Web Server/API Commands
The CR6 includes an onboard HTTP/HTTPS web server that provides an API for accessing data and controlling the data logger. External clients such as web browsers, applications, and custom software can send commands to this API. The CR6 supports HTTP/1.1 and HTTP/2. For the latest API documentation, see: Data Logger Web Server API.
This information describes using the API directly on the data logger. The same API is available through the CSI Web Server running on a PC. In this configuration, the API can access any data source defined in an RTMC project. See RTMC for more information.
Enabling Security
The datalogger employs a security scheme that includes three levels of security and is enabled by setting an option in the datalogger’s Status table to a value in the range of 1 to 65534 (refer to the SetSecurity instruction). This scheme can be used to limit access to a datalogger that is publicly available. However, the security code is visible in 
Device Configuration Utility Configuration tool used to set up dataloggers and peripherals, and to configure PakBus settings before those devices are deployed in the field and/or added to networks.. In addition, the range of codes is relatively small. To provide a more robust means of security, Basic Access Authentication was implemented with the HTTP API interface in the form of an Account Manager. User accounts can be defined within this Account Manager, which enables basic access authentication for read/write access to the web interface. Multiple user accounts/levels of access can be defined for one datalogger. Four levels of access are available:
- None: Disable a user account.
- Read Only: Data collection is unrestricted and available. Clock and writable variables cannot be changed; programs cannot be viewed, stopped, deleted, or retrieved.
- Read/Write: Data collection is unrestricted and available, and clock and writable variables can be changed. Programs cannot be viewed, stopped, deleted, or retrieved.
- All: Data collection is unrestricted and available, clock and writable variables can be changed; and programs can be viewed, stopped, deleted and retrieved.
The user accounts can be created or modified using Device Configuration Utility. Support for this Account Manager was added in Device Configuration Utility version 1.17. It is created from the Network Services tab, Edit Accounts button. After user accounts are defined and the Apply button is pressed, the accounts are automatically saved to the datalogger. When the Account Manager enables basic access authentication, the datalogger PakBus/TCP Password security setting is not used when accessing the datalogger via HTTP.
For OS versions prior to
When access to the datalogger Web Server is attempted without the appropriate security level, the datalogger will return a 401 Authorization Required response, which will prompt the Web client to display a user name/password request dialog. If an invalid username or password is entered, the datalogger Web Server will default to the level of access assigned to “anonymous”. As noted above, depending on the OS version, anonymous can have a default user level of read-only or none, though this can be changed using Device Configuration Utility.
If the older numeric security code has been enabled (1 – 65534 using SetSecurity or the Security() Status table settings) and no user accounts are on the datalogger, that numeric security code must be entered to access the datalogger. If a user account file is on the datalogger, the User Name and Password employed by the Basic Access Authentication will eliminate the need for entering the numeric security code.