ONVIF Profiles Explained: S, T, G, M, V Guide (2026)

Why Fora Soft wrote this playbook

Fora Soft is a software development company that has built video and real-time communication software since 2005. Across 20+ years and 250+ delivered products, we have shipped more ONVIF-backed VMS, NVR, body-worn, courtroom and analytics projects than we can comfortably list. ONVIF is the single most important interoperability standard in IP surveillance, and it is also the most misread. Nine out of ten integrators who call us already own the hardware and the VMS, then wonder why the two will not talk to each other. The answer is almost always a profile mismatch nobody checked.

This guide is the briefing we give a client in week one of a new surveillance project: what each ONVIF profile does, where it breaks, which profile to mandate, how to validate conformance in minutes, and where you will fall back to vendor SDKs anyway. It is calibrated against real deployments, including VALT, the enterprise video surveillance platform we have been the sole development team behind for over a decade, now used by 770+ US organizations and 50,000+ users under HIPAA. See our video surveillance development services for the kind of work this playbook comes out of.

What ONVIF actually is (and isn’t)

ONVIF (Open Network Video Interface Forum) is a non-profit industry consortium founded in 2008 by Axis Communications, Bosch Security Systems and Sony. Its charter is narrow: produce open standards for the interfaces between IP-based physical security products. It publishes specification documents, runs conformance testing, and maintains a public list of certified products that had passed 35,000 devices and clients entering 2026.

At the wire level, ONVIF defines web services using SOAP 1.2 over HTTP(S) with WSDL contracts, plus RTSP/RTP for media. Authentication is Digest or WS-Security UsernameToken. Events travel over SOAP notifications, either pull-point or base, and since Profile M they can also travel over MQTT with JSON payloads. Devices are discovered on the LAN with WS-Discovery.

What ONVIF is not. It is not a video format. H.264 and H.265 are codecs, not ONVIF. It is not a cloud platform, not a management UI, and it ships no reference hardware. Critically, it never standardizes proprietary features. Axis ACAP, Bosch IVA, Hikvision AcuSense and Hanwha Wisenet AI all live outside the spec, even on ONVIF-certified cameras.

Why ONVIF won the standards war

The only real rival, PSIA (Physical Security Interoperability Alliance, also founded 2008), covered a wider scope and used REST rather than SOAP. It was cleaner on paper and politically isolated in practice. ONVIF had the three founding manufacturers, then Hanwha, Pelco, Hikvision and Dahua, and the market followed. PSIA still exists but is effectively dormant for new deployments. Any integrator who tells you otherwise is a decade out of date.

Figure 1. The 2026 ONVIF profile map: what each video and access-control profile standardizes, and which combine on a single device.

The ONVIF profile roster at a glance

There are seven active profiles in 2026 plus Profile V, a cloud profile in release-candidate status, and a small set of modular add-ons. Profile Q was deprecated on April 1, 2022 for security reasons. Here is the canonical map.

Profile S: the streaming baseline retiring in 2027

Profile S was the first ONVIF profile, finalized in 2011, and for a decade it was the default sticker on every IP camera box. It standardizes live H.264 video, audio streaming, PTZ control, motion-detection events and basic metadata. If a VMS supports exactly one ONVIF profile, it is almost always Profile S.

The 2027 deadline changes procurement now. On October 9, 2025 ONVIF announced it is ending support for Profile S and recommending Profile T as the successor. After March 31, 2027, manufacturers can no longer submit new products, or existing products with new firmware, for Profile S conformance. The reason is security: Profile S mandates username-token authentication, which no longer matches current cybersecurity recommendations. Existing Profile S devices keep working, but if you are specifying hardware in 2026, treat Profile S as a legacy fallback and mandate Profile T.

What it misses. No H.265, no image-setting management, no embedded analytics, and no tamper events as a first-class citizen. On a new 2026 deployment, a Profile S-only stack leaves roughly 50% of bandwidth and every analytics capability on the table.

Profile T: the 2026 streaming baseline

Profile T was finalized on October 25, 2018 and is the streaming profile you should default to today. It adds H.265 alongside H.264, embedded motion and tampering analytics, image-settings management (brightness, contrast, WDR), bidirectional audio, and enhanced event handling. One precise point that trips teams up: a Profile T client must handle both H.264 and H.265, while a Profile T device must support at least one of them. So confirm H.265 on the specific model rather than assuming the profile guarantees it.

