Review Axis credential disablement separately from validity dates

Bottom line: Review the credential’s enabled state and time restrictions as separate fields. Keep the linked access-profile interval with that review before approving an access change.

Source fact: documented behavior

The Access control service defines a credential’s Enabled field separately from Status, which supplies information such as a reason for disablement.

For a credential, null ValidFrom means no start-time restriction, while null ValidTo means no stop-time restriction.

A CredentialAccessProfile reference can further restrict the associated access profile through its optional validity fields.

What the source does not establish

This article defines a configuration review, not a promise that a credential will open a door. Keep authentication requirements, schedules, controller support and the actual door decision in the deployment assessment. Do not substitute a friendly status label for the complete approved object.

Applicability questions

• Which exact credential token is being reviewed?
• What enabled state and validity interval does the owner intend?
• Does a linked access profile impose a narrower interval?
• Which isolated credential and door can be used without affecting normal access?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends a credential review that records enablement, status and each relevant time interval independently.

1. Retrieve the intended credential through the supported administrative workflow and retain a sanitized copy. Match its token to the owner’s approved test identity. Put Enabled, Status, ValidFrom and ValidTo on separate lines of the review. Preserve a null value explicitly instead of replacing it with a guessed expiry or a blank that another reviewer might interpret differently.
2. Follow each relevant access-profile reference and compare its intended interval with the credential record. Use a proposed temporary-worker scenario with a defined end time to review the intended restriction. Ask the access owner to identify the exact field that expresses that end time. Reject a plan that relies only on a descriptive label such as temporary or inactive.
3. Approve any edit as a narrowly scoped change. Keep the starting object and referenced profile values available for recovery. On an isolated test credential, change only the intended field, then retrieve the result again. Have the reviewer distinguish the enablement decision from the time-window decision before allowing the test identity to be used at an approved door.

Verification and evidence

Proposed verification: prepare one enabled-state case and one time-restricted case with the access owner. Compare the returned objects with the intended values, then observe the permitted access decision through the supported test arrangement. Record the actual observation time and controller time reference without assuming a client display uses the same interpretation.

Have a second administrator reconstruct which field controlled each proposed case. Preserve an unexpected result for investigation instead of repeatedly widening dates or enabling additional profiles. Remove the test identity through the approved process after the review. These are proposed checks; no credential was changed or door operated for this article.

Official references

• Access control service — Axis Communications; official VAPIX documentation.

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.