C-7 #1050088 · Liability insured · UniFi Certified PartnerNever the cheapest. Built to last.
UniFi Lab 22Access to a Z-Wave deadbolt
Front door:granted, bolt stays thrown
Tap, bolt opens
Access says granted, but the deadbolt stays locked
The door has a deadbolt and no strike, so has to do the unlocking. Get it talking to Access, fix the automation so only granted opens the door, then get the unlock to the lock.
Front door with a Z-Wave deadbolt, LOCK1, and no strike in the frame. ENTRY1, a G6 Pro Entry, on the wall beside it. In the rack: the console running Access, SW1 a PoE++ switch, and HUB1 a Door Hub with nothing wired to its lock terminal. Home Assistant on a Raspberry Pi with a Z-Wave stick. ENTRY1 shows granted, but LOCK1's bolt is thrown and Home Assistant is idle.LAB 22What the visitor seesDOORLOCK1Z-WaveZ-Wave deadbolt onlybolt thrownENTRY1G6 Pro EntrygrantedRACKAccesseventsZ-WaveUDM Pro Max · AccessSW1PoE++HUB1HALOCK: emptyHA AUTOMATIONtriggeraction12345Access says granted. The doorstays locked.ENTRY1: grantedLOCK1: bolt thrownHA: idle
{"access-event":{"t":"Access event","d":"The event a door fires in Home Assistant when someone tries to get in: access_granted or access_denied, with who it was and how (NFC, PIN or Face)."},"access-port":{"t":"Access port","d":"One VLAN only, untagged. Fine for a printer. Wrong for an AP that serves multiple SSIDs."},"adopt":{"t":"Adopt","d":"Bring a new UniFi device under your UniFi app so you can manage it. Until then it shows Pending Adoption."},"api-token":{"t":"API token","d":"The key Home Assistant uses to talk to UniFi Access. Made in Access under Settings, General, API Token, and shown only once. A key from the console Integrations page is a Protect key, and Access rejects it."},"aux":{"t":"AUX","d":"Extra Door Hub relay for a door operator (dry) or a siren or chime (powered 12V). Not for the main lock."},"backup-wan":{"t":"Backup WAN","d":"A second internet line, like UniFi 5G Backup or Starlink, that the gateway switches to when the main line drops."},"basic-protection":{"t":"Basic Protection","d":"RAID 5 with 3 or more drives. Protects against 1 drive failing."},"bpdu-guard":{"t":"BPDU Guard","d":"Port setting for client ports. A spanning tree message (BPDU) from a switch that should not be there shuts the port, and an admin has to re-enable it."},"broadcast-storm":{"t":"Broadcast storm","d":"What a loop does: the same traffic copies itself around the loop again and again until links fill up and devices drop off."},"client-isolation":{"t":"Client isolation","d":"WiFi setting that stops guest clients from talking to each other. Keep on for Guest."},"com":{"t":"COM","d":"Common side of the LOCK relay pair. It lands with NC or with NO, not both."},"debug-console":{"t":"Debug Console","d":"Built-in browser shell on the console."},"device-bridge":{"t":"Device Bridge","d":"A pair of UniFi radios that replaces a network cable between two buildings or spots."},"device-ssh-settings":{"t":"Device SSH Settings","d":"Network setting holding the SSH login an adopted device uses. Factory default devices use ui / ui."},"dhcp-option-43":{"t":"DHCP Option 43","d":"DHCP option that hands devices the Network host address so they adopt across VLANs."},"door-attendant-receiver":{"t":"Door Attendant / receiver","d":"User assigned to get the door call. Not on the list means no Unlock for that door."},"door-attendant":{"t":"Door Attendant","d":"The smallest Access admin role that can see, talk to and unlock a door for a visitor. Enough for a shared reception phone."},"door-hub":{"t":"Door Hub","d":"The Access controller at the door. It wires the lock, door sensor, exit button and reader."},"door-position-sensor-dps":{"t":"Door position sensor (DPS)","d":"A contact on the door and frame that tells the hub whether the door is open or closed."},"doorbell-call-receiver":{"t":"Doorbell Call receiver","d":"Who a reader rings when a visitor presses the doorbell. Set in Access, Interface Designer, Doorbell Call for that reader."},"dry":{"t":"DRY","d":"LOCK mode with no power from the hub. An outside supply can run a non-12V lock, up to 30V DC at 1 A."},"early-media":{"t":"Early media","d":"A SIP feature that carries audio and video before the call is answered. Without it a SIP phone can ring with no intercom video."},"evacuation":{"t":"Evacuation","d":"Access emergency mode that unlocks every door the controller manages at once. Keep it off dashboards and out of automations."},"factory-reset":{"t":"Factory reset","d":"Clears the camera so it isn't adopted anywhere."