Why it matters commercially. H.265 cuts storage and bandwidth by roughly 50% versus H.264 at the same visual quality. For a 1,000-camera site that is the difference between a $12k/month storage bill and a $6k/month bill. If your VMS is still Profile S-only, you are paying that difference for nothing. Our notes on the pipeline side live in real-time video processing with AI.

Profile G: edge recording and playback

Profile G, finalized in 2014, is the profile for NVRs, edge-recording cameras with SD cards or internal storage, and any device that records video locally. It standardizes four capabilities: configuring recording schedules, querying recording metadata, retrieving recordings, and controlling playback. It is also the profile under which two-way audio is formalized.

In practice Profile G is essential wherever centralized storage is not viable: remote sites, mobile vehicles, temporary installations, body-worn cameras. It is the only vendor-neutral way to query an edge-stored archive from a VMS without a proprietary SDK. Our take on the architecture trade-offs lives in scalable video management systems.

Profile M: the analytics metadata profile

Profile M, published in 2021, is the newest streaming-adjacent profile. It standardizes how IP devices share analytics metadata: bounding boxes, classifications (human, vehicle, face, license plate), events (line crossing, counting, loitering), and geolocation. It also introduces an optional MQTT binding for events, which turns a camera into a first-class IoT node your data platform can subscribe to.

Profile M is growing fast on enterprise AI cameras (Axis ARTPEC-9, Bosch 7000 series, Dallmeier, Hanwha Wisenet P/X, Pelco Sarix). Mid-tier and budget brands still lean on proprietary SDKs for their best analytics. For the metadata side in depth, see our dedicated ONVIF Profile M and object detection guide.

Profile V: the cloud profile arriving in 2026

Profile V is ONVIF’s answer to cloud video surveillance, or VSaaS. ONVIF published the release candidate in mid-2026 and expects to finalize it by the end of the year. It is the first credible standard for building a cloud VMS out of cameras from more than one vendor, without each brand’s proprietary cloud in the middle. For anyone who has watched a customer get locked into a single VSaaS vendor, that is the headline.

How it works. The camera behind a local firewall initiates an outbound Uplink connection to the cloud client over WSS (WebSocket Secure), so there is no port forwarding and no VPN. Authentication uses the OAuth 2.0 framework with mutual TLS and access tokens. The device then streams low-latency H.264 video over WebRTC, pushes encrypted video and audio to cloud storage such as Amazon S3 or Azure Blob for recording, and sends events either as pull-point notifications over the Uplink or as JSON over MQTTS. Bidirectional audio rides WebRTC where the hardware supports it.

Why the security lives in an add-on. Profile V is paired with a Profile V Security Add-on that carries the OAuth 2.0 requirements and the recording encryption. ONVIF put those rules in an add-on so they can be upgraded as threats evolve, without rewriting the whole profile. If you are scoping a cloud camera product for 2026 or 2027, design toward Profile V now: it maps almost exactly onto the modern VSaaS architecture teams are already building by hand.

Figure 2. Profile V connection flow: the device initiates a secure Uplink to the cloud client, then streams over WebRTC and records to cloud storage.

Profiles A, C, D: the access-control triad

ONVIF’s access-control profiles were long overshadowed by video, but as surveillance and physical access control systems (PACS) converge, these three profiles earn real attention.

Profile C (finalized 2013) handles run-time events: door-state notifications, access-granted or denied events, operational status. A VMS subscribes to Profile C to show door events next to a live camera feed.

Profile A (finalized 2017) handles configuration: credentials, schedules, access rules and access-point definitions. It is the management surface for an access control system.

Profile D (finalized 2021) handles peripherals: RFID and QR readers, biometric devices, keypads, door sensors and request-to-exit buttons. It is the newest of the three and adoption is uneven, so proprietary reader SDKs still dominate many deployments.

ONVIF add-ons: TLS, Uplink and Profile V Security

Add-ons are lightweight, versioned specifications that extend an existing profile rather than standing alone. A product must already conform to at least one profile before it can claim an add-on. Because add-ons carry version numbers, security requirements can move faster than the profiles they attach to. Two add-ons are published as of 2026.

TLS Configuration Add-on. This was ONVIF’s first add-on, released as a release candidate in 2023 with the v1.0 specification following in early 2024. It lets a conformant VMS configure or update TLS settings on a conformant device, so encrypted communication between client and device can be provisioned rather than hand-configured per camera. ONVIF has signaled an upgrade to this add-on by the end of 2026.

Profile V Security Add-on. Released alongside the Profile V candidate, this add-on defines secure authentication between a device and a cloud-based client using OAuth 2.0, plus encryption of recordings on the way to storage. It is what makes the Profile V cloud model safe to deploy across vendors.

