Gateway API

This page lists commonly used GatewayRuntime, Studio, and Watchdog interfaces. Log in first and send a valid Bearer Token when calling protected interfaces.

Basic Rules

Item	Description
GatewayRuntime default address	http://<gateway-IP>:6100
Studio default address	http://<Studio-IP>:5100
Watchdog default address	http://<gateway-IP>:6200
Data format	Normal interfaces use JSON. Import, upload, export, and download interfaces may use form files or file streams.
Authentication	Use Bearer Token after login. Log in again when the Token expires or authorization fails.
Result check	Check the returned status code and message to confirm whether the operation succeeded.

Studio and Watchdog listen on 0.0.0.0 by default, and the current version allows clients to use plain http://IP:port. Plain remote HTTP requires remote management and AllowInsecureRemoteHttp; Watchdog project deployment and process control also require RemoteDeploymentEnabled.

Studio And Watchdog Password Challenge

Studio and Watchdog do not accept a plaintext login or bootstrap password in the JSON request. Clients must use this current protocol:

1. Call the application's password public-key endpoint and read keyId, publicKey, algorithm, nonce, and expiresAt.
2. Verify that algorithm is RSA-OAEP-SHA256.
3. Parse publicKey as a Base64-encoded RSA 2048 SubjectPublicKeyInfo DER key and encrypt the following UTF-8 JSON. Field casing is fixed.

{
  "Password": "actual password",
  "Nonce": "nonce from the challenge"
}

4. Base64-encode the RSA-OAEP-SHA256 ciphertext. Send it as password, and send keyId as passwordKeyId in the login or bootstrap request.
5. After login, send Authorization: Bearer <token> to protected endpoints.

A challenge expires after two minutes and can be consumed only once. The server invalidates it after either a successful or failed decryption attempt, so every retry must obtain a new challenge. The current protocol does not provide Basic Authentication, plaintext-password, RSA-OAEP-SHA1, or legacy-field fallbacks.

On a plain HTTP IP page, a browser client can use node-forge for RSA-OAEP-SHA256 and crypto.getRandomValues for the OAEP seed. Do not depend on crypto.subtle.importKey, which is commonly unavailable in that context.

HTTP security boundary

The one-time RSA challenge only adds protection to the login and bootstrap password fields; it does not replace TLS. Bearer tokens, bootstrap tokens, password-change requests, project packages, backups, and other application data are still unencrypted in transit over plain HTTP. Use HTTPS on public or untrusted networks.

GatewayRuntime Authentication

Method	Path	Purpose
GET	/api/auth/GetLoginPasswordPublicKey	Get the password encryption public key
POST	/api/auth/Login	Log in
POST	/api/auth/RefreshToken	Refresh Token
POST	/api/auth/ChangePassword	Change the current password
POST	/api/auth/Logout	Log out from the current session
POST	/api/auth/LogoutAll	Log out all sessions of the current user
POST	/api/auth/Me	Get current user information
POST	/api/auth/GetMyMenus	Get menus available to the current user
POST	/api/auth/GetUserPermissions	Get current user permissions
GET	/api/auth/GetOAuth2Providers	Get OAuth2 providers
GET	/api/auth/GetRuntimeConfig	Get login page runtime configuration
POST	/api/auth/OAuth2Exchange	Exchange OAuth2 authorization code
POST	/api/auth/OAuth2Link	Link OAuth2 account
POST	/api/auth/OAuth2Unlink	Unlink OAuth2 account
POST	/api/auth/GetOAuth2Accounts	Get linked OAuth2 accounts

GatewayRuntime Overview And Metadata

Method	Path	Purpose
GET	/api/gatewayoverviewcontroller/getgatewaytotal	Get channel, device, variable, and alarm totals
GET	/api/gatewayoverviewcontroller/getcollectdevices	Get collection device overview
POST	/api/gatewayoverviewcontroller/getchannelstatuspagelist	Query channel status page
POST	/api/gatewayoverviewcontroller/getdevicestatuspagelist	Query device status page
POST	/api/gatewayoverviewcontroller/getvariablestatuspagelist	Query variable status page
GET	/api/gatewaysystemcontroller/getsysteminfo	Get CPU, memory, disk, uptime, and system information
GET	/api/gatewayprojectcontroller/getprojectinfo	Get current project information
GET	/api/gatewaymetadatacontroller/getpluginlist	Get collection plugin list
GET	/api/gatewaymetadatacontroller/getdataforwardpluginlist	Get data forwarding plugin list
GET	/api/gatewaymetadatacontroller/getchanneltypes?pluginName=<collect-plugin-full-name>	Get channel types supported by a collection plugin; the device form uses this to decide whether Channel is required
GET	/api/gatewaymetadatacontroller/getchannelselectlist	Get channel options
GET	/api/gatewaymetadatacontroller/getdeviceselectlist	Get device options
GET	/api/gatewaymetadatacontroller/getvariableselectlist	Get variable options