},"fail-safe":{"t":"Fail-safe","d":"A lock that needs power to stay locked, like a maglock. Wire it to LOCK NC and COM."},"fail-secure":{"t":"Fail-secure","d":"A lock that needs power to unlock, like most strikes. Wire it to LOCK NO and COM."},"flex-budget":{"t":"Flex budget","d":"USW-Flex downstream totals by input: AF 8W, AT 20W, BT or 60W injector 46W (set Power Source to PoE Injector)."},"free-egress":{"t":"Free egress","d":"Leaving without badging out."},"gateway-zone":{"t":"Gateway zone","d":"The router itself, which answers DHCP and DNS. Block a network's zone from the Gateway and its clients get no IP or DNS."},"high-quality-period":{"t":"High-quality period","d":"Recent footage stays full quality. Older footage is kept at low quality."},"home-assistant":{"t":"Home Assistant","d":"Home automation software. Here it runs on a Raspberry Pi, listens to UniFi Access, and sends unlock to the deadbolt."},"hot-swap":{"t":"Hot swap","d":"Replace a drive while the UNVR stays on."},"ids-ips":{"t":"IDS/IPS","d":"The gateway checks traffic for known attacks and blocks them. Turning it on lowers how fast the gateway can route, so each model lists an IPS throughput."},"inform":{"t":"Inform","d":"Device check-in URL to the Network application, usually controller host on port 8080, path /inform."},"injector":{"t":"Injector","d":"A box that adds PoE power to a cable. Too weak a class, like an AF injector on a loaded Flex, is a common field mistake."},"ir-range":{"t":"IR range","d":"How far the camera's built-in infrared night light reaches. Past it the night image goes dark fast."},"isolate-spokes":{"t":"Isolate Spokes","d":"Site Magic Hub and Spoke setting. Each spoke site reaches the hub but not the other spokes."},"line-of-sight":{"t":"Line of sight","d":"A clear straight path between the two bridge ends, with no roof, wall, or trees in the way."},"lock":{"t":"LOCK","d":"The Door Hub's main lock relay, with NO, NC and COM terminals. Set it to POWERED for 12V from the hub, or DRY for no power."},"lockdown":{"t":"Lockdown","d":"Access emergency mode that overrides credentials so doors stay locked. An admin can still unlock one door remotely."},"loop-protection":{"t":"Loop Protection","d":"Port setting that spots a loop on its own, even behind a switch that does not speak STP, and blocks the port. The port stays blocked until an admin re-enables it."},"managed-by-other":{"t":"Managed by Other","d":"Devices list state. Another instance of UniFi Network owns the device, including the same console after a factory restore. Fix: restore a backup, factory reset and re-adopt, or reassign in the mobile app."},"max-draw":{"t":"Max draw","d":"The most watts a device can pull, from its datasheet (IR on, at boot). UniFi PoE budgets use this, not the quieter live reading."},"mdns-proxy":{"t":"mDNS Proxy","d":"Gateway setting that passes device discovery between networks, so a phone on one VLAN can find a TV or printer on another. Auto, or Custom with the networks you pick."},"mesh":{"t":"Mesh","d":"Site Magic layout where every site links straight to every other site. It can't NAT overlapping subnets."},"native-vlan":{"t":"Native VLAN","d":"The untagged VLAN on a switch port. UniFi device management usually rides here. Set as Native VLAN in Port Manager."},"nc-com":{"t":"NC/COM","d":"Fail-safe pair. Unlock opens the relay and drops power so a maglock releases."},"no-com":{"t":"NO/COM","d":"Fail-secure pair. Unlock closes the relay and applies power so a strike unlocks."},"passive-poe":{"t":"Passive PoE","d":"Power sent on the cable with no handshake. It's always on when enabled, so only plug in devices made for it."},"pending-adoption":{"t":"Pending Adoption","d":"Devices list state for a device that has checked in and is waiting for you to click Adopt."},"pixel-density":{"t":"Pixel density","d":"Pixels on the target per meter or per foot. The IEC 62676-4 bands: Identify 250, Recognize 125, Observe 62, Detect 25 pixels per meter."},"poe-plus":{"t":"PoE+","d":"802.3at. Up to 25.5W to the device."},"poe-plus-plus":{"t":"PoE++","d":"802.3bt Type 3. Up to 51W to the device."},"poe-availability":{"t":"PoE Availability","d":"The total PoE power the switch can share across its ports."},"poe-budget":{"t":"PoE budget","d":"Every device's max draw added up, compared with what the switch or injector can supply. Go over it and devices lose power."},"poe-class":{"t":"PoE class","d":"AF (about 15W), AT (about 30W), BT / PoE++ (higher). UniFi budgets on documented max draw, not quiet daytime watts."},"poe-output":{"t":"PoE output","d":"A port on the UDB-Pro that powers a PoE device, here the camera. It only runs with PoE+ coming in."