        "modified_at": "2026-10-30T06:05:12+00:00",
        "reviewed_on": "2026-10-30",
        "reading_minutes": 3,
        "word_count": 507,
        "potentially_affected": "Axis access-control integrations exposing the documented Credential and CredentialAccessProfile structures; actual device and integration support require confirmation.",
        "dse_recommendation": "DSE recommends a credential review that records enablement, status and each relevant time interval independently.",
        "primary_source": {
            "name": "Axis Communications — Access control service",
            "url": "https://developer.axis.com/vapix/physical-access-control/access-control-service/",
            "published_on": null,
            "authority": "Axis Communications"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p><strong>Bottom line:</strong> Review the credential’s enabled state and time restrictions as separate fields. Keep the linked access-profile interval with that review before approving an access change.</p>\n<h2>Source fact: documented behavior</h2>\n<p>The <a href=\"https://developer.axis.com/vapix/physical-access-control/access-control-service/\" target=\"_blank\" rel=\"noopener noreferrer\">Access control service</a> defines a credential’s <code>Enabled</code> field separately from <code>Status</code>, which supplies information such as a reason for disablement.</p>\n<p>For a credential, null <code>ValidFrom</code> means no start-time restriction, while null <code>ValidTo</code> means no stop-time restriction.</p>\n<p>A <code>CredentialAccessProfile</code> reference can further restrict the associated access profile through its optional validity fields.</p>\n<h2>What the source does not establish</h2>\n<p>This article defines a configuration review, not a promise that a credential will open a door. Keep authentication requirements, schedules, controller support and the actual door decision in the deployment assessment. Do not substitute a friendly status label for the complete approved object.</p>\n<h2>Applicability questions</h2>\n<ul>\n<li>Which exact credential token is being reviewed?</li>\n<li>What enabled state and validity interval does the owner intend?</li>\n<li>Does a linked access profile impose a narrower interval?</li>\n<li>Which isolated credential and door can be used without affecting normal access?</li>\n</ul>\n<h2>DSE recommendation: controlled next steps</h2>\n<p><em>The following steps are DSE recommendations based on the cited source.</em></p>\n<p>DSE recommends a credential review that records enablement, status and each relevant time interval independently.</p>\n<ol>\n<li>Retrieve the intended credential through the supported administrative workflow and retain a sanitized copy. Match its token to the owner’s approved test identity. Put <code>Enabled</code>, <code>Status</code>, <code>ValidFrom</code> and <code>ValidTo</code> on separate lines of the review. Preserve a null value explicitly instead of replacing it with a guessed expiry or a blank that another reviewer might interpret differently.</li>\n<li>Follow each relevant access-profile reference and compare its intended interval with the credential record. Use a proposed temporary-worker scenario with a defined end time to review the intended restriction. Ask the access owner to identify the exact field that expresses that end time. Reject a plan that relies only on a descriptive label such as temporary or inactive.</li>\n<li>Approve any edit as a narrowly scoped change. Keep the starting object and referenced profile values available for recovery. On an isolated test credential, change only the intended field, then retrieve the result again. Have the reviewer distinguish the enablement decision from the time-window decision before allowing the test identity to be used at an approved door.</li>\n</ol>\n<h2>Verification and evidence</h2>\n<p>Proposed verification: prepare one enabled-state case and one time-restricted case with the access owner. Compare the returned objects with the intended values, then observe the permitted access decision through the supported test arrangement. Record the actual observation time and controller time reference without assuming a client display uses the same interpretation.</p>\n<p>Have a second administrator reconstruct which field controlled each proposed case. Preserve an unexpected result for investigation instead of repeatedly widening dates or enabling additional profiles. Remove the test identity through the approved process after the review. These are proposed checks; no credential was changed or door operated for this article.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://developer.axis.com/vapix/physical-access-control/access-control-service/\" target=\"_blank\" rel=\"noopener noreferrer\">Access control service</a> — Axis Communications; official VAPIX documentation.</li>\n</ul>\n<p>Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.</p>\n",
        "content_text": "Bottom line: Review the credential’s enabled state and time restrictions as separate fields. Keep the linked access-profile interval with that review before approving an access change.\nSource fact: documented behavior\nThe Access control service defines a credential’s Enabled field separately from Status, which supplies information such as a reason for disablement.\nFor a credential, null ValidFrom means no start-time restriction, while null ValidTo means no stop-time restriction.\nA CredentialAccessProfile reference can further restrict the associated access profile through its optional validity fields.\nWhat the source does not establish\nThis article defines a configuration review, not a promise that a credential will open a door. Keep authentication requirements, schedules, controller support and the actual door decision in the deployment assessment. Do not substitute a friendly status label for the complete approved object.