Uplink. Not an add-on but the specification the cloud story is built on, the ONVIF Uplink specification (version 26.06, June 2026) defines the device-initiated outbound channel, secured with TLS, that Profile V uses to reach a client through a firewall. When you read a Profile V or add-on Declaration of Conformance, check the version number: a 1.2 add-on is not automatically compatible with a 1.0 client.

Figure 3. ONVIF profile timeline, from Profile S in 2011 to Profile V in 2026 and the Profile S sunset on March 31, 2027.

Verifying conformance in five minutes

The only authoritative source is the ONVIF Conformant Products List. ONVIF itself warns that fraudulent logo use and overstated conformance claims are common on spec sheets. Treat every marketing page as suspect. The Declaration of Conformance (DoC) is the contract.

The 6-step DoC workflow

1. Find the exact model. Search by manufacturer and model number in the Conformant Products database. Watch for model revisions: a DS-2CD2663G0 is not a DS-2CD2663G1.

2. Match the firmware. Each DoC is tied to a tested firmware version. If your stock runs different firmware, that DoC does not apply.

3. Download the DoC. Read the first page for the profiles claimed, for example “Profile S, T, G, M”.

4. Scan the feature tables. Every feature is marked M (mandatory, must work), C (conditional, must work if the functionality exists at all), or O (optional). The features you care about should be ticked, not assumed.

5. Cross-check with a live tool. ONVIF Device Manager (free, Windows-only) connects to the camera and enumerates supported services. Compare it against the DoC.

6. Pin the firmware. In your deployment bill of materials, lock the exact firmware version and add a re-test step for any firmware upgrade.

The toolchain that keeps an ONVIF project moving

ONVIF Device Manager (Windows, free). Still the fastest way to connect to a camera, enumerate services, check DoC claims and pull a test stream.

ONVIF Device Test Tool (members only). The official conformance suite manufacturers run. If you are building a device rather than consuming one, you live in it.

gSOAP, python-zeep and onvif-zeep. WSDL-to-code generators for C/C++ and Python clients. Keep local copies of the ONVIF WSDLs, because online resolution is brittle.

Wireshark with RTSP and SOAP dissectors. When the DoC says one thing and the camera says another, the wire is where the truth is.

Happytime ONVIF Server and other emulators. Spin up a synthetic device to test your VMS consumer without touching physical hardware. Deeper builder notes live in our video surveillance engineering hub.

The profile bundles you actually deploy

Vendor adoption and the NDAA/FCC reality

Enterprise. Axis, Bosch, Hanwha, Pelco and Dallmeier publish clean DoCs, maintain firmware, and keep Profile M current. These are the brands where “ONVIF compliant” on the box matches the DoC in the database.

Mid-tier. Vivotek, i-PRO and Lorex offer solid Profile S and T, partial G, and are slowly adding M. DoCs are usually accurate, though optional features go missing on budget SKUs.

High-volume and budget. Hikvision and Dahua are ONVIF members and ship Profile S and T widely, but their advanced analytics and storage features sit behind proprietary ISAPI and DH-SDK interfaces. You will almost always run a proprietary SDK path alongside ONVIF for these brands, so budget accordingly.

Cloud and VSaaS. Verkada, Eagle Eye and Spot AI wrap ONVIF behind a gateway: the edge camera speaks ONVIF upstream, the cloud UI is proprietary. That is fine, as long as you remember ONVIF feature parity stops at the gateway. Profile V is aimed squarely at this gap.

The compliance layer buyers cannot skip in 2026

ONVIF conformance says nothing about whether you are allowed to buy a camera. In the US that is a separate, and tightening, question. NDAA Section 889 (2019) banned Hikvision, Dahua, Huawei, ZTE and Hytera from federal procurement. The FCC then added them to its Covered List, and in October 2025 moved to close the loopholes that let previously authorized gear keep entering the country. In an order issued on June 26, 2026, published in the Federal Register on July 6 and effective July 16, 2026, the FCC restricted continued import and marketing of certain previously authorized covered equipment. By 2026, roughly 45 states had adopted their own restrictions.

Existing installations do not have to be ripped out, but new products, replacement parts and expansions through compliant channels are now constrained. Practical rule for 2026 procurement: treat NDAA and FCC status as a hard filter that runs before the ONVIF profile audit, not after. Our guide to IP camera systems for business and AI-powered IP camera trends go deeper on sourcing.

