REST API Reference

Last updated

Everything the web app does goes through a REST API under /api on the appliance. You can call the same endpoints from your own programs. This article covers how to authenticate, the conventions every endpoint follows, and the Public Data API. REST API by Task has worked examples, and the complete list of endpoints is at the end of this article.

Warning: The /api routes are shaped for the app's own screens and can change between releases. For automation that must keep working across upgrades — provisioning, fleet audits, CI — use the versioned Configuration API (/api/v1), which promises not to break existing callers.

Three ways in

External programs sign in as a user, get a token, and send it on every request (below).
Scripts on the appliance should use the built-in helpers (tags, db, alarms, history, users, namedQueries…) — they run in-process and need no token. For an endpoint with no helper, call http.get('http://localhost:3001/api/...', headers). See Scripting API Reference.
Custom pages use scadaink.api.get/post/put/del(path, body), which already carries the signed-in viewer's session. See Custom Page API.

Base URL

From another computer: https://<appliance>/api (or http:// if TLS is not set up). The web server forwards /api to the API process.
From a script on the appliance: http://localhost:3001/api (3001 is the API's port unless API_PORT was changed).

Authentication

The API uses JSON Web Tokens (JWT) tied to a user account.

POST /api/auth/login with { "email": "...", "password": "..." }.
The response carries data.tokens.token (the access token) and data.tokens.refreshToken.
Send the access token on every request as the header Authorization: Bearer <token>.
Before the access token expires, POST /api/auth/refresh with { "refreshToken": "..." } to get a new pair.

bash

# Sign in and keep the access token
TOKEN=$(curl -s -X POST https://scada.local/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"integration@plant.com","password":"S3cure-Pass"}' | jq -r .data.tokens.token)

curl -s https://scada.local/api/devices/status/all -H "Authorization: Bearer $TOKEN"

json

{
  "success": true,
  "data": {
    "user": { "id": 7, "email": "integration@plant.com", "firstName": "MES", "lastName": "Link", "role": "operator", "lastSignIn": "2026-09-15 06:02:11", "createdAt": "", "updatedAt": "" },
    "tokens": { "token": "eyJhbGciOi…", "refreshToken": "eyJhbGciOi…" },
    "passwordChangeRecommended": false
  }
}

Token	Lifetime (default)	Set by
Access token	Session Timeout (60 minutes)	System → Settings; 24 hours (`JWT_EXPIRY_SECONDS`) if it was never saved
Refresh token	Session Timeout (60 minutes)	System → Settings; 7 days (`JWT_REFRESH_EXPIRY_SECONDS`) if it was never saved
Whole session	7 days from sign-in	`JWT_REFRESH_EXPIRY_SECONDS`

Things to know about these tokens:

Refresh before the access token expires. Both tokens expire together after the session timeout, so an integration must call /api/auth/refresh inside that window (for example at half of it) and store the new pair; an integration idle for longer signs in again. Refreshing never extends a session past 7 days from sign-in — then refresh answers 401 Your session has reached its maximum length. Sign in again.
Refresh returns a flat pair. /api/auth/refresh answers { "data": { "token": "...", "refreshToken": "..." } } — not nested under tokens as login is.
Logout revokes the token. /api/auth/logout ends the session that token belongs to; using it again (or its refresh token) answers 401 with { "code": "SESSION_REVOKED" }. It ends only that one session — a second integration signed in separately on the same account is unaffected. To cut off an integration immediately without its cooperation, disable its user account instead: every request from a disabled account is refused with 403 This account has been disabled. (code: "ACCOUNT_DISABLED"), even with an unexpired token, and any open connection for it is dropped within moments.
The role is live, not baked into the token. Role, e-mail and active status are re-read from the user record on every request (briefly cached — a few seconds — so this adds no meaningful load); a role change reaches an integration on its next call, no re-login needed. Refresh also returns the current role, never the one the old refresh token was carrying.
Two-factor accounts. When the account has two-factor authentication on, login answers { "data": { "mfaRequired": true, "challenge": "..." } } and no tokens. Post { "challenge", "code" } to /api/auth/mfa/verify within five minutes to get the tokens. For unattended integrations use a dedicated account without two-factor, restricted to the lowest role that works.
Directory accounts. If sign-in is backed by an external directory and the directory is unreachable, login returns 503 rather than 401.
Password changes revoke tokens. Changing an account's password ends every session issued with the old one — an integration must sign in again and update the token it stores. (Changing your own password from an already-authenticated session gets a fresh token pair back in the response instead of being signed out.)

Tip: Create a separate user for each integration (for example mes-link@plant.com, role operator) instead of reusing a person's account. Its Last sign-in in Users then tells you whether the integration is alive, and disabling it affects nothing else.

Roles

Every endpoint requires a minimum role. Roles are ordered admin > editor > operator > viewer; a higher role can do everything a lower one can.

Role	Typical API rights
viewer	Read devices, tags, live values, history, alarms, data table rows
operator	Also acknowledge and shelve alarms, write tags (device tags need Allow Tag Writes), run Open scripts and workflows, start and stop Open ladder tasks
editor	Also create and change devices, tags, alarm rules, data table rows, scripts and workflows
admin	Also delete devices and local tags, manage users, API tokens, settings, backups, data table structure

On top of the role, some requests pass further checks: per-user feature access and licensed features (403 with code: "FEATURE_DISABLED" or "FEATURE_USER_RESTRICTED"), per-resource access for scripts and workflows, per-tag write permissions from Security Levels, and the device's own write enabled switch. See User Management.

