Gallagher Command Centre is an on-premises access control and intruder alarm platform from Gallagher Security. Its REST API runs on the Command Centre server, by default on port 8904, and exposes events, alarms, cardholders, and the status of doors, access zones, alarm zones, inputs, outputs, and fence zones. The server answers 403 for any call outside its licensed feature set.
Through Fibric, an operator long-polls the alarm and event feeds, checks the door or zone involved, and proposes an override, a cardholder change, or an alarm acknowledgement. You approve each one. The call is made once, and the receipt shows what changed, why, and how to reverse it.
This is a reference listing. It documents what Fibric would read from Gallagher Command Centre and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.
Inputs
Events through GET /api/events with after, before, source, type, group, and cardholder filters, and new events through GET /api/events/updates
Current alarms through GET /api/alarms, and changes through the alarm updates link, which blocks until an alarm arrives or changes
Cardholders through GET /api/cardholders, including cards, access groups, competencies, and personal data fields, plus GET /api/cardholders/changes
Doors, access zones, alarm zones, inputs, outputs, macros, fence zones, and elevator groups, each searchable by name and division
Item status for one item through its updates link, or for many items through the /api/items/updates subscription
Schedules and day categories through GET /api/schedules and GET /api/day_categories
Proposed actions
Target capability: propose opening a door through POST /api/doors/{id}/open, or locking it through POST /api/doors/{id}/lock
Target capability: propose an access zone override such as free, secure, lock_down, or cancel_lock_down, with an end time up to 24 hours ahead
Target capability: propose arming or disarming an alarm zone, shunting an input, or turning an output on, off, or pulsed
Target capability: propose acknowledging, processing, or commenting on an alarm through POST /api/alarms/{id}/acknowledge, process, and comment
Target capability: propose a cardholder change through PATCH /api/cardholders/{id}, such as removing an access group or a card
Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.
What you can build
Clear a forced-door alarm with context
A door forced alarm arrives on the alarm updates feed. The operator pulls the event, the door, and the cardholder involved, then proposes an acknowledgement with a comment for your approval.
From an HR or identity leaver signal, the operator proposes a PATCH that de-authorises the cardholder and removes their access groups. You approve; the receipt lists what was removed.
Events filtered by group and time window are matched against the schedule for each door. Entries outside hours are listed for review with the cardholder and zone.
Access events by cardholder show which cards have not been presented over the period you set. The operator proposes disabling each one, and you decide.
A Command Centre server licensed for the features you use: RESTEvents, RESTStatus, RESTOverrides, RESTCardholders, or RESTConfiguration
A REST Client item whose linked cardholder belongs to an operator group with the needed privileges, such as Override or Edit Cardholders
Network reach to the server's REST port, 8904 by default, over HTTPS
A client certificate matching the thumbprint on its REST Client item, unless the site enables REST Clients with no client certificate
Authentication
A pre-shared API key issued by a REST Client item in Command Centre, sent as Authorization: GGL-API-KEY, optionally pinned to a client certificate thumbprint and an IP range.
Limits
Event pages return 1000 events by default and at most 10000 with top; alarm pages return at most 100
Long polls for events time out after about 30 seconds and return an empty updates array with a fresh next link
Timed override end times cannot be in the past or more than 24 hours ahead, and are not accurate to the second
Feature links must be taken from GET /api, which lists only licensed calls; unlicensed operations return 403
Access and pricing
Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.
Does Command Centre push events, or must you poll?
You long-poll. GET /api/events/updates waits until a new event arrives, or about 30 seconds, then returns the updates and a next link. Alarms work the same way through the updates link in the alarm results. Bulk item status uses a subscription at /api/items/updates.
Which licences does Command Centre's REST API need?
It depends on the calls. RESTEvents covers events and alarms. RESTStatus and RESTOverrides cover item status and overrides. RESTCardholders covers cardholder management, and RESTConfiguration covers divisions. GET /api shows only the calls your server is licensed for, and unlicensed calls return 403.
Can Command Centre open a door on request?
Yes, with the RESTOverrides licence and the Override privilege. POST /api/doors/{id}/open opens the door. From version 9.40, POST /api/doors/{id}/lock locks it. Access zones take free, secure, code_only, dual_auth, lock_down, and cancel_lock_down overrides.
Ask about Gallagher Command Centre
Ask about the capabilities and requirements in this listing.
This connector listing is developed, published, and supported by Fibric. It describes integration with Gallagher Command Centre through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy