Hikvision face-recognition access terminals are widespread in Morocco and elsewhere. Connecting them to attendance software can be done in several ways, with different consequences for reliability, data and maintenance. This article draws on our work with the DS-K1T321MFWX model.
Three ways to get the punches
1. Direct reading on the local network (ISAPI)
Hikvision terminals expose an authenticated web API, ISAPI. Software can query the terminal on the local network to read access events, check its time and capabilities, and manage enrolled people.
- Advantages: no internet needed, no intermediary, automatic reading.
- Watch out for: the terminal needs a fixed IP address and must stay reachable; some models have a single access account, so its password must be managed carefully.
This is the method Atlaxys Tempo uses: reading every 2 minutes by event serial number, without duplicates, resuming where the last read stopped.
2. File export from Hikvision software
The manufacturer’s management software can export punches to a file (often CSV). Third-party attendance software then imports it.
- Advantages: no terminal-specific development.
- Limits: a manual step, risk of forgetting, no clock check or enrolment from the attendance software.
Tempo accepts this kind of import (person, date-time), with a preview of rejected lines and no duplicates if the file is imported again.
3. The manufacturer’s cloud
Some terminals can be linked to the manufacturer’s online service. This eases remote access but routes data through a third-party service and depends on the internet. If you read the terminal locally, disable unused cloud services.
What to check per model
Functions vary from one model and firmware to another. Some concrete examples observed on a DS-K1T321MFWX (firmware V3.9.20):
- faces are managed in a dedicated library (FDLib), and some requests documented elsewhere answer “not supported”;
- the terminal advertises card, fingerprint and face capture, but no QR code function;
- only one access account is available;
- employee numbers accept letters and digits only (32 characters at most);
- each event carries the terminal’s time offset, which makes it possible to compute the exact time even if the time zone is wrong.
The practical conclusion: software should read the capabilities the terminal advertises rather than assume a DS-K1T341 behaves like a DS-K1T321. In Tempo, the DS-K1T341, 342, 343 and 671 families are marked “documentation only” until tested, and the software shows a warning for an unverified model.
Documented, tested, verified: three levels of evidence
For Tempo, the state at the time of publication:
- The ISAPI requests used were run on a real DS-K1T321MFWX (15 October 2026), through code shared with Gymza, Atlaxys’s other product.
- Tempo itself is tested against a simulated terminal built on the recorded responses of this model; its acceptance test on the physical terminal is done at installation.
- Capturing a face, fingerprint or card triggered from the software follows Hikvision’s documentation but has not yet been validated on the device.
Ask any vendor claiming “Hikvision compatibility” for the same level of detail.
Settings to apply on the terminal
- Fixed IP address or DHCP reservation, unique on the network (an address conflict makes the terminal intermittently unreachable).
- GMT+0 time zone without daylight saving — Morocco’s legal time since 20 September 2026 — and NTP enabled.
- A unique administrator password, kept somewhere safe.
- Unused services disabled (cloud access, SSH).
- Tamper switch checked after mounting.
These points are part of our pre-installation checklist. To compare with another brand, read about integrating ZKTeco terminals.
Frequently asked questions
Do all Hikvision terminals use the same protocol?
Hikvision access terminals generally expose an API called ISAPI, but the available functions and their responses vary by model and firmware. Software should read the capabilities each terminal advertises rather than assume one model behaves like another.
Can a Hikvision terminal be read from another site?
With local-network reading, the terminal must be reachable from the PC that queries it. Between two sites, that requires a company network linking them; otherwise, file import remains possible.
Written by the Atlaxys Consulting team from the product documentation and the sources cited.