Conventions

JSON in, JSON out. Send Content-Type: application/json. Request bodies over 100 KB are rejected (see Troubleshooting).
Envelope. Almost every response is { "success": true, "data": … } or { "success": false, "error": "human-readable message" }. Some add fields such as meta, pagination or code. The exceptions are file downloads (CSV, backups) and the Public Data API, which return the document directly.
Status codes. 400 bad or missing input; 401 no token, bad token or expired token (No token provided, Invalid or expired token); 403 authenticated but not allowed (Insufficient permissions, disabled account, feature off, tag permission); 404 not found; 409 conflict; 503 a backing service is down (for example InfluxDB is not available); 500 anything else, with the message in error.
Field names. /api responses use camelCase (ipAddress, writeEnabled). /api/v1 responses use the database's snake_case (ip_address, write_enabled).
Ids are integers. Tag paths contain slashes, so endpoints that take a tag path take it in the body or query string, not the URL.
Pagination is per endpoint — there is no global scheme. List endpoints that can grow take limit with offset or page, and cap limit (for example alarm history: page, limit ≤ 200, result in meta.total; data table rows: limit ≤ 1000, offset, result in pagination.total). Most configuration lists return everything.
Times. Live values, alarm times and history points are ISO 8601 in UTC (2026-09-15T06:02:11.412Z). Record timestamps such as createdAt, updatedAt and lastSignIn come from SQLite as YYYY-MM-DD HH:MM:SS in UTC with no zone marker — add the Z yourself before parsing. History queries also accept relative starts such as -1h, -24h, -7d.
Values. Live tag values arrive as { deviceId, tagPath, value, dataType, quality, timestamp }. value is always a string — convert it using dataType — and check quality (good, bad, uncertain) before trusting it; a device that lost communication reports an empty string with quality bad. See Tag Quality.
No rate limit applies to /api (only to /api/v1). Poll live values no faster than every 1–2 seconds and prefer one bulk call over one call per tag.

Auth endpoints

Method	Path	Purpose
POST	/api/auth/login	`{ email, password }` → `{ user, tokens }`, or `{ mfaRequired, challenge }`
POST	/api/auth/mfa/verify	`{ challenge, code }` → `{ user, tokens }`
POST	/api/auth/refresh	`{ refreshToken }` → `{ token, refreshToken }`
POST	/api/auth/logout	Record the sign-out (tokens stay valid until they expire)
GET	/api/auth/me	The signed-in user, including `authProvider` (`local` or the directory that owns the password)
POST	/api/auth/password	`{ currentPassword, newPassword }` → `{ tokens }`. Change your own password (at least 8 characters). Signs out your other sessions; use the returned tokens for this one. Wrong current passwords count toward the sign-in lockout. Refused for accounts from an external directory
GET	/api/auth/permissions	The signed-in user's feature and resource permissions
GET	/api/auth/console	`{ localConsole }` — is this browser the appliance's own screen?
POST	/api/auth/mfa/console-reset	Clear two-factor for an account — only from the attached screen, needs the password

Public Data API (read-only live values)

A simple, read-only feed of every live tag value for tools that cannot sign in — Grafana's JSON data source, Excel's From Web, a PLC-floor display.

Go to System → Settings and find the Data API card.
Turn on Enable Public Data API. The JSON endpoint and XML endpoint URLs appear with copy buttons.
Optionally turn on Require Authentication.

Method	Path	Purpose
GET	/api/data/tags.json	Live values of every enabled device, grouped by device
GET	/api/data/tags.xml	The same as XML
GET	/api/data/history.json	Historical values — enabled separately under Historian API; see Historian API

json

{
  "timestamp": "2026-09-15T06:02:11.412Z",
  "devices": [
    { "id": 3, "name": "Press 4", "driver": "modbus",
      "tags": [
        { "path": "HR100", "displayName": "Die Temp", "value": "182.4", "dataType": "float", "quality": "good", "timestamp": "2026-09-15T06:02:10.998Z" }
      ] }
  ]
}

Behavior to know:

When the API is off, both URLs answer 404 with Public data API is not enabled.
Require Authentication accepts a user JWT from /api/auth/login, as Authorization: Bearer or ?token=. It does not accept API tokens (sk_scadaink_…), and the JWT expires after the Session Timeout (60 minutes by default) — so a dashboard that stores a token in its URL soon stops working. For an unattended consumer on a trusted network, leave authentication off; otherwise have the consumer sign in and refresh.
Only enabled devices that currently have live values appear. A disconnected device with no cached values is omitted rather than listed empty.
The response does not use the { success, data } envelope.

Troubleshooting

Symptom	Cause	Fix
`401 No token provided`	Missing `Authorization` header, or `Bearer` misspelled	Send `Authorization: Bearer <token>`
`401 Invalid or expired token` after a while	Access token expired (Session Timeout, 60 minutes by default)	Call `/api/auth/refresh` before it expires, or sign in again
`401 Your session has ended. Sign in again.` (`code: SESSION_REVOKED`)	The session was signed out, or the account's password was changed	Sign in again and store the new token
`401 Invalid refresh token`	Refresh token expired (Session Timeout), revoked, or from another appliance	Sign in again
`401 Invalid email or password`	Wrong credentials, or a directory account using a local-only path	Check the account in Users
`403 Insufficient permissions`	The user's role is below the endpoint's minimum	Use an account with a higher role — the change reaches an already-issued token on its next request, no new sign-in needed
`403 This account has been disabled.`	The user was disabled	Re-enable it in Users
`403 Feature "…" is not enabled`	Licensed feature missing or switched off	Check the license and feature switches (see System Settings)
`403 Write access is not enabled for this device. Enable it in device settings.`	Device-level write switch is off	Turn on write access for the device — see Writing Tag Values
`500` with `request entity too large`	JSON body over 100 KB	Send smaller batches (the Configuration API import is affected too — see its troubleshooting)
HTML instead of JSON	You called the web server's page route (for example missing `/api`) or a proxy error page	Check the URL; `/api/…` always answers JSON
`503 InfluxDB is not available`	Historian database stopped	See Historian Storage

Complete endpoint list

The list below is generated from the API's route files, so it is always complete for this version. It shows method and path only — the role each needs and the body it takes are described in the article for that feature: Tag API, Historian API, Data Tables access, OEE, Work Orders, Alarms.

Every endpoint

All 738 endpoints mounted by the appliance API, generated from its route files.

