The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and stuff).

The problem is management does not exactly know what they want. And there are currently two options I'm tasked with figuring out:

 - Option 1, create a .dll (or similar) file with which 3th party
   programmers can communicate and create their own software solutions.
 - Options 2, change the current embedded hardware so the product can directly be spoken to over IP.

Even though my preferences goes out to option 1 I'm still trying to explore option 2 as good as I can. Therefore I am trying to find out if there are standardized protocols for exchanging access control specific data. And for what I have found I do not think there is. Competitors, also, seem to use their own thing. However I know very little when it comes to the vast jungle of standardized protocols which is why I'm asking the following question:

Is there a standardized protocol for sending over access control data.

I am not looking for securing the data I am sending (we already use TLS) I am looking for a way to structure the data I want to send.

In the worst case I will simply think of a format and send it over with something like JSON.