This document describes which OPC UA Profiles and Facets are implemented in the OPC UA .NET Standard Stack, and where in the codebase / documentation each one lives.
The OPC UA .NET Standard Stack implements core OPC UA services and selected companion specifications, with OPC UA 1.05.07 as its core implementation target. The individual parts have different latest published versions. The published specification support matrix at the end lists every specification in the OPC Foundation online reference, its latest listed version, and the SDK's support level.
The SDK provides full or partial support for these core areas:
- Parts 1-3 and 5-6: concepts, security, address-space and information models, encodings and transport mappings.
- Part 4: discovery, sessions, browsing, attributes, methods, node management and subscriptions. Query client APIs exist, but the default server does not implement the Query service set.
- Part 7: the server, client, transport and security profiles described below; coverage is a selection of the profile catalogue.
- Parts 8-11 and 13: Data Access, Alarms and Conditions, Programs, Historical Access and Aggregates.
- Part 12: LDS/LDS-ME, GDS registration, certificate management, authorization and key credentials, with the documented GDS gaps.
- Part 14: PubSub, including UADP/JSON, broker and datagram transports, with platform-dependent DTLS profile limits.
- Parts 16-20 and 23: state machines, aliases, roles, dictionary references, file transfer and common reference types.
- Part 21: ticket validation, registrar runtime and pull/push workflows,
with retained device credentials, security reset, managed Client provisioning,
provider-backed Server/ClientAndServer push and a Part 22
Resourcesparent reference. FDO protocols and credential installation remain external; the GDS guide describes the remaining recovery andConfigurationFilegaps. - Part 22: Base Network Model runtime, typed clients and an in-memory simulator, including defined optional capabilities when supplied by the provider; applications supply production network providers.
- Parts 25 and 26: generated Object Serialization and LogObject declarations, without complete runtime services for those models.
The companion and extension catalogue
describes the supported Devices, Asset Management Basics, Industrial Automation,
Positioning, ISA-95, WoT, AutoID, PackML, PA-DIM, LADS, Energy Consumption
Management, Machinery, Robotics, Cranes and Hoists, plastics/rubber, extrusion,
Machine Vision, weighing, measurement, Pumps and MachineTool families.
Weighing includes registered catchweigher and price-labeler observations,
completed hopper fills, piece-count registration and product totals, and opt-in
recipe condition waits; equipment operation and recipe-file parsing remain
application responsibilities.
Scales provides native async service writes for product targets/tolerances,
recipe condition settings and notification category/ID enums with
ValueAsText. Custom synchronous-only handlers must provide native async behavior.
Source-generation tooling also implements selected modelling checks relevant
to OPC 11030.
LADS supports optional cooperative Hold/Unhold, Suspend/Unsuspend, Reset and ToComplete operations when an acknowledging executor or hardware provider is configured. Its optional store restores templates, results, file bytes, maintenance records and counters without resuming interrupted physical execution; the default lifecycle still stops automatically. Opted-in AMB configuration adds configurable asset identification and selected asset building blocks without changing legacy device identities. Optional DI Locking enforces session ownership across UA writes and method calls throughout the device subtree, including generated AMB and FileType handlers.
Support describes SDK functionality, not certification of every current feature, companion model or application. Historical reference-server certification applies only to its tested product version and profile scope. Applications still need the required providers, configuration and equipment.
See What's New in 2.0 for the broader change narrative.
The canonical list of OPC UA profile and facet URIs is maintained by the
OPC Foundation at https://profiles.opcfoundation.org/. Listing an interface
or URI here does not mean every reference-server configuration advertises it.
Inspect the actual endpoint descriptions, ServerProfileArray and contributed
conformance units. Do not derive a profile URI from a package or feature name.
- Overview
- Server Profiles
- Companion and extension models
- Client Profiles
- Transport Profiles
- Security Profiles
- User Authentication
- Certificate Types
- Global Discovery Server (GDS)
- Message Encoding
- Specification Compliance
- Configuration
- Related Documentation
- References
- Published specification support matrix
The reference server (samples/Reference/ConsoleReferenceServer) advertises the
following profiles in its ServerProfileArray:
-
Standard UA Server Profile (2017) — The core OPC UA Server profile that includes:
- Basic server capabilities
- Discovery services
- Session management
- Subscription management
- MonitoredItem services
- View services (Browse, BrowseNext, TranslateBrowsePathsToNodeIds)
- Attribute services (Read, Write, HistoryRead, HistoryUpdate)
Query request/response types and client calls are available, but the default server returns
BadServiceUnsupportedforQueryFirstandQueryNext.
-
Data Access Server Facet — Variables, data types, and data-change notifications.