/api/admin (37)

Method	Path
GET	`/api/admin/api-tokens`
POST	`/api/admin/api-tokens`
DELETE	`/api/admin/api-tokens/:id`
GET	`/api/admin/audit/activity`
GET	`/api/admin/audit/errors`
GET	`/api/admin/backup/export`
POST	`/api/admin/backup/import`
GET	`/api/admin/backup/info`
GET	`/api/admin/backup/schedule`
PUT	`/api/admin/backup/schedule`
GET	`/api/admin/backup/schedule/files/:filename`
POST	`/api/admin/backup/schedule/run`
GET	`/api/admin/config`
PUT	`/api/admin/config`
POST	`/api/admin/config/smtp-test`
POST	`/api/admin/db/factory-reset`
GET	`/api/admin/db/health`
POST	`/api/admin/db/reset-group/:id`
GET	`/api/admin/db/reset-groups`
POST	`/api/admin/partial-export`
POST	`/api/admin/partial-export/import`
POST	`/api/admin/partial-export/preview`
GET	`/api/admin/partial-export/schema`
GET	`/api/admin/permissions/:type/:id`
PUT	`/api/admin/permissions/:type/:id`
GET	`/api/admin/security`
PUT	`/api/admin/security`
GET	`/api/admin/system-info`
GET	`/api/admin/users`
POST	`/api/admin/users`
DELETE	`/api/admin/users/:id`
PUT	`/api/admin/users/:id`
GET	`/api/admin/users/:id/features`
PUT	`/api/admin/users/:id/features`
POST	`/api/admin/users/:id/mfa/reset`
PUT	`/api/admin/users/:id/password`
GET	`/api/admin/users/:id/resource-access`

/api/admin/software-update (5)

Method	Path
POST	`/api/admin/software-update/apply`
POST	`/api/admin/software-update/rollback`
DELETE	`/api/admin/software-update/staged`
GET	`/api/admin/software-update/status`
POST	`/api/admin/software-update/upload`

/api/alarm-pipelines (8)

Method	Path
GET	`/api/alarm-pipelines`
POST	`/api/alarm-pipelines`
DELETE	`/api/alarm-pipelines/:id`
GET	`/api/alarm-pipelines/:id`
PUT	`/api/alarm-pipelines/:id`
POST	`/api/alarm-pipelines/:id/assign`
DELETE	`/api/alarm-pipelines/:id/assign/:ruleId`
GET	`/api/alarm-pipelines/log/recent`

/api/alarms (13)

Method	Path
PUT	`/api/alarms/:id/acknowledge`
POST	`/api/alarms/acknowledge`
GET	`/api/alarms/active`
GET	`/api/alarms/history`
GET	`/api/alarms/history/export`
GET	`/api/alarms/metrics`
GET	`/api/alarms/rules`
POST	`/api/alarms/rules`
DELETE	`/api/alarms/rules/:id`
PUT	`/api/alarms/rules/:id`
GET	`/api/alarms/shelves`
POST	`/api/alarms/shelves`
DELETE	`/api/alarms/shelves/:id`

/api/andon (6)

Method	Path
GET	`/api/andon/configs`
POST	`/api/andon/configs`
DELETE	`/api/andon/configs/:id`
GET	`/api/andon/configs/:id`
PUT	`/api/andon/configs/:id`
GET	`/api/andon/display/:id`

/api/appliance (28)

Method	Path
GET	`/api/appliance/interface-names`
GET	`/api/appliance/network`
PUT	`/api/appliance/network/:ifname/ip`
PUT	`/api/appliance/network/:ifname/name`
GET	`/api/appliance/network/:ifname/wifi`
POST	`/api/appliance/network/:ifname/wifi`
POST	`/api/appliance/network/confirm`
GET	`/api/appliance/system`
GET	`/api/appliance/system/datastores`
PUT	`/api/appliance/system/hostname`
GET	`/api/appliance/system/ntp`
PUT	`/api/appliance/system/ntp`
POST	`/api/appliance/system/power`
GET	`/api/appliance/system/requirements`
POST	`/api/appliance/system/requirements/recheck`
POST	`/api/appliance/system/service/:service/restart`
PUT	`/api/appliance/system/time`
GET	`/api/appliance/system/timezones`
GET	`/api/appliance/tls`
GET	`/api/appliance/tls/acme`
PUT	`/api/appliance/tls/acme`
POST	`/api/appliance/tls/acme/issue`
POST	`/api/appliance/tls/confirm`
GET	`/api/appliance/tls/csr`
POST	`/api/appliance/tls/csr`
POST	`/api/appliance/tls/regenerate`
POST	`/api/appliance/tls/revert`
POST	`/api/appliance/tls/upload`

/api/audit-chain (4)

Method	Path
GET	`/api/audit-chain/checkpoints`
POST	`/api/audit-chain/checkpoints`
GET	`/api/audit-chain/checkpoints/:id/archive`
GET	`/api/audit-chain/verify`

/api/auth (17)

Method	Path
GET	`/api/auth/console`
POST	`/api/auth/login`
POST	`/api/auth/logout`
POST	`/api/auth/logout-all`
GET	`/api/auth/me`
POST	`/api/auth/mfa/backup-codes`
POST	`/api/auth/mfa/confirm`
POST	`/api/auth/mfa/console-reset`
POST	`/api/auth/mfa/disable`
POST	`/api/auth/mfa/enroll`
GET	`/api/auth/mfa/status`
POST	`/api/auth/mfa/verify`
POST	`/api/auth/password`
GET	`/api/auth/password-policy`
POST	`/api/auth/password/expired`
GET	`/api/auth/permissions`
POST	`/api/auth/refresh`

/api/change-trace (2)

Method	Path
POST	`/api/change-trace/analyze`
GET	`/api/change-trace/tags`

/api/cloud-health (4)

Method	Path
GET	`/api/cloud-health`
PUT	`/api/cloud-health`
PUT	`/api/cloud-health/cloud-url`
POST	`/api/cloud-health/send-now`

/api/connectors (9)

Method	Path
GET	`/api/connectors`
POST	`/api/connectors`
DELETE	`/api/connectors/:id`
GET	`/api/connectors/:id`
PUT	`/api/connectors/:id`
POST	`/api/connectors/:id/clear-queue`
POST	`/api/connectors/:id/send-test`
GET	`/api/connectors/targets`
POST	`/api/connectors/test`

/api/contact (1)

Method	Path
POST	`/api/contact`

/api/custom-pages (12)

