Rhombus
Identity & SecurityConnect AI agents to Rhombus, a cloud-managed physical security platform for cameras and sensors. Agents read camera and sensor state, pull security events, and resolve the location behind each one.
What This Integration Enables
Start with the honest boundary, because it is the whole shape of this integration. Every action in the Rhombus connector reads. There is no arm, no disarm, no unlock, no acknowledge, no clip creation, and no alert dismissal. FlowRunner does not operate your physical security system. It reads camera health, door and button and climate and occupancy sensor state, policy alerts, saved clips, locations, users, and organization settings, and it puts what it reads in front of a person or into another system. That is a deliberate posture rather than a gap: an agent that cannot unlock a door cannot be tricked into unlocking one.
The second boundary matters just as much. This connector has no triggers. Rhombus does not push motion events, line crossing events, panic button presses, or alarm state into FlowRunner. A flow that reacts to a policy alert is polling List Policy Alerts on a schedule with afterTimestampMs and paging forward with lastTimestampMs and lastUuid. Your polling interval is therefore your detection latency, and the API's per organization rate limit is the ceiling on how tight you can make it. Say this out loud when you design the flow: this is a reporting and context path, not a life safety alerting path. Rhombus's own console and alerting remain the system of record for anything that has to be seen in seconds. What FlowRunner adds is everything that happens after the alert, where the work is resolving a device UUID into a place, reading it against sensor state, and getting it to the right person with enough context that they can decide something. That is where automation exceptions actually live in physical security: not in the detection, but in the triage.
Without FlowRunner
With FlowRunner
Use Case Scenarios
After hours alerts that arrive already resolved
A scheduled flow calls List Policy Alerts with afterTimestampMs set to the last cursor and scoped to the location UUIDs of the sites that are closed overnight. For each alert the agent calls Get Location Details to turn the UUID into a name, an address, and a timezone, which is the difference between "alert on device 8f3a" and "line crossing at the Fort Worth dock, 2:14am local." It reads List Door Sensors and List Occupancy Sensors for the same site to establish whether anything else registered, then posts the assembled picture to the facilities channel in Slack. Alerts at sites that were legitimately staffed overnight are logged rather than escalated, because the agent read the occupancy state before deciding to interrupt anyone.
A device health report the maintenance team will actually act on
Rhombus sensors are battery powered and cameras run firmware, and both facts get noticed at the worst possible moment. A weekly flow calls List Cameras with includeMummified left off, then List Door Sensors, List Button Sensors, List Climate Sensors, and List Occupancy Sensors, and assembles one table grouped by location: firmware versions that have drifted apart, connection and health status, and every battery percentage under threshold. Each row carries the location name from List Locations rather than a UUID. The agent opens a ticket per site in Jira so a technician gets one visit per building instead of five. A panic button below battery threshold is escalated separately rather than filed with the rest, because a help button nobody knows is dead is a different class of problem from a camera on old firmware.
Access review against the org that actually exists
List Users returns every user in the organization with verification status, MFA status, the account owner flag, creation timestamp, per user permission entries, and partner users. A quarterly flow reads that list, compares it against the HR roster, and produces three groups: users with no matching employee record, users without MFA enabled, and partner users whose engagement has ended. It writes the comparison to Google Sheets for the security owner and posts the summary. The connector cannot remove anyone, and this page will not pretend otherwise. What it removes is the excuse that nobody had the list.
Human-in-Loop Highlight
Get Camera Media URIs returns live WAN HLS and MPEG-DASH streaming URIs for a single camera, plus LAN streaming templates. That is the one action in this connector whose output is not a fact about the system but a window into a physical space where people are working. Once an agent posts that URI into a channel it is in that channel's history, visible to everyone in it, for as long as the URI is valid, and no amount of deleting the message afterwards changes who already had it. There is no undo on having seen a colleague's shift. So the agent never resolves a live feed on its own initiative. When an alert clears the escalation bar it posts what it does know, resolved through Get Location Details: "Line crossing alert at Fort Worth dock, 2:14am local, door sensor D3 reported open 90 seconds earlier, no occupancy registered. Do you want the live feed for camera Dock North, and who should it go to?" The site owner names themselves or names someone, the agent calls Get Camera Media URIs, and it sends the URI to that person directly rather than to the channel. The agent did the tedious part, which is turning three UUIDs into one sentence a human can act on. The decision to watch a room stayed with a person who can be asked why.