\nApplicability questions\n\nWhich exact credential token is being reviewed?\nWhat enabled state and validity interval does the owner intend?\nDoes a linked access profile impose a narrower interval?\nWhich isolated credential and door can be used without affecting normal access?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a credential review that records enablement, status and each relevant time interval independently.\n\nRetrieve the intended credential through the supported administrative workflow and retain a sanitized copy. Match its token to the owner’s approved test identity. Put Enabled, Status, ValidFrom and ValidTo on separate lines of the review. Preserve a null value explicitly instead of replacing it with a guessed expiry or a blank that another reviewer might interpret differently.\nFollow each relevant access-profile reference and compare its intended interval with the credential record. Use a proposed temporary-worker scenario with a defined end time to review the intended restriction. Ask the access owner to identify the exact field that expresses that end time. Reject a plan that relies only on a descriptive label such as temporary or inactive.\nApprove any edit as a narrowly scoped change. Keep the starting object and referenced profile values available for recovery. On an isolated test credential, change only the intended field, then retrieve the result again. Have the reviewer distinguish the enablement decision from the time-window decision before allowing the test identity to be used at an approved door.\n\nVerification and evidence\nProposed verification: prepare one enabled-state case and one time-restricted case with the access owner. Compare the returned objects with the intended values, then observe the permitted access decision through the supported test arrangement. Record the actual observation time and controller time reference without assuming a client display uses the same interpretation.\nHave a second administrator reconstruct which field controlled each proposed case. Preserve an unexpected result for investigation instead of repeatedly widening dates or enabling additional profiles. Remove the test identity through the approved process after the review. These are proposed checks; no credential was changed or door operated for this article.\nOfficial references\n\nAccess control service — Axis Communications; official VAPIX documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.",
        "content_markdown": "Bottom line: Review the credential’s enabled state and time restrictions as separate fields. Keep the linked access-profile interval with that review before approving an access change.\n\n## Source fact: documented behavior\n\nThe [Access control service](https://developer.axis.com/vapix/physical-access-control/access-control-service/) defines a credential’s Enabled field separately from Status, which supplies information such as a reason for disablement.\n\nFor a credential, null ValidFrom means no start-time restriction, while null ValidTo means no stop-time restriction.\n\nA CredentialAccessProfile reference can further restrict the associated access profile through its optional validity fields.\n\n## What the source does not establish\n\nThis article defines a configuration review, not a promise that a credential will open a door. Keep authentication requirements, schedules, controller support and the actual door decision in the deployment assessment. Do not substitute a friendly status label for the complete approved object.\n\n## Applicability questions\n\n- Which exact credential token is being reviewed?\n\n- What enabled state and validity interval does the owner intend?\n\n- Does a linked access profile impose a narrower interval?\n\n- Which isolated credential and door can be used without affecting normal access?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends a credential review that records enablement, status and each relevant time interval independently.\n\n- Retrieve the intended credential through the supported administrative workflow and retain a sanitized copy. Match its token to the owner’s approved test identity. Put Enabled, Status, ValidFrom and ValidTo on separate lines of the review. Preserve a null value explicitly instead of replacing it with a guessed expiry or a blank that another reviewer might interpret differently.\n\n- Follow each relevant access-profile reference and compare its intended interval with the credential record. Use a proposed temporary-worker scenario with a defined end time to review the intended restriction. Ask the access owner to identify the exact field that expresses that end time. Reject a plan that relies only on a descriptive label such as temporary or inactive.\n\n- Approve any edit as a narrowly scoped change. Keep the starting object and referenced profile values available for recovery. On an isolated test credential, change only the intended field, then retrieve the result again. Have the reviewer distinguish the enablement decision from the time-window decision before allowing the test identity to be used at an approved door.\n\n## Verification and evidence\n\nProposed verification: prepare one enabled-state case and one time-restricted case with the access owner. Compare the returned objects with the intended values, then observe the permitted access decision through the supported test arrangement. Record the actual observation time and controller time reference without assuming a client display uses the same interpretation.\n\nHave a second administrator reconstruct which field controlled each proposed case. Preserve an unexpected result for investigation instead of repeatedly widening dates or enabling additional profiles. Remove the test identity through the approved process after the review. These are proposed checks; no credential was changed or door operated for this article.\n\n## Official references\n\n- [Access control service](https://developer.axis.com/vapix/physical-access-control/access-control-service/) — Axis Communications; official VAPIX documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/",