Mini case: a 400-camera hospital migration

Situation. A regional hospital group ran a decade-old VMS with roughly 400 Axis P-series cameras on Profile S H.264. Recording was chewing through a central SAN, the CISO wanted HIPAA-grade audit and after-hours loitering analytics, and access-control events needed to reach the SOC dashboard without yet another vendor integration. This is the exact class of migration we handle on VALT, the enterprise surveillance platform we have maintained as sole development team for 10+ years across 770+ US organizations and 50,000+ users.

The 10-week plan. Weeks 1–2: DoC audit, firmware plan, and a rolling H.264-to-H.265 transition via Profile T. Weeks 3–5: enabling Profile M on the newer P-series units with an MQTT broker for metadata. Weeks 6–7: access-control Profile A and C integration against the existing HID readers. Weeks 8–9: audit trail and SOC UI. Week 10: load test, runbooks and handoff.

The storage math, worked. One 4 MP camera recording continuously at 4 Mbps on H.264 writes 4 × 86,400 / 8 ≈ 43 GB/day. At equal quality, Profile T H.265 lands near 2 Mbps, about 21 GB/day. Across 400 cameras that is roughly 8.6 TB/day saved, or about 3.1 PB/year off the SAN. The move to Profile M also shifted alerting onto the metadata path, so operators watch object events (person after hours, vehicle in a fire lane) instead of raw motion, and access events now render beside the matching camera feed with no extra plugin. See the VMS side in 12 essential features of modern VMS software.

What an ONVIF consumer really costs to build

Estimates below assume our Agent Engineering-accelerated workflow. Non-accelerated teams should budget 40–60% more hours. Numbers cover the ONVIF integration only, not the VMS UI, user management or storage plumbing around it.

Figure 4. Build effort per ONVIF profile consumer, low-to-high engineering-hour range on our accelerated workflow.

Which profiles to mandate in five questions

Q1. Will you deploy H.265? Yes, Profile T is non-negotiable. Even if no, mandate Profile T anyway, because Profile S stops accepting new conformance on March 31, 2027.

Q2. Will recording live on the edge? Yes, Profile G is required. No, a central VMS only, and Profile G is optional.

Q3. Is cross-vendor analytics metadata in scope? Yes, Profile M is required, and plan for MQTT plus a metadata archive. No, skip M, and proprietary analytics may be cheaper.

Q4. Is the product cloud-first, or is access control unified with video? Cloud-first, track Profile V and design toward Uplink now. Unified access control, plan Profile A + C, likely D.

Q5. Does procurement include Hikvision or Dahua? Yes, plan a parallel proprietary-SDK path for advanced features, and clear the NDAA/FCC filter first. No, pure ONVIF is realistic.

Five pitfalls that sink ONVIF projects

1. Trusting spec sheets over DoCs. Marketing pages overstate conformance. The DoC is the contract, so audit every model.

2. Ignoring firmware pinning. Conformance is firmware-specific. A fleet running 12 firmware revisions has 12 different behaviors to support.

3. Assuming optional features work. A Profile T camera without a tick against “image settings” will not let you set brightness over ONVIF, even if the web UI does.

4. Conflating ONVIF with the vendor SDK. If the product depends on Axis ACAP, Bosch IVA, Hikvision DeepinView or Wisenet AI, ONVIF alone will not carry the feature.

5. Skipping WS-Discovery governance. On a flat LAN, WS-Discovery multicast floods the network when hundreds of cameras wake at once. Segment the VLAN or disable multicast discovery and script device addition explicitly.

KPIs: what to measure on an ONVIF stack

Quality KPIs. Live-stream start latency under 800 ms p95 from PLAY to first I-frame, PTZ command round-trip under 400 ms, and metadata delivery latency under 500 ms where Profile M is in play.

Business KPIs. Storage footprint per camera per day (Profile T H.265 should run 40–50% below Profile S H.264), alert-to-operator latency under 1 s, and the count of proprietary SDK code paths, which you drive to zero on unified sites and accept at one or two on mixed fleets.

Reliability KPIs. Camera availability at or above 99.5% per month, ONVIF discovery completion under 30 s for a 500-camera LAN, and firmware drift held to three or fewer distinct versions across the fleet at any time.

When ONVIF is the wrong tool

Consumer cloud cameras. Ring, Nest and Wyze do not ship ONVIF. For consumer products bundled with a cloud backend, proprietary protocols win on latency, battery life and integration simplicity.

