Solutions · Repository connectors

OnBase documents in every FOI, ATIP and public records request

AccessPoint's Hyland OnBase connector lets coordinators browse document types, search on keywords and document dates, and capture OnBase documents into the request — fetched server-side through the Hyland API Server, with the document handle, revision and a verified SHA-256 hash recorded on every one.

Start Free Trial Request a Demo

In a municipality, a provincial or state agency, a health organization or a university that runs on OnBase, the record that answers a request is often an OnBase document: a permit file, an invoice, a claim, a report to council. Getting it into the request means asking the department to retrieve it in the OnBase client, export it and e-mail it over — or giving the access office its own OnBase seat and a routine of saving, renaming and re-uploading. Either way, the keyword values that made the document findable, and the revision that was sent, are lost on the way.

OnBase has no folder tree: its retrieval model is document type group, then document type, then keyword values. AccessPoint's connector presents exactly that in the Add from… picker — your document type groups, their document types, then documents newest document date first — through the Hyland API Server's Document Management REST API. Every document carries its keyword values as metadata, its document date and stored date, and its latest revision. Search filters by document type, by keyword (equals or contains), by document-date range and by the keyword types you expose as facets, and a native search passes a validated OnBase query body straight through. Free-text search maps to the keyword types you list, or to document names; OnBase's Full-Text Search module stays off until it is confirmed on your instance.

The connector signs in through the Hyland IdP as one OnBase service user, so whatever that user's user-group rights and security keywords allow is what every permitted coordinator can browse — AccessPoint's rule on who may add records to the case is the per-user gate. Scope it narrowly: Retrieve rights on exactly the document types the access office may collect from, mirrored in the connector's own allow-list. OnBase's audit will show the service user, so the connector logs every call with the AccessPoint user, the case and the purpose, ready for your SIEM. The API Server itself needs no extra OnBase licence, but the service user consumes an integration licence — a named user, a concurrent client or a Query Meter block — and each listing, search or collection page counts as one query.

The connector needs HTTPS to the API Server and the Hyland IdP. When the API Server is on premises, the recommended shape is an App Service or Container App in your own Azure subscription with an Azure Relay Hybrid Connection to the OnBase server — the connector is the relay's client, so there is no inbound rule on your network. It can also run as a Windows service beside the API Server, reached the same way. Either way the cost is in your own subscription: a small host (two vCPUs and 2 GB of memory are ample) and about USD $10 a month per Hybrid Connection listener at Azure list price, with 5 GB of relay traffic included. OnBase is a trademark of Hyland Software; AccessPoint is not affiliated with or endorsed by Hyland.

Sound familiar?

Three moments every access office that leans on OnBase recognizes.

The export-and-e-mail round trip

The clerk asks Finance for the purchase orders behind a contract. Three days later a zip of PDFs arrives from the OnBase client, and nobody can say which revision of each one was exported.

The keywords stayed in OnBase

The permit number, the parcel and the document date that made each document findable never reach the request. Someone retypes them into the records log so the release can be described.

A shared account in the audit trail

An auditor asks who retrieved forty documents from OnBase last spring, and for which request. The audit trail shows a generic account; the answer lives in someone's memory.

What to look for in an OnBase connector for FOI and public records

Whatever you buy — including if it isn't AccessPoint — these are the questions to ask of any tool that pulls OnBase documents into an access request.

OnBase's own model, not an invented folder tree Coordinators should browse document type groups and document types the way OnBase organizes them, newest first, with search to reach the rest.
Keyword search with operators Equals and contains on keyword types, document-date ranges and keyword facets — the fields your records staff already search on.
Server-side capture with a verified hash The document should stream from the API Server into the case with a SHA-256 hash computed on arrival — not pass through someone's downloads folder.
A narrow, named service identity One service user with Retrieve rights on exactly the document types the office may collect, and an allow-list on the connector that matches.
Attribution an auditor can follow Because OnBase records the service user, every call should be logged with the person, the case and the purpose, and the capture written to the request's own audit ledger.
Respect for your OnBase licensing One query per listing, cached metadata and a bounded result set, so a Query Meter licence is not spent on browsing.

How the OnBase connector works

Built on the Hyland API Server — these are the pieces that matter to an access office.

Groups, types, documents

Roots are your document type groups, or document types where the API Server exposes no groups. Each type lists its documents newest document date first, paged from one bounded query; a type with more documents than the bound shows the newest, and search reaches the rest.

Keyword search

Filter by document type, by keyword type with equals or contains, and by document date; any keyword type you expose as a facet becomes a filter too. A native search sends your own OnBase query body, checked before it reaches the API Server.

Keyword values on every record

The details flyout shows the group, type and document name as a path, the document and stored dates, the latest revision, and every keyword value — multi-value keywords included.

Collect a document type

Collect this folder… on a document type, or a whole group, takes every document in the background, bounded by document date, and mirrors the group and type as folders in the workspace.

One narrow service user

An allow-list by id, name or system name keeps the connector to the document types you choose, and the connector's health check flags any entry that matches nothing.

