Skip to content
Kodifly
EN
Menu

DEVB TC(W) No. 3/2023, Annex A 5(6) and 5(12)(a)

4S platform API and data: integration, hosting and handover

A 4S platform must make every timestamped alert, image and reading available by API, encrypted, and keep the API documents current (DEVB TC(W) No. 3/2023, Annex A, clause 5(6)). Hosting must meet recognised security standards. Some contract specifications add an OpenAPI v3 REST API, single sign-on and an SFTP data hub. SpatialSense meets each.

Last updated

API
Timestamped data available by API (clause 5(6))
API standard
RESTful, OpenAPI v3, JSON
Single sign-on
OpenID Connect or OAuth2, PKCE and client credentials
Hosting
TIA-942 Tier 3 data centre and ISO/IEC 27001
Encryption
At least 256-bit SSL
End of contract
Data returned, copies destroyed, certificate issued

What the circular requires of 4S data

Clause 5(6) of Annex A to DEVB TC(W) No. 3/2023 says all audio, video, image and data from 4S components must be digitised and marked with the time and date of transmission, available for integration by an Application Programming Interface (API), and live-streamed to the centralised management platform. All of it is encrypted. The contractor maintains the APIs through upgrades and maintenance, and keeps a copy of the API library documents after launch and after each major upgrade.

Clause 5(12)(a) sets the platform's hosting and security. Servers may sit in the site office, a data centre or the cloud. Data is filed automatically and kept for at least 3 months. Users open the platform in a web browser over HTTPS, with no other software or licence.

Where a contract adopts both the DWSS and 4S, DEVB TC(W) No. 8/2025 says the 4S platform shall be amalgamated into the DWSS as one Smart Construction Management hub (paragraph 7, footnote 1). The DWSS then sends its data on to iCWP within 24 hours (Annex A, clause 1.7.2).

Integration duties, and how SpatialSense meets them

DutySourceSpatialSense
Timestamped data available by APITC(W) No. 3/2023, Annex A 5(6)Meets. Every alert, image and reading carries its date and time and is open to authorised systems by API.
API documents kept currentAnnex A 5(6)Meets. API library documents are kept after launch and each major upgrade.
REST API with an OpenAPI v3 descriptorSome contract specificationsMeets. JSON descriptor, X.Y.Z versioning, standard create, read, update and delete operations, and every error documented.
Two-way data accessSome contract specificationsMeets. Raw and processed data can be queried, extracted and ingested.
Single sign-onSome contract specificationsMeets. OpenID Connect or OAuth2 against the main contractor's Azure Active Directory, with the Authorization Code flow with PKCE and the Client Credentials flow. SAML or WS-Fed where used.
SFTP data hubSome contract specificationsMeets. A raw data file in TXT or CSV at each agreed interval, pushed to the contractor's server from whitelisted IP addresses and checked by an end-of-file CRC.
DWSS hubTC(W) No. 8/2025, paragraph 7, footnote 1Meets. SpatialSense is the 4S platform and the DWSS in one system.
DEVB SmartEyeSome contract specificationsMeets. Platform data sent by API to DEVB's SmartEye dashboard.

Hosting and security

The platform requirements in Annex A, clause 5(12)(a), with the additions some contract specifications make.

Data centre
TIA-942 certified Tier 3 data centre and ISO/IEC 27001 (clause 5(12)(a)(x))
Cloud assurance
An up-to-date independent auditor report, for example ISO/IEC 20000 or ISO/IEC 27017 (clause 5(12)(a)(x))
Site-hosted servers
Separated by firewall or VPN (clause 5(12)(a)(ix))
Encryption
At least 256-bit SSL for all traffic and data feeds (clause 5(12)(a)(xi)). Sensitive API properties encrypted with AES.
Security audits
To the Security Regulations and the Government Baseline IT Security Policy (clause 5(12)(a)(xii))
Availability
99.9% in working hours (clause 1(3)), with a redundancy plan for 99.99% where the contract asks
Privacy
Personal Data (Privacy) Ordinance (clause 1(2)), with an independent privacy impact assessment where the contract asks

At the end of the contract

  1. Return

    All project data and information goes back to the Project Manager.

  2. Remove

    Data from each decommissioned component is removed completely.

  3. Destroy

    Copies and backups are securely erased from the hosting environment.

  4. Certify

    A certificate of data destruction is issued.

  5. Verify

    The Project Manager may inspect and verify the return and destruction.

OpenAPI, single sign-on and an SFTP data hub.