},"point-to-multipoint":{"t":"Point to multipoint","d":"One radio serving many bridges at once, like the UDB-Pro-Sector."},"powered":{"t":"POWERED","d":"LOCK power from the hub: 12V DC, up to 1 A. Do not add a second 12V supply."},"recipient-number":{"t":"Recipient Number","d":"On a SIP doorbell call, the extension the reader dials. For a Talk phone in Third-Party PBX mode it is that phone's extension."},"recording-destination":{"t":"Recording destination","d":"The NVR the camera records to. Picked on the phone during adoption."},"recording-retention":{"t":"Recording Retention","d":"A limit on how long recordings are kept. Not a promise."},"remote-unlock-via-endpoint":{"t":"Remote Unlock via Endpoint","d":"Access setting. When off, Endpoint receivers can talk on a call but cannot unlock."},"repair":{"t":"Repair","d":"Rebuilds the protected storage onto the new drive. Things run slower until it finishes."},"request-to-exit-rex":{"t":"Request to exit (REX)","d":"A button, motion sensor, or panic bar that unlocks the door from the inside without a credential."},"root-bridge":{"t":"Root bridge","d":"The switch every other switch measures its paths from. The lowest STP priority wins, so set the core switch to 0."},"rstp":{"t":"RSTP","d":"Rapid Spanning Tree, the faster form of STP. On by default. It blocks the second path of a loop, and the Ports page shows that port as blocked."},"set-inform":{"t":"set-inform","d":"Device SSH command that tells a UniFi device where its Network host is, e.g. http://192.168.1.10:8080/inform."},"sonosnet":{"t":"SonosNet","d":"The speakers' own wireless network. It runs its own spanning tree you cannot configure, and a speaker that is wired and on SonosNet can bridge two wired segments into a loop."},"stp":{"t":"STP","d":"Spanning Tree Protocol. Switches find a second path between them and block it, so traffic cannot circle forever."},"stp-edge":{"t":"STP Edge","d":"Marks a port as a client port, where only end devices plug in. Pair it with BPDU Guard."},"stp-priority":{"t":"STP priority","d":"A number per switch. The lowest becomes the root bridge. Core 0, the next layer 4096, then add 4096 per layer."},"stun":{"t":"STUN","d":"UDP 3478 helper for remote adoption and remote management. Not the adoption path itself: adoption needs TCP 8080 to the Network host."},"super-encoding":{"t":"Super Encoding","d":"Makes each day of recording smaller."},"tagged-vlan-management":{"t":"Tagged VLAN Management","d":"Port setting for which VLANs ride tagged (802.1Q): Allow All, Block All, or Custom. Guest and IoT SSIDs need their VLANs tagged on the AP uplink."},"teleport-adoption":{"t":"Teleport Adoption","d":"Adopts a camera at another location to the NVR at the main house over the internet. No VPN, no port forwarding."},"third-party-pbx-mode":{"t":"Third-Party PBX mode","d":"G3 phone setup that registers the phone as a SIP phone with a SIP server, here UniFi Talk, instead of as a native Talk phone."},"trigger-level":{"t":"Trigger level","d":"Which contact state counts as active. Open active (NC) or close active (NO)."},"trunk":{"t":"Trunk","d":"A port carrying the Native VLAN plus tagged VLANs. The right setup from switch to AP, or switch to gateway, when there are several networks."},"unauthorized-opening":{"t":"Unauthorized Opening","d":"Access status when the door opens while it's locked."},"unifi-endpoint":{"t":"UniFi Endpoint","d":"The phone app path for Access calls. Remote Unlock via Endpoint turns unlock on or off for that path."},"ups":{"t":"UPS","d":"A battery box that keeps the rack powered through a power cut. Size it for the console, switches, PoE and the modem."},"wireless-meshing":{"t":"Wireless meshing","d":"AP setting that lets an AP uplink over the air to another AP. With every AP wired, a wired AP can bridge two segments by air. Turn it off if no APs are wirelessly adopted."},"z-wave":{"t":"Z-Wave","d":"A low-power home automation radio. Home Assistant reaches the deadbolt through a Z-Wave USB stick."},"zbf":{"t":"ZBF","d":"Zone-Based Firewall. Rules are set between zones, like Internal, External, Gateway and Hotspot, plus custom zones such as IoT."}}
Try another way this breaks
Lab complete. A granted face or card opens the deadbolt, and a denied card does not.
Tap, bolt opens
SAFETY
It only goes one way: Access to the lock. Access never sees the bolt, and the Access log says granted even when the bolt didn't move. Check the lock state in Home Assistant.
If the Pi, the network or Z-Wave is down, the door stays locked. Keep the lock's keypad or key as the backup.