Open in source

Point the connector at your OnBase web client's document address and every captured record links back to the document in OnBase, for anyone with their own OnBase access.

Chain of custody

OnBase records the service user. AccessPoint records the person.

Captures run server-side: the AccessPoint API asks the connector for the document's latest revision, streams it into the case's own storage in your Azure subscription, computes a SHA-256 hash as it arrives and compares it with the hash the connector reports. Each record's Source details show the OnBase path, the document handle, the revision taken, the hash with its Verified pill, and who captured it and when; the request's hash-chained audit ledger records the connector, item, version, hash and purpose. On the OnBase side, the connector writes an attribution line for every call — the AccessPoint user and sign-in name, the case, the purpose and the request id — so your SIEM can join OnBase's service-user entries to the person who acted.

Frozen copy, verified hash The record on the case is provably the bytes OnBase served.
Every call attributed User, case and purpose on each connector log line and ledger entry.
Provenance travels Source path, item id, version, hash and capture date go with a tenant export.

From OnBase to the request file

The path for an organization adding OnBase to AccessPoint:

  1. With your Hyland administrator, confirm the API Server and the Hyland IdP Server are installed, create an IdP client connection for the connector, and create a service user with Retrieve rights on the document types the access office may collect from.
  2. Deploy the connector to an App Service or Container App in your Azure subscription — or as a Windows service beside the API Server — and set the API Server and IdP addresses, the document-type allow-list, the keyword facets and the Open in source address, with secrets held as Key Vault references.
  3. If the API Server is on premises, add a Hybrid Connection and install the Hybrid Connection Manager inside your network; it connects outward and reads Connected.
  4. Run the connector's self-test, then register it under Settings → Connectors as a Remote connector, run Test connection and enable it.
  5. On a request, choose Add from… and the OnBase tile, open a document type or search on a keyword, and add the documents — or collect a whole document type in the background.

Go deeper

All repository connectors Every system AccessPoint can capture records from, and how to choose between a built-in and a hosted connector. Connector set-up in the docs Registering, testing and monitoring a connector, identity modes, and Hybrid Connections. Municipal & local government FOI and public records for the whole organization, at one flat price. Provincial & territorial government Provincial access and privacy regimes, run in one platform in your own tenant. US state & local government Your state's public records law, configured in your agency's own tenant. Records & information managers Capture, retention and defensible destruction for the people who own the records.

Hyland OnBase Connector Questions

Do OnBase documents leave our tenant when AccessPoint captures them?
No. Captured documents travel from your API Server, through the connector you host, into the case's own storage in your Azure subscription — nowhere else. The AccessPoint API does the fetching server-side; your browser never calls the connector, the publisher never sees connector traffic, and the content is streamed rather than held on the connector.

Do we need a VPN or an inbound firewall rule to reach OnBase?
No. An on-premises API Server is reached through an Azure Relay Hybrid Connection: the Hybrid Connection Manager on a machine inside your network makes only an outbound connection on port 443 to the relay, so no inbound rule is needed whether the connector runs in Azure or beside the API Server. The AccessPoint API's own TLS session runs end to end through the tunnel.

Which OnBase versions does the connector support, and has it been validated against ours?
OnBase Foundation EP1 or later with the Hyland API Server and the Hyland IdP Server installed; Foundation 22.1 or later is the realistic floor. The connector is built on Hyland's published Document Management REST API. Because every OnBase installation is configured differently — the sign-in grant, whether document type groups are exposed, revision lists, full-text search, the web client's document address — those points are connector settings rather than code, and Realizer validates the connector against your instance during onboarding. Ask us about your version.

Does AccessPoint copy the OnBase document or link to it?
It copies the latest revision into the case once, as a frozen copy with a verified hash, and keeps a link back: Open in source opens the document in your OnBase web client once you configure its address. The document handle and revision are recorded, and the same document at the same revision is skipped rather than captured twice on one case. The connector never writes to OnBase.

Can departments collect their own records from OnBase?
Yes. An administrator can widen the OnBase tile from coordinators to a role such as Custodian, and a custodian's task can carry a repository row bound to a document type, where Browse here and Search here open the picker at that place. Because the connector reads OnBase as one service user, everyone who can see the tile sees what that user sees — so scope the service user and the allow-list to the document types the request work needs.

Is there a per-connector fee for the OnBase connector?
No. Repository connectors are a licensed module of AccessPoint, and every plan includes it: flat annual pricing by organization size ($2,990, $7,990, $14,990 or $29,990), no per-user fees, billed through the Microsoft commercial marketplace, with a 30-day free trial. What you pay separately is Azure, in your own subscription — the connector's host and about USD $10 a month per Hybrid Connection listener at list price — and, on the Hyland side, the integration licence the service user consumes.

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.

  • Under 500 employees$2,990/yr
  • 500–1,999 employees$7,990/yr
  • 2,000–9,999 employees$14,990/yr
  • 10,000+ employees$29,990/yr

See full pricing Build the business case

Your OnBase Records. Your Request File. One Picker.

Try AccessPoint free for 30 days in your own Microsoft 365 tenant — repository connectors included, no per-connector fee.

Start Free Trial Request a Demo