Connect → devices → access codes

Every vendor account your tenant links goes through the same four resources, regardless of which provider it is.

1. Start a connect webview

In test mode this completes instantly against simulated devices — no vendor redirect happens.

POST /v1/connect_webviews
{
  "provider": "TTLOCK",
  "customerRedirectUrl": "https://yourapp.com/lock-connected"
}

2. List connected accounts and devices

GET /v1/connected_accounts
GET /v1/devices?connected_account_id=<id>

Each device's capabilities tells you which access-code delivery methods it actually supports — see Devices & capabilities.

3. Create a time-bound access code

POST /v1/access_codes
Idempotency-Key: <a key you generate per logical request>

{
  "deviceId": "<device id>",
  "deliveryMethod": "KEYPAD",
  "name": "Guest — unit 4B",
  "validFrom": "2026-08-01T15:00:00.000Z",
  "validUntil": "2026-08-03T11:00:00.000Z"
}

deliveryMethod defaults to KEYPAD— the code is synced to the lock and the guest types it on the physical keypad, nothing further to do on your side until it's time to revoke. For a lock with no keypad, use REMOTE instead — see Remote unlock for that flow, which is meaningfully different (your app collects the code from the guest and submits it back to lockapi to trigger the unlock).

Always send an Idempotency-Key on this endpoint — see Idempotency. A guest must never receive two live access codes because a request was retried.

4. Revoke it when the stay ends

DELETE /v1/access_codes/<id>