web sdk overview

About the Security Center Web SDK

The Security Center Web SDK is an HTTP API for managing entities, monitoring events, and executing operations in Security Center.

What is the Web SDK?

The Web SDK is a specialized Security Center role that acts as an HTTP API gateway. It allows applications to interact with Security Center using standard HTTP requests.

Key capabilities:

• Entity management: Create, read, update, and delete Security Center entities (cardholders, credentials, visitors, access rules, and other entities)
• Real-time events: Subscribe to and receive live event streams
• Report execution: Query and filter historical events
• Alarm operations: Trigger and acknowledge alarms
• Custom operations: Execute actions and macros

Architecture overview

Understanding how the Web SDK works helps you avoid common integration mistakes.

Connection flow

flowchart LR
    subgraph App[Your Application]
        A1[HTTP API calls]
        A2[JSON/XML responses]
    end

    subgraph WebSDK[Web SDK role]
        W1[Session Management]
        W2[Query Processing]
    end

    subgraph SC[Security Center Directory]
        S1[Entity Storage]
        S2[Event System]
    end

    App -->|HTTP/HTTPS| WebSDK --> SC

Loading

How it works:

1. Your application makes HTTP requests to the Web SDK role
2. Web SDK role authenticates your requests and creates a session
3. Session maintains a connection to Security Center and caches data for performance
4. Security Center processes operations and returns results through the Web SDK

Important

Your application connects only to the Web SDK role, not directly to the Security Center Directory server. The Web SDK handles all communication with Security Center for your application.

The Web SDK does not support cross-origin requests from browsers. Browser JavaScript cannot call the Web SDK directly. To build a browser-based application, route Web SDK requests through your own backend server acting as a proxy.

If SSL is enabled on the Web SDK role, the server presents a self-signed certificate by default. If your client does not trust the certificate, the HTTPS request fails. See TLS certificate for your options.

Sessions explained

When you make your first authenticated request, the Web SDK creates a session for you. This session:

• Maintains your connection to Security Center
• Tracks subscriptions to real-time events
• Stores session settings, such as creation partitions

Session identity

Sessions are tied to the unique combination of credentials, Application ID, and Web SDK instance.

Shared sessions

Important

Multiple applications using the same credentials and Application ID and connecting to the same Web SDK instance will share the same session.

Example:

Application A: USER1 + APPID1 → http://server:4590/WebSdk/
Application B: USER1 + APPID1 → http://server:4590/WebSdk/

Result: Both applications share one session

Implications:

• Settings configured by Application A (like /creationpartition) affect Application B.
• Event subscriptions from Application A are shared with Application B.
• Activity from either application resets the session timeout.
• Both applications see the same session state.

Separate sessions

When connecting to different Web SDK instances, sessions are completely independent:

Application A: USER1 + APPID1 → http://server1:4590/WebSdk/  (Session 1)
Application B: USER1 + APPID1 → http://server2:4590/WebSdk/  (Session 2)

Result: Two separate sessions

Session lifecycle

Event	Behavior
First request	Session created, connection established to Security Center
Subsequent requests	Session reused, cached data returned when available
5 minutes of inactivity	Session expires and is cleaned up
Keep-alive request GET /	Resets the 5-minute inactivity timer
Any other authenticated request	Also resets the 5-minute inactivity timer
Event subscription with open stream	Automatic keep-alive every 1 minute (session never expires)

Important

Settings like /creationpartition are session-specific. After 5 minutes of inactivity the session ends and these settings are cleared. Use GET / when you intentionally want to keep the session alive, and call /creationpartition again before operations if your session may have expired.

See also

• Getting started with the Web SDK: Authentication, your first API call, and Web SDK role setup.
• Web SDK reference: Well-known GUIDs, card format identifiers, and enumerations.
• Web SDK troubleshooting: Diagnosing common Web SDK issues.