Security and Autodesk integration

Published-model access with a clear delivery boundary.

BIMRelay reads the Revit evidence needed to generate the workbook. It keeps delivery edits in BIMRelay and never writes those decisions back into the model.

Autodesk OAuth

Users connect their Autodesk account through OAuth. Connection credentials and refresh tokens are handled by the server and refreshed when Autodesk access tokens expire.

Published Forma data

BIMRelay reads the selected published Revit host and compatible linked models through Autodesk Platform Services. It does not require a desktop Revit add-in.

No Revit model writeback

Workbook edits and delivery decisions are not written into Revit. Publishing writes only the completed XLSX file to the selected Forma folder.

Project permissions

Workspace administration and project-level manager, editor, and read-only roles control who can manage, change, or inspect project data.

Archiving and deletion

Archived projects remain available read-only and cannot run new extraction or workbook processing. A deleted project is removed from user access immediately, and its remaining database records and object-storage files are purged after a 30-day grace period.

Immediate access revocation

Removing someone from a project takes effect immediately. Their live workbook sessions are disconnected and open tabs lose access. Revocation does not wait for their next sign-in.

OAuth scopes and publishing

Read access for models. Write access only for completed file publishing.

BIMRelay uses Autodesk data and viewable access to discover projects, read published model versions, extract Revit data, and provide model context. The Autodesk connection can also request create and write scopes to publish a completed XLSX export to a chosen Forma folder.

Those publishing scopes are never used to modify Revit model contents. Workspace admins control which Autodesk connections are authorized, and revoking a grant disconnects its access immediately.