Skip to main content

​
About OpenPath

Avigilon Alta (formerly Openpath) is Motorola Solutions’ cloud-based physical access control platform - doors, readers, mobile credentials, and entry management. The Serval integration appears in the app as “OpenPath” and connects using your Organization ID plus an admin email and password. Serval then proxies API calls to the Avigilon Alta API on behalf of your workflows, with all requests automatically scoped to your organization. Note the rebrand: the vendor now calls the product Avigilon Alta / Alta Access, and the legacy Openpath admin portal redirects to the Alta Access portal. Authentication: Organization ID plus admin email and password. Serval logs in to Avigilon Alta fresh on every API call and uses the returned session token automatically - there is no token caching. Data sync: On-demand only. There is no background sync, no webhooks, and no triggers - workflows call the Avigilon Alta API directly through a generic API request action.

​
What the OpenPath integration enables

Anything in the OpenPath API that is scoped to your organization can be accessed through Serval.

​
Get your credentials

You need three things: your numeric Organization ID, and the email and password of a dedicated Avigilon Alta admin account without MFA. See the provider’s guide to authenticating with the API for background.
1

Log in to the Alta Access portal

Go to the Alta Access portal. The legacy control.openpath.com URL redirects there.
2

Find your Organization ID

Read it from the browser URL: it is the number after “/o/”. For example, if the URL contains “/o/302/dashboards/activityDashboard”, your Organization ID is “302”. It appears on every portal page.
3

Create a dedicated service account

Create or designate a dedicated account for the integration - an Alta-native account with its own email and password, not a personal account and not an SSO-federated identity. Grant it the admin permissions your workflows need.
4

Make sure MFA is not enforced for that account

Serval’s login sends only the email and password and cannot supply a TOTP code. If MFA is required on the account, every API call will fail.
The account must be Alta-native (created in the Alta Access portal) and must not have MFA enforced. SSO identities and MFA-protected accounts cannot be used for API access through this integration.
Use a dedicated service account rather than a personal one. Because Serval logs in with the stored password on every call, a personal password change immediately breaks the integration.

​
Connect in Serval

1

Open the OpenPath connect form

In Serval, find the integration tile named “OpenPath” and open the connect form. All three fields are required and marked with an asterisk.
2

Organization ID (required)

Enter your numeric Organization ID from the portal URL. Helper text: “Your OpenPath organization ID (found in the OpenPath admin portal URL)”. Leaving it blank shows “This field is required”. There is no format validation, so a wrong ID is accepted at save time and only surfaces later as failed API calls.
3

Email (required)

Enter the service account’s email. Helper text: “Your OpenPath account email”. Leaving it blank shows “This field is required”.
4

Password (required, masked input)

Enter the service account’s password. Helper text: “Your OpenPath account password”. The input is masked as you type.
5

Submit, then verify

Submitting saves the credentials immediately - they are not tested against Avigilon Alta at save time. Run the health check right away to confirm connectivity.
When you reopen the connection to edit it, Organization ID comes back in cleartext, Email comes back masked in an editable text box (bullet characters plus the last 4 characters), and Password shows the same masked format with a control to replace it. Fields you leave untouched or blank keep their stored values. To rotate a credential, enter the complete new value: clear the Email box and type the full new address, and for the Password use the replace control and type the full new password into the “Enter new value” box. Changing the Organization ID re-scopes all future API calls to the new organization.

​
Verifying the connection

The integration ships one health check: List OpenPath Entries - logs in to Avigilon Alta with the stored email and password, then lists the entries (doors and access points) in your organization to confirm the credentials and Organization ID work end to end.
  • On success: “Successfully connected to OpenPath and retrieved entries”
  • On failure: “Failed to list OpenPath entries. Please verify your email, password, and that MFA is disabled or a valid MFA code was provided.”
If the health check passes but a workflow call fails, the usual causes are: the service account lacks permission for that specific operation (the health check only needs to list entries), or the workflow’s request path duplicates the organization scoping that Serval already adds automatically.

​
Gotchas and troubleshooting

Serval’s login sends only an email and password; there is no field for a TOTP or MFA code anywhere in the integration. If the account has MFA enforced, every API call and the health check will fail with an authentication error. The health check’s failure message mentions providing “a valid MFA code”, but the integration has no way to supply one - the account must simply not require MFA. Avigilon’s API documentation also requires an Alta-native account (not SSO) for API access.
Session tokens are not cached: each proxied request logs in first, so every workflow API call generates two outbound requests to Avigilon Alta. Budget for this against provider rate limits on high-volume workflows. It also means a password change in Avigilon Alta breaks the integration instantly - the very next request fails - until the new password is entered in Serval.
Submitting the connect form stores the credentials without testing them against the Avigilon Alta API. A typo in the Organization ID, email, or password is only caught when the health check or a workflow call runs. Always run the health check immediately after connecting or editing the connection.
Serval bakes your Organization ID into the base of every API call, so workflow request paths must be relative to your organization - do not add the organization scoping to request paths yourself, or it will be applied twice. An incorrect Organization ID makes every call fail with a not-found or permission error even when the email and password are valid.
On edit, Organization ID is shown in cleartext while Email and Password are shown masked - bullets plus the last 4 characters. A field you leave untouched or blank keeps its stored value, so you only ever need to fill in what you are changing. When rotating credentials, type the complete new value rather than editing the masked text: clear the Email box and type the full new address, or use the Password field’s replace control and type the full new password. Then run the health check to confirm.
Motorola Solutions rebranded Openpath as Avigilon Alta; the access product is “Alta Access”. The Serval tile still says “OpenPath” and the API still lives at api.openpath.com, but the admin portal at control.openpath.com now redirects to the Alta Access portal, and provider docs use the Avigilon Alta name. If you are searching for “Avigilon” or “Alta”, this is the integration you want. For provider-side issues, see Avigilon Alta support.
Need help? Contact support@serval.com for assistance with your OpenPath integration.