Agent Capabilities
13 actionsCameras
3- List Cameras Returns minimal state for every camera in the organization: UUID, name, serial number, firmware version, connection and health status, location UUID, and network details. Set includeMummified to also list decommissioned cameras, which is useful for reconciling an asset register and misleading in a health report.
- Get Camera Media URIs Returns the live and video on demand streaming URIs for one camera, including WAN HLS (M3U8), MPEG-DASH (MPD) and H.264 live URIs plus LAN streaming templates. Takes the camera UUID from List Cameras. Treat its output as sensitive by default.
- Get Camera Footage Seekpoints Returns the recorded footage availability windows for a camera across a time range, so a flow can establish whether video for an incident actually exists before anyone goes looking. Provide startTime as seconds since epoch and duration in seconds, and set includeAnyMotion to include motion event markers.
Sensors
4- List Door Sensors Returns basic state for every door sensor: name, open or closed state, battery percentage, firmware version, health, location UUID, and any associated cameras. The associated cameras field is what lets an agent connect a door event to the footage that covers it.
- List Button Sensors Returns minimal state for every panic or help button sensor, including name, battery level, firmware version, health status, and location. Battery state on these is worth its own alerting path.
- List Climate Sensors Returns minimal state for every environmental sensor, including current temperature, humidity, CO2, heat index, battery level, firmware, health, and location. Useful well beyond security for server rooms, cold storage, and occupancy comfort.
- List Occupancy Sensors Returns minimal state for every occupancy sensor, including presence state, battery level, health, and location. Reading this alongside an alert is what separates an after hours intrusion from a staffed late shift.
Events and Clips
2- List Policy Alerts Returns recent policy alerts covering motion, line crossing, and other rule based events, with time window filtering through afterTimestampMs and beforeTimestampMs, scoping to specific device or location UUIDs, a result cap, and cursor pagination through lastTimestampMs and lastUuid. This is a poll. Nothing here is pushed to FlowRunner.
- List Saved Clips Returns saved video clips for the organization, up to 100 per page, each with its UUID, description, device UUIDs, byte count, and creation timestamp. Use maxPageSize to cap results and pageTimestampMs to page back through older clips.
Locations and Organization
4- List Locations Returns every location in the organization with UUID, name, full address, latitude and longitude, timezone, labels, and floor plans. Set subLocationsIncluded to return the sub location hierarchy. The timezone field is the one that turns an epoch timestamp into a local hour a person can judge.
- Get Location Details Returns full details for a single location by UUID, including address, coordinates, timezone, labels, and floor plans, with subLocationsRequired to include the hierarchy. This is the action that converts an alert's location UUID into somewhere a human recognizes.
- Get Organization Returns details about the authenticated organization, including its name, settings, and enabled feature flags. Useful for a flow that needs to know which capabilities are actually turned on before it assumes them.
- List Users Returns all users in the organization with name, email, verification and MFA status, account owner flag, and creation timestamp, plus partner users and per user permission entries. The raw material for an access review.
Frequently Asked Questions
What can FlowRunner do with Rhombus?
FlowRunner agents can run List Cameras, Get Camera Media URIs, and Get Camera Footage Seekpoints in Rhombus, plus 10 more actions.
Does connecting Rhombus to FlowRunner require OAuth?
No. Rhombus connects to FlowRunner with an API key, no OAuth flow required.
Can Rhombus trigger a FlowRunner workflow automatically?
Rhombus doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.
Start building with Rhombus
$100 in credits. No card required. Connect in minutes.