Collection Configuration

Object	Main Paths	Purpose
Channel	/api/channelcontroller/addchannel, updatechannel, deletechannel, batcheditchannel, copychannel	Add, edit, delete, batch edit, and copy channels
Channel import/export	/api/channelcontroller/channelexcelexport, channelpageexcelexport, channelexcelimport	Import and export channels with Excel
Device	/api/devicecontroller/adddevice, updatedevice, deletedevice, batcheditdevice, copydevice	Add, edit, delete, batch edit, and copy devices
Device import/export	/api/devicecontroller/deviceexcelexport, devicepageexcelexport, deviceexcelimport	Import and export devices with Excel
Variable	/api/variablecontroller/addvariable, updatevariable, deletevariable, batcheditvariable, copyvariable	Add, edit, delete, batch edit, and copy variables
Variable import/export	/api/variablecontroller/variableexcelexport, variableexcelimport, gatewaydataexcelexport, gatewaydataexcelimport	Import and export variables or gateway configuration
Variable write	/api/gatewaywritevariablecontroller/setvariablevalue	Write variable values

Data Forwarding

Method	Path	Purpose
GET	/api/gatewaydataforwardcontroller/getgroups	Get forwarding groups
GET	/api/gatewaydataforwardcontroller/gettargets	Get forwarding targets
GET	/api/gatewaydataforwardcontroller/getgroupvariables	Get variables in a forwarding group
GET	/api/gatewaydataforwardcontroller/gettargetvariableproperties	Get target variable properties
GET	/api/gatewaydataforwardcontroller/getruntime	Get data forwarding runtime status
POST	/api/gatewaydataforwardcontroller/addgroup, updategroup, deletegroup, restartgroup	Maintain forwarding groups
POST	/api/gatewaydataforwardcontroller/addtarget, updatetarget, deletetarget, restarttarget	Maintain forwarding targets
POST	/api/gatewaydataforwardcontroller/setgroupvariables	Save forwarding group variables
POST	/api/gatewaydataforwardcontroller/upserttargetvariableproperty, deletetargetvariableproperty	Save or delete target variable properties
POST	/api/gatewaydataforwardcontroller/getgrouplog, gettargetlog	Query forwarding runtime logs
POST	/api/gatewaydataforwardcontroller/exportgrouplog, exporttargetlog	Export forwarding runtime logs
POST	/api/gatewaydataforwardcontroller/dataforwardexcelexport, dataforwardexcelimport	Import and export forwarding configuration

Forwarding group variables decide whether a variable belongs to a group. Target variable properties only describe how a specific target uses that variable; in manual range mode, call setgroupvariables before saving target variable properties.

Data And Alarm Query

Method	Path	Purpose
POST	/api/gatewayrealdatacontroller/GetRealDataRecordsByTarget	Query real-time data records
GET	/api/gatewayrealdatacontroller/GetRealDataTargetNames	Get real-time data targets
POST	/api/gatewayhisdatacontroller/GetHisDataRecordsByTarget	Query historical data records
POST	/api/gatewayhisdatacontroller/GetHisNumberDataRecordsByTarget	Query historical numeric data
POST	/api/gatewayhisdatacontroller/GetTypedHisDataRecordsByTarget, GetTypedHisNumberDataRecordsByTarget	Query typed historical records by UTC range, variable set, pagination, and allow-listed sorting
POST	/api/gatewayhisdatacontroller/GetHisNumberSeriesByTarget	Query historical numeric series in Auto, Raw, Average, Minimum, Maximum, First, or Last mode
GET	/api/gatewayhisdatacontroller/GetHisDataTargetNames	Get historical data targets
POST	/api/customsqldatacontroller/GetCustomSqlDataByTarget	Query custom SQL historical data
GET	/api/customsqldatacontroller/GetCustomSqlColumns	Get custom SQL columns
POST	/api/gatewayrealalarmcontroller/getrealalarmvariables	Query real-time alarms
POST	/api/gatewayrealalarmcontroller/confirmalarm	Confirm real-time alarms
POST	/api/gatewayhisalarmcontroller/GetHisAlarmRecordsByTarget	Query historical alarms
GET	/api/gatewayhisalarmcontroller/GetHisAlarmTargetNames	Get historical alarm targets

Typed history requests use UTC start/end times and are protected by limits for variable count, range, page size, series points, source rows, and export rows. Defaults are maintained in Configuration/HisDataQueryOptions.json. Integrations should paginate records or use numeric-series aggregation instead of requesting an entire large raw range at once.