Method	Path
GET	`/api/custom-pages`
POST	`/api/custom-pages`
DELETE	`/api/custom-pages/:id`
GET	`/api/custom-pages/:id`
PUT	`/api/custom-pages/:id`
PUT	`/api/custom-pages/:id/preview-draft`
GET	`/api/custom-pages/:id/render`
POST	`/api/custom-pages/:id/render-ticket`
GET	`/api/custom-pages/by-slug/:slug`
PUT	`/api/custom-pages/folder`
GET	`/api/custom-pages/templates/catalog`
POST	`/api/custom-pages/templates/generate`

/api/custom-tables (18)

Method	Path
GET	`/api/custom-tables`
POST	`/api/custom-tables`
DELETE	`/api/custom-tables/:id`
GET	`/api/custom-tables/:id`
PUT	`/api/custom-tables/:id`
GET	`/api/custom-tables/:id/columns`
POST	`/api/custom-tables/:id/columns`
DELETE	`/api/custom-tables/:id/columns/:colId`
GET	`/api/custom-tables/:id/data`
POST	`/api/custom-tables/:id/data`
DELETE	`/api/custom-tables/:id/data/:rowId`
PUT	`/api/custom-tables/:id/data/:rowId`
GET	`/api/custom-tables/by-name/:name`
GET	`/api/custom-tables/by-name/:name/data`
POST	`/api/custom-tables/by-name/:name/data`
DELETE	`/api/custom-tables/by-name/:name/data/:rowId`
PUT	`/api/custom-tables/by-name/:name/data/:rowId`
POST	`/api/custom-tables/query`

/api/dashboards (13)

Method	Path
GET	`/api/dashboards`
POST	`/api/dashboards`
DELETE	`/api/dashboards/:id`
GET	`/api/dashboards/:id`
PUT	`/api/dashboards/:id`
POST	`/api/dashboards/:id/duplicate`
POST	`/api/dashboards/:id/widget-query`
POST	`/api/dashboards/auto-generate`
PUT	`/api/dashboards/folder`
GET	`/api/dashboards/public/:slug`
GET	`/api/dashboards/public/:slug/resources`
POST	`/api/dashboards/public/:slug/widget-query`
POST	`/api/dashboards/query`

/api/data (3)

Method	Path
GET	`/api/data/history.json`
GET	`/api/data/tags.json`
GET	`/api/data/tags.xml`

/api/data-infra (28)

Method	Path
GET	`/api/data-infra/outbound-api`
POST	`/api/data-infra/outbound-api`
DELETE	`/api/data-infra/outbound-api/:id`
GET	`/api/data-infra/outbound-api/:id`
PUT	`/api/data-infra/outbound-api/:id`
POST	`/api/data-infra/outbound-api/:id/test`
GET	`/api/data-infra/remote-db-forward/entries`
POST	`/api/data-infra/remote-db-forward/purge`
POST	`/api/data-infra/remote-db-forward/retry-failed`
GET	`/api/data-infra/remote-db-forward/stats`
GET	`/api/data-infra/sf-tags/influx`
PUT	`/api/data-infra/sf-tags/influx`
GET	`/api/data-infra/sf-tags/remotedb/:connectionId`
PUT	`/api/data-infra/sf-tags/remotedb/:connectionId`
POST	`/api/data-infra/store-forward/purge`
GET	`/api/data-infra/store-forward/quarantine`
POST	`/api/data-infra/store-forward/quarantine/discard`
POST	`/api/data-infra/store-forward/quarantine/retry`
POST	`/api/data-infra/store-forward/retry-failed`
GET	`/api/data-infra/store-forward/settings`
PUT	`/api/data-infra/store-forward/settings`
GET	`/api/data-infra/store-forward/stats`
GET	`/api/data-infra/transaction-groups`
POST	`/api/data-infra/transaction-groups`
DELETE	`/api/data-infra/transaction-groups/:id`
GET	`/api/data-infra/transaction-groups/:id`
PUT	`/api/data-infra/transaction-groups/:id`
POST	`/api/data-infra/transaction-groups/:id/execute`

/api/devices (16)

Method	Path
GET	`/api/devices`
POST	`/api/devices`
DELETE	`/api/devices/:id`
GET	`/api/devices/:id`
PUT	`/api/devices/:id`
POST	`/api/devices/:id/connect`
POST	`/api/devices/:id/disconnect`
GET	`/api/devices/:id/info`
POST	`/api/devices/demo`
GET	`/api/devices/serial/ports`
GET	`/api/devices/serial/sniff/poll`
POST	`/api/devices/serial/sniff/start`
POST	`/api/devices/serial/sniff/stop`
POST	`/api/devices/simulator`
GET	`/api/devices/status/all`
GET	`/api/devices/status/summary`

/api/downtime (10)

Method	Path
GET	`/api/downtime/events`
POST	`/api/downtime/events`
DELETE	`/api/downtime/events/:id`
PUT	`/api/downtime/events/:id`
GET	`/api/downtime/events/active`
GET	`/api/downtime/pareto`
GET	`/api/downtime/reasons`
POST	`/api/downtime/reasons`
DELETE	`/api/downtime/reasons/:id`
PUT	`/api/downtime/reasons/:id`

/api/driver-health (4)

Method	Path
GET	`/api/driver-health`
GET	`/api/driver-health/:id/log`
GET	`/api/driver-health/:id/stats`
GET	`/api/driver-health/stats`

/api/esign (6)

Method	Path
GET	`/api/esign/options`
PUT	`/api/esign/options`
GET	`/api/esign/records`
GET	`/api/esign/records/:id`
GET	`/api/esign/settings`
PUT	`/api/esign/settings`

/api/event-streams (11)

Method	Path
GET	`/api/event-streams`
POST	`/api/event-streams`
DELETE	`/api/event-streams/:id`
GET	`/api/event-streams/:id`
PUT	`/api/event-streams/:id`
GET	`/api/event-streams/:id/dead-letters`
POST	`/api/event-streams/:id/dead-letters/delete`
POST	`/api/event-streams/:id/dead-letters/replay`
POST	`/api/event-streams/:id/enabled`
POST	`/api/event-streams/:id/http-key`
POST	`/api/event-streams/test`