Integration settings sit on one screen: the OpenAPI documentation is published, single sign-on is on and the SFTP data hub is connected.

4S platform API and data, answered

Does a 4S platform need an API?

Yes. All audio, video, image and data from 4S components must be timestamped and available for integration by an API, and the contractor maintains the APIs and keeps the API library documents (DEVB TC(W) No. 3/2023, Annex A, clause 5(6)).

Which API standard do contracts ask for?

The circular does not name one. Some contract specifications ask for a RESTful API with a valid OpenAPI v3 descriptor in JSON and standard create, read, update and delete operations. SpatialSense provides it.

Can users sign in with the main contractor's accounts?

Yes. SpatialSense supports single sign-on with OpenID Connect or OAuth2 against the main contractor's Azure Active Directory, using the Authorization Code flow with PKCE and the Client Credentials flow.

Where must the 4S platform be hosted?

In the site office behind a firewall or VPN, or in a data centre or cloud. Hosted servers must meet a recognised standard such as a TIA-942 certified Tier 3 data centre and ISO/IEC 27001, with an independent auditor report such as ISO/IEC 20000 or ISO/IEC 27017 (clause 5(12)(a)(ix) and (x)).

How does 4S data reach the DWSS?

Where a contract adopts both, the 4S platform is amalgamated into the DWSS (TC(W) No. 8/2025, paragraph 7, footnote 1). With SpatialSense it is the same system, so every 4S alert sits in the DWSS record.

What happens to the data at the end of the contract?

All data is returned to the Project Manager, copies and backups are securely destroyed, and a certificate of data destruction is issued. The Project Manager may verify it.

More Smart Site Safety guides

  • 4S and DWSSHow the 4S centralised management platform joins the DWSS Smart Construction Management hub under DEVB TC(W) Nos. 3/2023 and 8/2025, and what flows into it.
  • AI cameraDEVB TC(W) No. 3/2023 clause 5(12)(g): the unsafe scenarios an AI camera must detect, the 80% test and 90% average accuracy, 1 second alarms and video records.
  • Centralised platformWhat DEVB TC(W) No. 3/2023 requires of the 4S centralised management platform (CMP): 30 users, 3 months of data, security, and the alerts every device sends it.
  • 4S componentsThe twelve 4S components in DEVB TC(W) No. 3/2023 Annex A, what each must do, and the rules that apply to every device. Kodifly delivers the set complete.
  • Confined spaceDEVB TC(W) No. 3/2023 clause 5(12)(h): worker counting, PPE checks and oxygen, gas and temperature monitoring for confined spaces under Cap. 59AE.
  • Contract variantsHow 4S requirements vary between Hong Kong contract specifications: 12 or 9 components, 2 or 15 AI cameras, 70 or 100 dB sirens and extra data duties. Kodifly meets both.
  • 4S Labelling SchemeHow the CIC and DEVB 4S Labelling Scheme works: who applies, what CIC assesses, the site inspection, one-year validity, renewal and confiscation.
  • Mobile plant alertDEVB TC(W) No. 3/2023 clause 5(12)(e): 360 degree sensors on excavators and cranes, a 2 m danger zone, 100 dB siren, and the BD mandatory rules for private works.
  • Permit-to-workWhat DEVB TC(W) No. 3/2023 clause 5(12)(c) requires of a digitised permit-to-work system: the high-risk activities, live mobile status and expiry alerts.
  • Plant and tool trackingDEVB TC(W) No. 3/2023 clause 5(12)(b): a unique digital ID on every plant, MEWP, lifting gear and powered tool, with scan checks and overdue alerts.
  • Smart lockDEVB TC(W) No. 3/2023 clause 5(12)(d): electronic locks and keys on electrical cabinets, floor openings, lift shafts and confined spaces, with siren and alerts.
  • Tower crane alertDEVB TC(W) No. 3/2023 clause 5(12)(e): the tower crane loading and unloading danger zone of at least 7 m from the hook, 3 m clearance, 100 dB siren and alerts.
  • VR safety trainingDEVB TC(W) No. 3/2023 clause 6: half-yearly VR safety training for workers in eight high-risk activities, accepted content, hardware and training records.
  • Worker monitoringDEVB TC(W) No. 3/2023 clause 5(12)(f): wearables for every worker with location, standstill, temperature and heart rate alerts, and privacy limits.

Plan your 4S integration

Tell us the systems your 4S must feed. We will return the API, sign-on and data handover plan.

Talk to us about 4SSmart Site Safety System