SmartWeb exposes three universal API interfaces for accessing D2000 — the REST API (synchronous request / response over HTTP/1.1), the CometD API (bidirectional WebSocket / long-polling for real-time push) and the gRPC API (server-to-server HTTP/2). The REST and CometD APIs can be used by browser clients as well as server-to-server clients and share the same access filter model and authentication infrastructure; the gRPC API is intended for server-to-server clients and is configured separately per instance.

REST endpoints and contexts

The REST layer is split into three independent contexts, each with its own security:

Path	Security	Purpose

Path	Security	Purpose
`/api/rest`	API key / JWT / Basic auth	Server-to-server clients (machine API). Also covers `/api/odata/`, `/api/open/`, `/api/oauth2/`, `/api/opentsdb/`.
`/api/web/rest`	HTTP session + CSRF	Browser-to-server communication (the SmartWeb web application and the admin console).
`/api/public/rest`	None	Public infrastructure (CSRF token generation, password reset).

All REST services targeting D2000 use the path prefix /v0/d2/. The most important endpoints:

Path	Description

Path	Description
`/v0/d2/rpc`	Execute a D2000 RPC procedure
`/v0/d2/archive`	Read historical data from a D2000 archive object
`/v0/d2/eda`	Read / write EDA vector data
`/v0/d2/auth/login`, `/v0/d2/auth/logout`	User authentication, session termination
`/v0/d2/sba`	Execute a Simple Byte Array (binary) RPC call
`/v0/d2/changepassword`	Change the D2000 password of the logged-in user (web context only)
`/v0/d2/apifallback/**`	Forward requests to a remote SmartWeb node (server-to-server context only)
`/v0/service/infrastructure`	Public — returns the CSRF token, server version, build info
`/v0/service/resetpassword`	Public password reset flow

Example RPC call from a browser (with a CSRF token and a session cookie):

curl -X POST https://smartweb.example.com/api/web/rest/v0/d2/rpc \
  -H "Content-Type: application/json" \
  -H "X-CSRFToken: <token>" \
  -H "Cookie: JSESSIONID=<session>" \
  -d '{"event":"E.MyRpc","method":"Calculate","params":{"a":1,"b":2}}'

Example server-to-server archive read:

curl "https://smartweb.example.com/api/rest/v0/d2/archive?name=AR.Temperature&from=2026-01-01T00:00:00Z&to=2026-01-02T00:00:00Z" \
  -H "X-API-Key: my-secret-api-key"

CometD endpoint and channels

The CometD endpoint is exposed at /api/cometd (WebSocket with a long-polling fallback). It is secured by the HTTP session and enforces the same CSRF requirements as the web REST context. The browser communicates with it through the d2jsapi TypeScript client.

Channel	Direction	Description

Channel	Direction	Description
`/meta/handshake`	client → server	CometD handshake; the session is verified here
`/meta/subscribe`	client → server	Subscribe to a channel; starts a D2000 object / archive / EDA subscription
`/meta/unsubscribe`	client → server	Cancel a subscription
`/v0/d2/object/{objectName}`	server → client	Push of a value change of the subscribed D2000 object
`/v0/d2/archive/{archiveName}`	server → client	Streamed historical archive data
`/v0/d2/eda/{vectorCode}`	server → client	Push of EDA vector data
`/v0/d2/rpc`	client → server	RPC call request
`/v0/d2/rpc/{callbackId}`	server → client	RPC call result
`/v0/d2/servicemessage`	server → client	Push of D2000 service / alarm messages

gRPC API

The gRPC API is a server-to-server interface built on HTTP/2. Through it, clients can call D2000 RPC procedures, subscribe to object value changes, stream archive and EDA data, and receive RPC calls initiated by D2000. Multiple independent gRPC server instances can be started, each with its own binding address, TLS/mTLS configuration and access filter. Unlike the REST and CometD APIs it is not intended for the browser, and its access filter is configured separately per instance (it is not shared with the REST/CometD model described below).

[!NOTE] For the detailed configuration — service methods, TLS/mTLS, response headers, health checks and examples — see gRPC API Configuration.

OData API

The OData API exposes D2000 archive data and EDA vectors through the standard OData 4.0 interface, suitable for reporting and analytics tools.

[!NOTE] For the detailed configuration, entity sets and query examples, see OData API Configuration.

OpenAPI

The OpenAPI integration works in both directions — SmartWeb can expose external HTTP endpoints described by an OpenAPI specification and bind them to D2000 RPC procedures, or let D2000 ESL scripts call external HTTP services.

[!NOTE] For the detailed configuration of both inbound and outbound OpenAPI, see OpenAPI API Configuration.

Grafana API

The Grafana API implements the OpenTSDB HTTP API 2.4, so Grafana can access D2000 time series (measured and calculated points, variables, archives, EDA vectors) through its built-in OpenTSDB data source — with no plugin required. It is mounted at /api/opentsdb and secured the same way as the server-to-server REST API.

[!NOTE] For the detailed data-source setup, object-to-metric mapping and configuration, see Grafana API Configuration.

Access filter

The REST API and the CometD API share a common access filter that controls which D2000 RPC methods and objects clients may call. By default, every method and every object name is allowed. To restrict access, define explicit allow-lists using wildcard patterns (case-insensitive — * matches any number of characters, ? matches a single character).

smartweb:
  application:
    cometApi:
      enabled: true              # global enable / disable of the CometD interface
      accessFilter:
        allowedD2RpcEventNames:
          - "*"                  # any event name
        allowedD2RpcMethodNames:
          - "*"                  # any RPC method
        allowedD2ObjectNames:
          - "*"                  # any D2 object (subscriptions, archive, EDA)

    restApi:
      enabled: true              # global enable / disable of the REST interface
      accessFilter:
        allowedD2RpcEventNames:
          - "E.MyRpc"
          - "E.TRAY_*"
        allowedD2RpcMethodNames:
          - "Calculate"
          - "GetStatus"
        allowedD2ObjectNames:
          - "P.*"
          - "M.*"

If the cometApi / restApi section is omitted, both interfaces are enabled and unrestricted. The access filter is evaluated on every individual call; a rejected call returns HTTP 403 Forbidden (REST) or terminates the CometD channel.

GZIP

SmartWeb transparently compresses responses and decompresses requests using GZIP. No further configuration is needed; clients only need to send the standard Accept-Encoding: gzip and Content-Encoding: gzip headers.

Universal API Configuration