The Access unlock time and the lock's auto-lock are separate settings. Leave the lock's auto-lock on.
Keep Evacuation and Lockdown off dashboards. They affect every door at once.
This run: all five at once. Get Home Assistant talking to Access, fix the automation, then get the unlock to the lock.
Adding UniFi Access in Home Assistant stops at "Could not connect". Access itself works fine at the door.
1Home Assistant to AccessNo connection
2Access keyKey rejected
3AutomationBolt never moves
4Who it opens forDenied card opens
5Z-Wave to LOCK1Never reaches LOCK1
Common causes · Home Assistant says "Could not connect"
Test the door
Check the lock, not just the Access log
Access never sees the bolt. Its log says granted even when the bolt didn't move.
Check the lock state in Home Assistant after each tap.
Test a card that should fail, too.
Tap a face Access grants, or a card Access denies, and watch what reaches the lock.
At the door and in the rack
ENTRY1G6 Pro Entry, reads faces and cards
HUB1Door Hub, nothing wired to its lock terminal
SW1PoE++ switch, powers HUB1
Consoleruns UniFi Access
Home Assistanton a Raspberry Pi, with a Z-Wave USB stick
LOCK1Z-Wave deadbolt on the door, no strike in the frame
Controls
Hints
1
SEEING1/3
Locked
2
LOOK AT2/3
Locked
3
CHANGE3/3
Locked
Good to know · info only
Out of scope for this lab
Wiring a strike to HUB1Z-Wave range numbersLock brands and models
Why this fails
says "Could not connect"
Adding UniFi Access in Home Assistant stops at "Could not connect". Access itself works fine at the door.
The chain
Face or card at ENTRY1. Access checks the rule and logs granted. Access pushes the event to Home Assistant. The automation gets access_granted for that door and sends unlock to LOCK1 over . The bolt pulls back, and Home Assistant shows LOCK1 unlocked.
Safety
It only goes one way: Access to the lock. Access never sees the bolt, and the Access log says granted even when the bolt didn't move. Check the lock state in Home Assistant. If the Pi, the network or Z-Wave is down, the door stays locked. Keep the lock's keypad or key as the backup. The Access unlock time and the lock's auto-lock are separate settings. Leave the lock's auto-lock on. Keep and off dashboards. They affect every door at once.
Glossary
Home Assistant
Home automation software. Here it runs on a Raspberry Pi, listens to UniFi Access, and sends unlock to the deadbolt.
Access event
The event a door fires in Home Assistant when someone tries to get in: access_granted or access_denied, with who it was and how (NFC, PIN or Face).
API token
The key Home Assistant uses to talk to UniFi Access. Made in Access under Settings, General, API Token, and shown only once. A key from the console Integrations page is a Protect key, and Access rejects it.
Z-Wave
A low-power home automation radio. Home Assistant reaches the deadbolt through a Z-Wave USB stick.
Evacuation
Access emergency mode that unlocks every door the controller manages at once. Keep it off dashboards and out of automations.
Lockdown
Access emergency mode that overrides credentials so doors stay locked. An admin can still unlock one door remotely.
1 Raspberry Pi with Home Assistant and a Z-Wave USB stick
1 Z-Wave deadbolt, LOCK1
Change on win: none yet
Counts only, no prices.
Takeaway
Tap, bolt opens
Access decides who gets in. Home Assistant moves the bolt. Check the lock, not just the Access log.
With no strike in the frame, the relay has nothing to open. listens to Access and sends the unlock over .
Let the Pi reach Access. Allow the Pi to the console on TCP 12445 only, or put it on the console's network. Never port-forward it.
Use an Access token. Make it in Access, under Settings, General, . A key from the console Integrations page is a Protect key.
Trigger on the . The door's Unlock button only clicks the Door Hub relay. Send unlock to the lock.
access_granted only. The Access event also fires for denied attempts.
Get the unlock to the lock. Move the Z-Wave stick on a USB extension, add a plugged-in repeater, or pair the lock again.
SAFETY
It only goes one way: Access to the lock. Access never sees the bolt, and the Access log says granted even when the bolt didn't move. Check the lock state in Home Assistant.
If the Pi, the network or Z-Wave is down, the door stays locked. Keep the lock's keypad or key as the backup.
The Access unlock time and the lock's auto-lock are separate settings. Leave the lock's auto-lock on.
Keep Evacuation and Lockdown off dashboards. They affect every door at once.
Doors that open for the right people and stay shut for everyone else. We design, wire and set up access control.
UniFi Access granted but Z-Wave lock does not unlock
A teaching lab, not a quote and not a design for your site. Steps follow the Home Assistant UniFi Access integration docs and Ubiquiti's UniFi Access API reference. Menu names move between UniFi Access versions. Z-Wave range depends on the building, so no distances are shown. The status lines are lab labels.