MQTT Client and MQTT Server producers can access the same history capabilities through the default RpcHistory topic. Requests use RpcHistory/<32-digit-hex-request-id> and responses use RpcHistory/<request-id>/Response. The protocol supports targets, records, numeric series, historical alarms, alarm confirmation, and cancellation. Large responses are gzip-compressed and Base64-chunked, with request, response, chunk, concurrency, and timeout limits.

Rules, Scripts, And Nodes

Module	Main Paths	Purpose
Rule flows	/api/gatewayruleenginecontroller/getruleflowspaged, saveruleflow, deleteruleflows, toggleflowenabled	Query, save, delete, enable, and disable rule flows
Rule runtime	/api/gatewayruleenginecontroller/getruleenginestatus, getallflownodevalues, getruleenginelog	Query rule status, node values, and logs
Rule import/export	/api/gatewayruleenginecontroller/ruleflowexcelexport, ruleflowexcelimport	Import and export rules with Excel
Scripts	/api/gatewayscriptcontroller/getscriptlist, createscript, deletescripts, compilescript, compileallscripts	Query, create, delete, and compile scripts
Script metadata	/api/gatewayscriptcontroller/getregisteredexpressionspaged, getexpressioncategories, getscriptcategories	Query registered expressions and categories
Custom nodes	/api/gatewaycustomnodecontroller/getcustomnodespaged, createcustomnode, deletecustomnodes, compileallcustomnodes	Query, create, delete, and compile custom nodes
Editor assistance	/api/completion/complete, codecheck, signaturehelp, hover, definition, formatcode	Provide code completion, checking, signature help, hover, definition, and formatting in script and node editors

Plugins, Certificates, And System Settings

Module	Main Paths	Purpose
Plugins	/api/gatewayplugincontroller/getplugins, updatepluginenable, batchenableplugins, batchdisableplugins, syncpluginconfigs	Query, enable, disable, and sync plugins
Certificates	/api/certificatecontroller/getcertificates, addcertificate, updatecertificate, deletecertificates, generatecertificateauthority, generateservercertificate, generateclientcertificate, exportcertificate, exportprivatecertificate, getcertificateselectlist	Shared TAdmin certificate query, upload, update, delete, generation, export, and selection
Alarm configuration	/api/gatewayalarmconfigcontroller/GetAlarmConfig, UpdateAlarmConfig	Configure alarm recovery policy
Redundancy	/api/gatewayredundantcontroller/getredundancyoptions, setredundancyoptions, switchredundantstate	Configure redundancy and switch redundancy state
Network	/api/gatewaynetworkconfigcontroller/getnetworkconfigs, setnetworkconfig	Query and configure network cards
Time synchronization	/api/gatewaytimecontroller/getsystemtime, setsystemtime, getntpconfig, setntpconfig, syncntptime	Configure system time and NTP
System control	/api/gatewayrestartcontroller/restartruntime, restartapplication	Restart runtime or application
Backup	/api/backupcontroller/backupconfigdatabase	Back up the configuration database
PING	/api/gatewaypingcontroller/pingtest	Test network connectivity

Certificate API upgrade

Certificate management has moved to the shared TAdmin module. The old /api/gatewaycertificatecontroller/... controller is no longer the current API. Callers must migrate to /api/certificatecontroller/... and update action names such as generatecertificateauthority and deletecertificates, together with the certificate:* permission codes.

