Data Logger Web Server API (1.0.1)

This documentation describes the API as implemented in the current released operating system for each model, or newer. Version numbers are from campbellsci.com.

Note: The API and documentation may change without notice. Validate behavior against the specific firmware version in use.

Note: This documentation is derived from, and audited against, the data logger firmware implementation.

The data logger exposes an HTTP API for data access and control. This section covers the request syntax common to every command and how access is secured.

Every request is a GET to the data logger. It uses a ?command= query string and HTTP Basic credentials (a data logger user account — see Enabling security). For example, to read the two most-recent records of a table as JSON:

curl --user user:pass \
  'http://<datalogger>/?command=DataQuery&uri=dl:Public&mode=most-recent&p1=2&format=json'

The JSON response uses CSIJSON and has two parts. The head block describes the table: its environment and the schema for each field (name, type, units, and process). The data rows follow. Each row has a timestamp (time), a record number (no), and the field values (vals):

{ "head": { "environment": { "…": "…" }, "fields": [ "…" ] },
  "data": [ { "time": "2026-08-06T13:44:00", "no": 12, "vals": [ "…" ] } ] }

Next: use DataQuery to retrieve records (five modes, all formats), and BrowseSymbols to list the tables and fields you can query. The sections below cover request syntax, response formats, security, and error handling.

Commands generally follow the form:

<URL>?command=<CommandName>&uri=<DataSource>&<arguments>

• Arguments are appended with &; optional arguments use a default.
• uri / the dl: scheme — the data source. When querying the data logger directly it is the top-level source, so uri=dl: (or omitting uri) is assumed. A table or field is addressed as dl:<table> or dl:<table>.<field>.
• Credentials in the URL — a username/password may be supplied inline, for example http://admin:12345@192.168.24.62/?command=ClockCheck.

Note: Any reserved character used in a value in the URL — an argument value, a uri, a file name, or inline credentials — must be percent-encoded. See URL escape codes.

Note: Operations below are shown with placeholder paths (for example, /DataQuery) because OpenAPI cannot put a query string in a path. The real request is always against / with ?command=<CommandName> — see each operation's request sample for the actual URL.

• Default ports: HTTP on 80, HTTPS on 443. Every model serves HTTP/1.1. HTTP/2 runs on the CR6, CR1000X(e), Granite 6, Granite 9, and Granite 10 only; the CR300, CR310, and CR350 use HTTP/1.1 only. Where it is supported, HTTP/2 runs only over TLS (port 443) — port 80 is always HTTP/1.1. TLS uses mbedTLS and supports session resumption. You can set the number of concurrent HTTPS connections in Device Configuration Utility.
• Methods: GET, POST, PUT, and DELETE. POST carries HTML form submissions; PUT/DELETE operate on /{drive}/{path} files.
• The server is reachable over any active interface — Ethernet, Wi-Fi, cellular, or USB (RNDIS) — on both IPv4 and IPv6. Address the data logger by DNS/host name (for example, datalogger.local), IPv4 address, or IPv6 address. In a URL, wrap an IPv6 literal in square brackets — for example, http://[fe80::1]/?command=ClockCheck. USB (RNDIS) connections are treated as trusted for access-control purposes.
• Responses use either Transfer-Encoding: chunked or a Content-Length header, always carry Cache-Control: no-cache, and may be gzip-compressed (Content-Encoding: gzip). The server does not serve range/partial requests (Accept-Ranges: none) — always request whole files.
• File uploads (PUT) accept either a Content-Length body or Transfer-Encoding: chunked. A Transfer-Encoding header that is not chunked is rejected with 500; an over-size Content-Length returns 413.

Most data commands accept a format argument that selects the response format:

Unrecognized values fall back to html.

toa5 and tob1 are record-table formats supported only by data-retrieval commands (DataQuery). Every other command supports html, json, and xml only. Each operation below lists the formats it supports.

Two combinable mechanisms:

1. Numeric security code (legacy) — set in the Status table via SetSecurity / Security() to 1–65534. Weak; if set with no user accounts it must be supplied.
2. Account Manager (HTTP Basic auth) — user accounts created in Device Configuration Utility. When enabled, the PakBus/TCP password and numeric code are not used for HTTP.

Access levels. Every request is authorized at one of four levels (the numeric code is what CheckAuthorization reports):

Anonymous and failed sign-ins. A request with no Authorization header is treated as the built-in anonymous user. When no user accounts exist, anonymous and failed sign-ins both get Read-Only access. If a request resolves to None, the data logger returns 401 to prompt for credentials instead of serving it. USB (RNDIS) connections are trusted (full access) unless you configure otherwise.

On failure the server returns a standard HTTP status with a short HTML or header-only body:

Successful command responses (200) also carry a per-operation outcome code in the body (for example, 1 = success for SetValueEx/ClockSet) — see each command for its meaning.

Authorization checks.

Reading measurement data and browsing the symbol/table namespace.

Data tables. Measurements are stored in data tables. Each table is a fixed-size ring buffer of records. When a table fills up, the oldest records are overwritten. So you can retrieve only a limited, moving window of history. That window is held in CPU RAM. A memory card, onboard flash, or SSD can extend it further back. Each record has:

• a record number (no) — it increases by one per record and is not reset in normal operation. Only a program recompile or table re-initialization resets it. It is a 32-bit unsigned counter, so treat it as an opaque serial number that can wrap.
• a timestamp (time) — the record's time on the logger's local clock, at sub-second resolution. No timezone offset is included.

Each field descriptor reports a type (for example xsd:float, xsd:unsignedInt, or xsd:string with string_len) and a process. The process is the CRBasic operation that produced the field: Smp (sample), Avg (average), Max, Min, and so on. Invalid or not-a-number floating-point values are written as the string "NAN".

Setting public/variable values.

Reading and setting the data logger clock.

File operations — the ?command= file commands and the method-level PUT/GET/DELETE on /{drive}/{path}.

Drives. Files live on named drives, addressed as <drive>:<path> (for example CPU:program.cr1x). In a URL the first / becomes the :, so that path is /CPU/program.cr1x. The set of drives varies by model. Query the root (GET /?command=ListFiles) to see what a given logger has.

All drives are FAT: file and drive names are case-insensitive (case-preserving), and long file names are supported. cpu:program.CR1X and CPU:PROGRAM.cr1x address the same file.

Percent-encode these reserved characters wherever they appear in a value in the URL.

The version shown at the top of this document tracks the documentation, not the firmware. Each firmware release also carries its own version (see Supported models and OS versions).