/api/event-streams/ingest (1)

Method	Path
POST	`/api/event-streams/ingest/:id`

/api/expression-tags (6)

Method	Path
GET	`/api/expression-tags`
POST	`/api/expression-tags`
DELETE	`/api/expression-tags/:id`
GET	`/api/expression-tags/:id`
PUT	`/api/expression-tags/:id`
POST	`/api/expression-tags/test`

/api/features (5)

Method	Path
GET	`/api/features`
PUT	`/api/features/:flag/toggle`
DELETE	`/api/features/license`
POST	`/api/features/license`
DELETE	`/api/features/license/trials/:licenseId`

/api/files (10)

Method	Path
DELETE	`/api/files/:fileId`
GET	`/api/files/folders`
POST	`/api/files/folders`
DELETE	`/api/files/folders/:id`
GET	`/api/files/folders/:id`
PUT	`/api/files/folders/:id`
GET	`/api/files/list`
GET	`/api/files/serve/{*path}`
GET	`/api/files/storage`
POST	`/api/files/upload`

/api/fleet (18)

Method	Path
GET	`/api/fleet/agents`
POST	`/api/fleet/agents/:peerId/backup`
POST	`/api/fleet/agents/:peerId/install`
POST	`/api/fleet/agents/:peerId/rollback`
POST	`/api/fleet/agents/:peerId/stage`
POST	`/api/fleet/agents/refresh`
GET	`/api/fleet/backups`
DELETE	`/api/fleet/backups/:id`
GET	`/api/fleet/backups/:id/download`
POST	`/api/fleet/config/apply`
POST	`/api/fleet/config/preview`
GET	`/api/fleet/jobs`
GET	`/api/fleet/packages`
POST	`/api/fleet/packages`
DELETE	`/api/fleet/packages/:id`
POST	`/api/fleet/rollout`
PUT	`/api/fleet/settings`
GET	`/api/fleet/status`

/api/forms (1)

Method	Path
POST	`/api/forms/submit`

/api/historian (14)

Method	Path
GET	`/api/historian/backend-status`
GET	`/api/historian/export`
GET	`/api/historian/query`
GET	`/api/historian/retention`
PUT	`/api/historian/retention`
POST	`/api/historian/rollups/run`
GET	`/api/historian/rollups/status`
GET	`/api/historian/settings`
PUT	`/api/historian/settings`
POST	`/api/historian/sql/ensure-schema`
POST	`/api/historian/sql/flush`
POST	`/api/historian/sql/prune`
GET	`/api/historian/status`
GET	`/api/historian/tags`

/api/labor-efficiency (12)

Method	Path
GET	`/api/labor-efficiency/entries`
DELETE	`/api/labor-efficiency/entries/:id`
PUT	`/api/labor-efficiency/entries/:id`
POST	`/api/labor-efficiency/entries/:id/clock-out`
GET	`/api/labor-efficiency/entries/active`
POST	`/api/labor-efficiency/entries/clock-in`
GET	`/api/labor-efficiency/operators`
GET	`/api/labor-efficiency/report`
GET	`/api/labor-efficiency/standards`
POST	`/api/labor-efficiency/standards`
DELETE	`/api/labor-efficiency/standards/:id`
PUT	`/api/labor-efficiency/standards/:id`

/api/ladder (22)

Method	Path
DELETE	`/api/ladder/programs/:id`
PUT	`/api/ladder/programs/:id`
POST	`/api/ladder/programs/:programId/routines`
DELETE	`/api/ladder/routines/:id`
GET	`/api/ladder/routines/:id`
PUT	`/api/ladder/routines/:id`
POST	`/api/ladder/routines/:id/reset-chart`
GET	`/api/ladder/status`
GET	`/api/ladder/tasks`
POST	`/api/ladder/tasks`
DELETE	`/api/ladder/tasks/:id`
GET	`/api/ladder/tasks/:id`
PUT	`/api/ladder/tasks/:id`
DELETE	`/api/ladder/tasks/:id/forces`
GET	`/api/ladder/tasks/:id/forces`
POST	`/api/ladder/tasks/:id/forces`
DELETE	`/api/ladder/tasks/:id/forces/:forceId`
GET	`/api/ladder/tasks/:id/log`
POST	`/api/ladder/tasks/:id/start`
GET	`/api/ladder/tasks/:id/status`
POST	`/api/ladder/tasks/:id/stop`
POST	`/api/ladder/tasks/:taskId/programs`

/api/local-tags (5)

Method	Path
GET	`/api/local-tags`
POST	`/api/local-tags`
DELETE	`/api/local-tags/:id`
PUT	`/api/local-tags/:id`
POST	`/api/local-tags/write`

/api/logs (2)

Method	Path
GET	`/api/logs`
GET	`/api/logs/available`

/api/named-queries (7)

Method	Path
GET	`/api/named-queries`
POST	`/api/named-queries`
DELETE	`/api/named-queries/:id`
GET	`/api/named-queries/:id`
PUT	`/api/named-queries/:id`
POST	`/api/named-queries/:id/invalidate`
POST	`/api/named-queries/:idOrName/execute`

/api/nav-bars (7)

Method	Path
GET	`/api/nav-bars`
POST	`/api/nav-bars`
DELETE	`/api/nav-bars/:id`
GET	`/api/nav-bars/:id`
PUT	`/api/nav-bars/:id`
PUT	`/api/nav-bars/:id/items`
GET	`/api/nav-bars/:id/resolved`

/api/notifications (17)

Method	Path
GET	`/api/notifications/inbound`
POST	`/api/notifications/inbound`
GET	`/api/notifications/people`
GET	`/api/notifications/rule-log`
GET	`/api/notifications/schedules`
POST	`/api/notifications/schedules`
DELETE	`/api/notifications/schedules/:id`
GET	`/api/notifications/schedules/:id`
PUT	`/api/notifications/schedules/:id`
GET	`/api/notifications/settings`
PUT	`/api/notifications/settings`
DELETE	`/api/notifications/settings/inbound-token`
POST	`/api/notifications/settings/inbound-token`
GET	`/api/notifications/sms`
POST	`/api/notifications/sms/:id/cancel`
POST	`/api/notifications/sms/:id/retry`
POST	`/api/notifications/sms/test`