Logs

Log Type	Main Paths
Backend log	/api/backendlogcontroller/getbackendlog, getallbackendlog, exportbackendlog, exportallbackendlog
Channel log	/api/channelcontroller/getchannellog, updatechannelloglevel, exportchannellog
Device log	/api/devicecontroller/getdevicelog, updatedeviceloglevel, exportdevicelog
Operation log	/api/adminsystemlogcontroller/getoperatelog, /api/adminsystemlogcontroller/exportoperatelog
RPC log	/api/rpclogcontroller/getrpclog, exportrpclog
SQL log	/api/adminsystemlogcontroller/getsqllog, /api/adminsystemlogcontroller/exportsqllog
Audit log	/api/adminauditlogcontroller/getloginaudit, getpermissionaudit, getusersecurityaudit, and related export interfaces

Permissions

Object	Main Paths	Purpose
Users	/api/gatewayusercontroller/getusers, adduser, updateuser, setroles, resetpassword, lock, unlock, deleteuser	Maintain users and assign roles
Sessions	/api/gatewayusercontroller/getusersessions, revokesession, setsessionrevoked	Manage user sessions
Roles	/api/gatewayrolecontroller/getroles, addrole, updaterole, copyrole, setpermissions, getpermissioncatalog, deleterole	Maintain roles and permissions
Menus	/api/gatewaymenucontroller/getmenutree, savemenu, validatemenu, movemenu, setmenuenabled, setmenuvisible, deletemenu	Maintain menu tree
Buttons	/api/gatewaybuttoncontroller/getbuttons, addbutton, updatebutton, deletebutton	Maintain button permissions

Studio And Watchdog

Studio Authentication

Method	Path	Description
GET	/api/auth/GetLoginPasswordPublicKey	Issue a two-minute, one-time RSA-OAEP-SHA256 password challenge.
GET	/api/auth/BootstrapStatus	Query whether administrator bootstrap is required.
POST	/api/auth/Bootstrap	Bootstrap with token, passwordKeyId, and Base64 ciphertext password.
POST	/api/auth/Login	Log in with name, passwordKeyId, and Base64 ciphertext password.
POST	/api/auth/ChangePassword	Change the password using the Studio JWT Bearer and return a newly issued JWT.

Studio returns a JWT Bearer that expires after seven days. The one-time bootstrap token is stored at Data/studio_bootstrap.token under the runtime directory and is deleted after successful bootstrap. Bootstrap is allowed from an IP client when remote management is enabled.

Watchdog Authentication

Method	Path	Description
GET	/api/watchdog/login/password-public-key	Issue a two-minute, one-time RSA-OAEP-SHA256 password challenge.
GET	/api/watchdog/bootstrap/status	Query whether administrator bootstrap is required.
POST	/api/watchdog/bootstrap	Bootstrap with token, passwordKeyId, and Base64 ciphertext password.
POST	/api/watchdog/login	Log in with username, passwordKeyId, and Base64 ciphertext password.
POST	/api/watchdog/logout	Revoke the current Bearer session.

Watchdog returns accessToken, username, and expiresAt. The access token is a random opaque value valid for eight hours; only its SHA-256 digest is retained in server memory. Logout or a Watchdog restart invalidates it. The one-time bootstrap token is stored at Data/watchdog_bootstrap.token and is deleted after successful bootstrap.

Application	Main Paths	Purpose
Studio authentication	/api/auth/GetLoginPasswordPublicKey, BootstrapStatus, Bootstrap, Login, ChangePassword	One-time password challenge, bootstrap, login, and password change
Studio projects	/api/project/list, create, update, import	Query, create, edit, and import projects
Studio runtime	/api/runtime/current-project, start, stop, gateway-version, app-version	Query local runtime status and version
Studio Watchdog	/api/watchdog/configs, config/save, upload, download	Configure Watchdog connections, upload projects, and download projects
Studio tunnel	/api/tunnel/status, listeners, config, start, stop	Query and configure tunnel service
Watchdog authentication	/api/watchdog/login/password-public-key, bootstrap/status, bootstrap, login, logout	One-time password challenge, bootstrap, Bearer login, and logout
Watchdog status	/api/watchdog/status, projects, logs, backups	Dashboard, projects, logs, and backups
Watchdog projects	/api/watchdog/project/upload, project/download/{name}, apply/{name}, project/{name}	Upload, download, apply, and delete projects
Watchdog process	/api/watchdog/restart, stop	Restart or stop GatewayRuntime
Watchdog backup	/api/watchdog/backup/create, backup/restore/{name}, backup/{name}	Create, restore, and delete backups
Watchdog tunnel	/api/watchdog/tunnel/status, activate/{name}, deactivate/{name}, activate-all, deactivate-all	Query and control tunnel clients
Watchdog settings	/api/watchdog/options, change-password	Configure Watchdog and change password

Notes

• Use the exact path and letter case shown in the table.
• Import, export, upload, and download interfaces may return files or accept form files.
• Management interfaces are controlled by menu, button, and API permissions. If the role lacks permission, the call may fail even when the Token is valid.