Sub-100 ms critical-infrastructure alerting. In ultra-low-latency workflows such as perimeter intrusion at nuclear or financial sites, WebRTC with in-band alarm metadata beats the ONVIF event pipeline. Use ONVIF for archive and the evidentiary chain, and keep the hot path tighter.

Single-vendor, closed ecosystem. If the hardware and VMS come from one vendor and there is zero interest in swapping either, the native SDK gives more features with less ceremony. ONVIF is insurance for vendor flexibility, and if you will never exercise it, you can skip the premium.

FAQ

What are the ONVIF profiles S, T, G, M, A, C and D?

They are fixed feature sets a device or client can conform to. Video profiles: S (basic H.264 streaming, being retired in 2027), T (advanced H.264/H.265 streaming, the 2026 baseline), G (edge recording and playback), M (analytics metadata). Access-control profiles: A (configuration), C (door events), D (peripherals). Profile V, a cloud profile, is a 2026 release candidate. A device can hold several at once.

Is ONVIF free to use?

The specifications are publicly downloadable at no cost. Conformance testing, which you only need if you manufacture a device or client and want to display the ONVIF mark, carries a fee paid to ONVIF. Using ONVIF on existing conformant devices has no licensing cost.

Is ONVIF Profile S being discontinued?

Yes. ONVIF announced on October 9, 2025 that it will end support for Profile S. After March 31, 2027, manufacturers cannot submit new products, or existing products with new firmware, for Profile S conformance. Profile S mandates username-token authentication that no longer meets current security guidance. Existing Profile S devices keep working, but new deployments should mandate Profile T.

What is ONVIF Profile V?

Profile V is ONVIF’s cloud video surveillance profile, released as a candidate in 2026 and expected to finalize by year end. The camera initiates a secure Uplink to a cloud client over WSS, authenticates with OAuth 2.0 and mutual TLS, streams H.264 over WebRTC, and pushes encrypted recordings to cloud storage. It lets a cloud VMS mix cameras from multiple vendors without a proprietary cloud in the middle.

Which ONVIF profiles do I need for a cloud VMS?

For a cloud-first or VSaaS product, target Profile V (the 2026 cloud release candidate) so cameras from multiple vendors reach your cloud over a device-initiated Uplink. Keep Profile T as the on-premises streaming fallback, add Profile G if you also record at the edge, and Profile M if you need analytics metadata. Until devices ship with Profile V conformance, most cloud builds still run Profile T plus a gateway.

Does Profile T include Profile S?

Not formally. They overlap heavily, and a Profile T device almost always still supports Profile S features for backward compatibility, but conformance is separate. In practice a Profile T camera from 2021 or later works with Profile S clients. Just do not assume it from the spec alone; confirm it in the DoC.

Do Hikvision or Dahua cameras support ONVIF?

Yes. Both are ONVIF members and most of their IP camera lineup ships Profile S and T. Their flagship analytics and advanced storage sit behind proprietary ISAPI and DH-SDK interfaces, so those features need the vendor SDK even on an ONVIF-compliant device. Separately, US buyers must check NDAA and FCC status, which has tightened through 2025 and 2026.

Does ONVIF work over the public internet?

The classic profiles were built for the LAN, so terminate ONVIF inside a VPN or a bastion gateway and never expose a camera directly to the public internet. Profile V changes this for cloud: it defines a device-initiated Uplink secured with TLS and OAuth 2.0, which is the right way to reach a camera through a firewall.

Is ONVIF the same as RTSP?

No. RTSP is a media streaming protocol. ONVIF is a management and control standard that uses RTSP, among other protocols, to move media. You can speak RTSP to a camera without ONVIF, but you will not get PTZ, analytics events or unified discovery.

What to Read Next

Ready to make ONVIF a competitive advantage?

ONVIF is the connective tissue of modern IP surveillance, and the sticker on the box is the start of the conversation, not the end. Read the DoC, mandate Profile T now that Profile S is on a 2027 clock, add G and M where the deployment needs them, watch Profile V for cloud, and plan around the places where vendor SDKs still carry the advanced features. Clear the NDAA and FCC filter before any of it. Done well, an ONVIF-native system is cheaper to run, easier to refresh, and hedged against vendor strategy changes you cannot predict today.

Fora Soft has built ONVIF consumers, VMS back-ends and gateways for over a decade, including the platform behind 770+ US organizations on VALT. If you want to skip the learning curve, we will bring the reference architecture, the code, and the operational playbook that have shipped across retail, smart-city, industrial, courtroom and enterprise-security projects. Deeper build notes live in our custom VMS development guide.