/api/oee (8)

Method	Path
GET	`/api/oee/configs`
POST	`/api/oee/configs`
DELETE	`/api/oee/configs/:deviceId`
GET	`/api/oee/configs/:deviceId`
GET	`/api/oee/history`
GET	`/api/oee/realtime`
GET	`/api/oee/realtime/:deviceId`
POST	`/api/oee/snapshot`

/api/onboarding (3)

Method	Path
GET	`/api/onboarding`
POST	`/api/onboarding/complete`
POST	`/api/onboarding/reset`

/api/opcua (6)

Method	Path
GET	`/api/opcua/certificates`
DELETE	`/api/opcua/certificates/:thumbprint`
POST	`/api/opcua/certificates/:thumbprint/trust`
POST	`/api/opcua/certificates/:thumbprint/untrust`
GET	`/api/opcua/settings`
PUT	`/api/opcua/settings`

/api/overview (1)

Method	Path
GET	`/api/overview/production`

/api/page-files (4)

Method	Path
GET	`/api/page-files/:pageId`
DELETE	`/api/page-files/:pageId/:fileId`
POST	`/api/page-files/:pageId/upload`
GET	`/api/page-files/serve/:pageId/:name`

/api/pen-sets (4)

Method	Path
GET	`/api/pen-sets`
POST	`/api/pen-sets`
DELETE	`/api/pen-sets/:id`
PUT	`/api/pen-sets/:id`

/api/python-packages (4)

Method	Path
GET	`/api/python-packages`
DELETE	`/api/python-packages/:name`
POST	`/api/python-packages/pypi`
POST	`/api/python-packages/upload`

/api/quality (9)

Method	Path
GET	`/api/quality/events`
POST	`/api/quality/events`
DELETE	`/api/quality/events/:id`
PUT	`/api/quality/events/:id`
GET	`/api/quality/reasons`
POST	`/api/quality/reasons`
DELETE	`/api/quality/reasons/:id`
PUT	`/api/quality/reasons/:id`
GET	`/api/quality/summary`

/api/recipes (13)

Method	Path
GET	`/api/recipes`
POST	`/api/recipes`
DELETE	`/api/recipes/:id`
GET	`/api/recipes/:id`
PUT	`/api/recipes/:id`
POST	`/api/recipes/:id/apply`
GET	`/api/recipes/:id/versions`
POST	`/api/recipes/:id/versions/:version/restore`
GET	`/api/recipes/by-part/:partNumber`
GET	`/api/recipes/history`
GET	`/api/recipes/part-selectors`
POST	`/api/recipes/part-selectors`
DELETE	`/api/recipes/part-selectors/:deviceId`

/api/redundancy (4)

Method	Path
PUT	`/api/redundancy/config`
POST	`/api/redundancy/probe`
GET	`/api/redundancy/status`
POST	`/api/redundancy/switchover`

/api/remote-db (19)

Method	Path
GET	`/api/remote-db/connections`
POST	`/api/remote-db/connections`
DELETE	`/api/remote-db/connections/:id`
GET	`/api/remote-db/connections/:id`
PUT	`/api/remote-db/connections/:id`
GET	`/api/remote-db/connections/:id/columns`
POST	`/api/remote-db/connections/:id/include`
GET	`/api/remote-db/connections/:id/tables`
POST	`/api/remote-db/connections/:id/test`
POST	`/api/remote-db/connections/test`
POST	`/api/remote-db/query`
GET	`/api/remote-db/tables`
DELETE	`/api/remote-db/tables/:tableId`
PUT	`/api/remote-db/tables/:tableId`
GET	`/api/remote-db/tables/:tableId/data`
POST	`/api/remote-db/tables/:tableId/data`
DELETE	`/api/remote-db/tables/:tableId/data/:rowId`
PUT	`/api/remote-db/tables/:tableId/data/:rowId`
POST	`/api/remote-db/tables/:tableId/refresh`

/api/reports (16)

Method	Path
POST	`/api/reports/:id/generate`
GET	`/api/reports/:id/render-data`
GET	`/api/reports/download/:historyId`
POST	`/api/reports/download/:historyId/ticket`
GET	`/api/reports/file/:ticket`
GET	`/api/reports/history`
GET	`/api/reports/schedules`
POST	`/api/reports/schedules`
DELETE	`/api/reports/schedules/:id`
PUT	`/api/reports/schedules/:id`
POST	`/api/reports/schedules/:id/run`
GET	`/api/reports/templates`
POST	`/api/reports/templates`
DELETE	`/api/reports/templates/:id`
GET	`/api/reports/templates/:id`
PUT	`/api/reports/templates/:id`

/api/resource-access (2)

Method	Path
GET	`/api/resource-access/:type/:id`
PUT	`/api/resource-access/:type/:id/operator-run`

/api/retention (4)

Method	Path
GET	`/api/retention`
PUT	`/api/retention`
PUT	`/api/retention/influx`
POST	`/api/retention/prune`

/api/scan-classes (7)

Method	Path
GET	`/api/scan-classes`
POST	`/api/scan-classes`
DELETE	`/api/scan-classes/:id`
GET	`/api/scan-classes/:id`
PUT	`/api/scan-classes/:id`
GET	`/api/scan-classes/effective`
POST	`/api/scan-classes/test-condition`

/api/scanner (7)

Method	Path
POST	`/api/scanner/adopt/:id`
GET	`/api/scanner/jobs`
GET	`/api/scanner/results`
DELETE	`/api/scanner/results/:jobId`
POST	`/api/scanner/start`
GET	`/api/scanner/status`
POST	`/api/scanner/stop`

/api/schedules (6)

Method	Path
GET	`/api/schedules`
POST	`/api/schedules`
DELETE	`/api/schedules/:id`
PUT	`/api/schedules/:id`
POST	`/api/schedules/:id/run`
GET	`/api/schedules/targets`

/api/script-libraries (6)