                "url": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-30"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Access Control",
                        "item": "https://update.dsesecurity.com/topic/access-control/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Review Axis credential disablement separately from validity dates",
                        "item": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/#article",
                "identifier": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/",
                "url": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/",
                "headline": "Review Axis credential disablement separately from validity dates",
                "description": "Review credential enablement and its validity interval separately, including any narrower access-profile interval.",
                "abstract": "Review credential enablement and its validity interval separately, including any narrower access-profile interval. A usable date range is not a complete credential acceptance record.",
                "articleBody": "Bottom line: Review the credential’s enabled state and time restrictions as separate fields. Keep the linked access-profile interval with that review before approving an access change.\nSource fact: documented behavior\nThe Access control service defines a credential’s Enabled field separately from Status, which supplies information such as a reason for disablement.\nFor a credential, null ValidFrom means no start-time restriction, while null ValidTo means no stop-time restriction.\nA CredentialAccessProfile reference can further restrict the associated access profile through its optional validity fields.\nWhat the source does not establish\nThis article defines a configuration review, not a promise that a credential will open a door. Keep authentication requirements, schedules, controller support and the actual door decision in the deployment assessment. Do not substitute a friendly status label for the complete approved object.\nApplicability questions\n\nWhich exact credential token is being reviewed?\nWhat enabled state and validity interval does the owner intend?\nDoes a linked access profile impose a narrower interval?\nWhich isolated credential and door can be used without affecting normal access?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a credential review that records enablement, status and each relevant time interval independently.\n\nRetrieve the intended credential through the supported administrative workflow and retain a sanitized copy. Match its token to the owner’s approved test identity. Put Enabled, Status, ValidFrom and ValidTo on separate lines of the review. Preserve a null value explicitly instead of replacing it with a guessed expiry or a blank that another reviewer might interpret differently.\nFollow each relevant access-profile reference and compare its intended interval with the credential record. Use a proposed temporary-worker scenario with a defined end time to review the intended restriction. Ask the access owner to identify the exact field that expresses that end time. Reject a plan that relies only on a descriptive label such as temporary or inactive.\nApprove any edit as a narrowly scoped change. Keep the starting object and referenced profile values available for recovery. On an isolated test credential, change only the intended field, then retrieve the result again. Have the reviewer distinguish the enablement decision from the time-window decision before allowing the test identity to be used at an approved door.\n\nVerification and evidence\nProposed verification: prepare one enabled-state case and one time-restricted case with the access owner. Compare the returned objects with the intended values, then observe the permitted access decision through the supported test arrangement. Record the actual observation time and controller time reference without assuming a client display uses the same interpretation.\nHave a second administrator reconstruct which field controlled each proposed case. Preserve an unexpected result for investigation instead of repeatedly widening dates or enabling additional profiles. Remove the test identity through the approved process after the review. These are proposed checks; no credential was changed or door operated for this article.\nOfficial references\n\nAccess control service — Axis Communications; official VAPIX documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.",
                "datePublished": "2026-10-30T06:05:08+00:00",
                "dateModified": "2026-10-30T06:05:12+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/review-axis-credential-disablement-separately-from-validity-dates/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Review Axis credential disablement separately from validity dates"
                },
                "articleSection": [
                    "Access Control",
                    "IT"
                ],
                "keywords": [
                    "Access Control",
                    "IT",
                    "Guide",
                    "Advisory priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Access Control",
                        "url": "https://update.dsesecurity.com/topic/access-control/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 507,
                "timeRequired": "PT3M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Axis Communications — Access control service",
                    "url": "https://developer.axis.com/vapix/physical-access-control/access-control-service/"
                }
            }
        ]
    }
}