Method	Path
GET	`/api/script-libraries`
POST	`/api/script-libraries`
DELETE	`/api/script-libraries/:id`
GET	`/api/script-libraries/:id`
PUT	`/api/script-libraries/:id`
POST	`/api/script-libraries/:id/test`

/api/scripts (16)

Method	Path
GET	`/api/scripts`
POST	`/api/scripts`
DELETE	`/api/scripts/:id`
GET	`/api/scripts/:id`
PUT	`/api/scripts/:id`
PUT	`/api/scripts/:id/enable`
POST	`/api/scripts/:id/execute`
DELETE	`/api/scripts/:id/executions`
GET	`/api/scripts/:id/executions`
GET	`/api/scripts/:id/executions/stats`
PUT	`/api/scripts/:id/network`
GET	`/api/scripts/:id/versions`
GET	`/api/scripts/:id/versions/:versionId`
POST	`/api/scripts/:id/versions/:versionId/restore`
GET	`/api/scripts/autocomplete/tags`
POST	`/api/scripts/check`

/api/secrets (3)

Method	Path
GET	`/api/secrets`
POST	`/api/secrets`
DELETE	`/api/secrets/:id`

/api/security-levels (9)

Method	Path
GET	`/api/security-levels`
POST	`/api/security-levels`
DELETE	`/api/security-levels/:id`
PUT	`/api/security-levels/:id`
GET	`/api/security-levels/me`
GET	`/api/security-levels/tags/:tagId`
PUT	`/api/security-levels/tags/:tagId`
GET	`/api/security-levels/users/:userId`
PUT	`/api/security-levels/users/:userId`

/api/settings (9)

Method	Path
GET	`/api/settings`
PUT	`/api/settings`
GET	`/api/settings/cloud`
GET	`/api/settings/kiosk`
GET	`/api/settings/locale`
PUT	`/api/settings/locale`
GET	`/api/settings/locale/default`
GET	`/api/settings/nav`
GET	`/api/settings/site`

/api/shifts (9)

Method	Path
GET	`/api/shifts`
POST	`/api/shifts`
DELETE	`/api/shifts/:id`
GET	`/api/shifts/:id`
PUT	`/api/shifts/:id`
POST	`/api/shifts/calendar`
DELETE	`/api/shifts/calendar/:id`
GET	`/api/shifts/calendar/entries`
GET	`/api/shifts/current`

/api/simulation (9)

Method	Path
POST	`/api/simulation/:deviceId/import/:sourceDeviceId`
POST	`/api/simulation/:deviceId/start`
GET	`/api/simulation/:deviceId/status`
POST	`/api/simulation/:deviceId/stop`
GET	`/api/simulation/:deviceId/tags`
POST	`/api/simulation/:deviceId/tags`
DELETE	`/api/simulation/:deviceId/tags/:tagSubId`
PUT	`/api/simulation/:deviceId/tags/:tagSubId`
POST	`/api/simulation/:deviceId/tags/bulk`

/api/smart-assist (12)

Method	Path
POST	`/api/smart-assist/confirm`
GET	`/api/smart-assist/observations`
POST	`/api/smart-assist/observations`
GET	`/api/smart-assist/observations/:id`
POST	`/api/smart-assist/observations/:id/analyze`
GET	`/api/smart-assist/observations/:id/analyze-request`
POST	`/api/smart-assist/observations/:id/analyze-result`
POST	`/api/smart-assist/observations/:id/apply`
POST	`/api/smart-assist/observations/:id/cancel`
POST	`/api/smart-assist/observations/:id/stop`
POST	`/api/smart-assist/scan`
GET	`/api/smart-assist/scan/:scanId`

/api/sparkplug (11)

Method	Path
GET	`/api/sparkplug/connections`
POST	`/api/sparkplug/connections`
DELETE	`/api/sparkplug/connections/:id`
GET	`/api/sparkplug/connections/:id`
PUT	`/api/sparkplug/connections/:id`
POST	`/api/sparkplug/connections/:id/connect`
GET	`/api/sparkplug/connections/:id/devices`
POST	`/api/sparkplug/connections/:id/devices`
POST	`/api/sparkplug/connections/:id/disconnect`
DELETE	`/api/sparkplug/device-map/:id`
PUT	`/api/sparkplug/device-map/:id`

/api/spc (14)

Method	Path
GET	`/api/spc/charts/:chartId/cpk-trend`
GET	`/api/spc/charts/:chartId/data`
POST	`/api/spc/charts/:chartId/data`
GET	`/api/spc/charts/:chartId/stats`
GET	`/api/spc/charts/:chartId/xbar-r`
DELETE	`/api/spc/charts/:id`
PUT	`/api/spc/charts/:id`
POST	`/api/spc/charts/:id/recalculate-limits`
GET	`/api/spc/groups`
POST	`/api/spc/groups`
GET	`/api/spc/groups/:groupId/charts`
POST	`/api/spc/groups/:groupId/charts`
DELETE	`/api/spc/groups/:id`
PUT	`/api/spc/groups/:id`

/api/style-classes (6)

Method	Path
GET	`/api/style-classes`
POST	`/api/style-classes`
DELETE	`/api/style-classes/:id`
GET	`/api/style-classes/:id`
PUT	`/api/style-classes/:id`
GET	`/api/style-classes/:id/usage`

/api/symbols (8)

Method	Path
GET	`/api/symbols`
POST	`/api/symbols`
DELETE	`/api/symbols/:id`
GET	`/api/symbols/:id`
PUT	`/api/symbols/:id`
GET	`/api/symbols/:id/usage`
GET	`/api/symbols/categories`
POST	`/api/symbols/import-svg`

/api/tag-locator (3)

Method	Path
POST	`/api/tag-locator/:deviceId/start`
GET	`/api/tag-locator/:deviceId/status`
POST	`/api/tag-locator/:deviceId/stop`

/api/tag-udts (13)

Method	Path
GET	`/api/tag-udts`
POST	`/api/tag-udts`
DELETE	`/api/tag-udts/:id`
GET	`/api/tag-udts/:id`
PUT	`/api/tag-udts/:id`
POST	`/api/tag-udts/:id/instances`
POST	`/api/tag-udts/:id/instances/bulk`
POST	`/api/tag-udts/:id/plan`
DELETE	`/api/tag-udts/instances/:instanceId`
GET	`/api/tag-udts/instances/:instanceId`
PUT	`/api/tag-udts/instances/:instanceId`
PUT	`/api/tag-udts/instances/:instanceId/opcua`
GET	`/api/tag-udts/instances/all`

/api/tags (19)

Method	Path
GET	`/api/tags/browse-all`
GET	`/api/tags/browse/:deviceId`
GET	`/api/tags/export.csv`
GET	`/api/tags/history/:deviceId`
POST	`/api/tags/import`
GET	`/api/tags/live/:deviceId`
GET	`/api/tags/recommended/:deviceId`
DELETE	`/api/tags/simulate/:deviceId`
POST	`/api/tags/simulate/:deviceId`
POST	`/api/tags/subscribe`
GET	`/api/tags/subscriptions`
GET	`/api/tags/subscriptions/:deviceId`
PUT	`/api/tags/subscriptions/:id`
PUT	`/api/tags/subscriptions/:id/deadband`
PUT	`/api/tags/subscriptions/:id/history`
PUT	`/api/tags/subscriptions/:id/scaling`
POST	`/api/tags/unsubscribe`
GET	`/api/tags/where-used`
POST	`/api/tags/write`

/api/templates (8)

Method	Path
GET	`/api/templates`
POST	`/api/templates`
DELETE	`/api/templates/:id`
GET	`/api/templates/:id`
PUT	`/api/templates/:id`
POST	`/api/templates/:id/duplicate`
GET	`/api/templates/:id/usage`
GET	`/api/templates/repeat/instances`

/api/tv (2)

Method	Path
GET	`/api/tv/allowed`
GET	`/api/tv/data`

/api/tv-displays (6)

Method	Path
GET	`/api/tv-displays`
POST	`/api/tv-displays`
DELETE	`/api/tv-displays/:id`
GET	`/api/tv-displays/:id`
PUT	`/api/tv-displays/:id`
GET	`/api/tv-displays/:slug/resolved`

/api/user-groups (5)

Method	Path
GET	`/api/user-groups`
POST	`/api/user-groups`
DELETE	`/api/user-groups/:id`
GET	`/api/user-groups/:id`
PUT	`/api/user-groups/:id`

/api/v1 (8)

Method	Path
POST	`/api/v1/config/export`
POST	`/api/v1/config/import`
POST	`/api/v1/config/preview`
GET	`/api/v1/config/schema`
GET	`/api/v1/devices/:id`
GET	`/api/v1/devices/:id/status`
GET	`/api/v1/openapi.json`
GET	`/api/v1/tags`

/api/v1/mesh (15)

Method	Path
GET	`/api/v1/mesh/alarms`
GET	`/api/v1/mesh/discovered`
GET	`/api/v1/mesh/node`
PUT	`/api/v1/mesh/node`
DELETE	`/api/v1/mesh/pair/allow`
POST	`/api/v1/mesh/pair/allow`
POST	`/api/v1/mesh/pair/complete`
POST	`/api/v1/mesh/pair/start`
GET	`/api/v1/mesh/peers`
DELETE	`/api/v1/mesh/peers/:id`
POST	`/api/v1/mesh/peers/:id/reconnect`
PUT	`/api/v1/mesh/peers/:id/settings`
GET	`/api/v1/mesh/public/:slug/peers`
GET	`/api/v1/mesh/summary`
POST	`/api/v1/mesh/unpair`

/api/vision (17)

Method	Path
DELETE	`/api/vision/:deviceId/captures`
GET	`/api/vision/:deviceId/captures`
GET	`/api/vision/:deviceId/captures/:name`
GET	`/api/vision/:deviceId/config`
PUT	`/api/vision/:deviceId/config`
POST	`/api/vision/:deviceId/coordinates/calibrate`
POST	`/api/vision/:deviceId/coordinates/robot`
POST	`/api/vision/:deviceId/coordinates/target`
POST	`/api/vision/:deviceId/preview`
GET	`/api/vision/:deviceId/sequence`
POST	`/api/vision/:deviceId/sequence/run`
GET	`/api/vision/:deviceId/spc`
POST	`/api/vision/:deviceId/spc`
GET	`/api/vision/:deviceId/stats`
POST	`/api/vision/:deviceId/teach`
POST	`/api/vision/:deviceId/teach-text`
POST	`/api/vision/:deviceId/test-image`

/api/work-instructions (8)

Method	Path
GET	`/api/work-instructions`
POST	`/api/work-instructions`
DELETE	`/api/work-instructions/:id`
GET	`/api/work-instructions/:id`
PUT	`/api/work-instructions/:id`
GET	`/api/work-instructions/:id/signoffs`
POST	`/api/work-instructions/:id/signoffs`
DELETE	`/api/work-instructions/signoffs/:signoffId`

/api/work-orders (14)

Method	Path
GET	`/api/work-orders`
POST	`/api/work-orders`
DELETE	`/api/work-orders/:id`
GET	`/api/work-orders/:id`
PUT	`/api/work-orders/:id`
POST	`/api/work-orders/:id/activate`
POST	`/api/work-orders/:id/cancel`
POST	`/api/work-orders/:id/complete`
PUT	`/api/work-orders/:id/counts`
POST	`/api/work-orders/:id/counts/increment`
POST	`/api/work-orders/:id/release`
GET	`/api/work-orders/:id/release-check`
GET	`/api/work-orders/active`
GET	`/api/work-orders/summary`

/api/workflows (9)

Method	Path
GET	`/api/workflows`
POST	`/api/workflows`
DELETE	`/api/workflows/:id`
GET	`/api/workflows/:id`
PUT	`/api/workflows/:id`
PUT	`/api/workflows/:id/enable`
POST	`/api/workflows/:id/execute`
GET	`/api/workflows/:id/executions`
DELETE	`/api/workflows/executions/:execId`

REST API Reference ​

Three ways in ​

Base URL ​

Authentication ​

Roles ​

Conventions ​

Auth endpoints ​

Public Data API (read-only live values) ​

Troubleshooting ​

Complete endpoint list ​

Every endpoint ​

See also ​