-
Method Server Facet — Method calls on objects in the address space.
-
Reverse Connect Facet — Server-initiated connections to a client (see Reverse Connect documentation).
-
Client Redundancy Facet — Subscription transfer between sessions/servers; see Transfer Subscriptions.
-
Historical Access (15 released 2022 Server facets) — the ReferenceServer capability-gates and advertises:
- Raw Data
- Modified Data
- AtTime
- Aggregate
- Annotation
- Structured Data
- Raw Data Insert
- Raw Data Replace
- Raw Data Update
- Raw Data Delete
- Event Read
- Event Insert
- Event Replace
- Event Update
- Event Delete
See Historical Access and Aggregates.
The Opc.Ua.Lds.Server library plus the ConsoleLdsServer reference
application implement the Local Discovery Server. The LDS application
advertises the Local Discovery Server 2017 Facet
(see samples/Lds/ConsoleLdsServer/Lds.Server.Config.xml).
Beyond the default profiles advertised in the reference server's
ServerProfileArray, the master branch implements the following facets in
the SDK. They can be enabled per-application by registering the
corresponding NodeManager and, where applicable, adding the matching URI to
ServerProfileArray (consult https://profiles.opcfoundation.org/ for the
canonical URI string before claiming a facet):
- Alarms and Conditions (Part 9) — Full server-side implementation
with latched / silenced / out-of-service alarms, alarm groups, a
suppression engine, and rate metrics. The reference server's
AlarmNodeManagerexposes a working sample. See Alarms and Conditions. - State Machine (Part 16) —
StateMachineBuilderand theFluentFiniteStateMachineStateextensibility insrc/Opc.Ua.Server/StateMachines/. The reference server'sBoilerStateMachineStateis an end-to-end sample. See State Machines. - File Access (Part 20, partial) — Server-side
FileSystemNodeManager+IFileSystemProviderinsrc/Opc.Ua.Server/FileSystem/. The reference server enables it via theEnableFileSystemNodeManageroption. The matching System.IO-style client lives inFileSystemClient. The shared file handler rejects combined Read + Write opens. A conflicting write-only open on a writable file can returnBad_InvalidStatewhere Part 20 requiresBad_NotWritable. - Node Management (Part 4 service set) —
INodeManagementAsyncNodeManageropt-in plus a per-NodeManagerAllowNodeManagementgate forAddNodes/DeleteNodes/AddReferences/DeleteReferences. See Node Management. - Alias Names (Part 17) —
AliasNameStoreand the optionalAliasNameNodeManagerforAliasNameCategory/FindAlias/FindAliasVerbose/AddAliasesToCategory/DeleteAliasesFromCategory/LastChange. The reference server wires the standard Aliases and Topics nodes viaConfigureAliasNameStore. See Alias Names. - Base Network Model (Part 22) —
AddNetworkModelbinds application-owned providers to standard Resources entry points, interfaces, priority mappings, TSN streams and LLDP, including defined optional capabilities when supplied. The reference provider simulates state; it does not configure host interfaces or reserve TSN bandwidth. No profile URI is synthesized from the specification's conformance-unit names. See Base Network Model. - WoT Connectivity (OPC 10100-1) —
Opc.Ua.WotCon/Opc.Ua.WotCon.Server/Opc.Ua.WotCon.Clientlibrary trio for surfacing OPC UA servers as Web-of-Things Thing Descriptions. See WoT Connectivity. - Device Integration (Part 100) —
Opc.Ua.Di/Opc.Ua.Di.Server/Opc.Ua.Di.Clientlibrary trio, including the lock service and the software-update package store. See Device Integration and Software Update. - Relative Spatial Location and Global Positioning (Parts 210 and 211) —
Opc.Ua.Positioning/Opc.Ua.Positioning.Server/Opc.Ua.Positioning.Clientimplement the released RSL and GPOS models, including RSL spatial lists and model changes plus the GPOS GlobalPosition, GlobalLocation, and Zones conformance units. See Positioning. - Industrial Automation (OPC 10000-200), Full — shared
Opc.Ua.IAmodel withOpc.Ua.IA.Serverprovider bindings for stacklights, statistics and calibration-target information, andOpc.Ua.IA.Clientgenerated-proxy access, discovery and feature inspection. Statistics copy exactEnumValueTypeandArgumentbodies field by field and accept application-defined structures as encodedExtensionObjectvalues. Providers encode custom structures before publication, and clients with the matching model can decode them. Physical procedures and storage remain application-owned. See Industrial Automation. - PA-DIM (OPC 30081), Full —
Opc.Ua.PADIM.Serverpublishes provider-backed devices under the Device IntegrationDeviceSet, andOpc.Ua.PADIM.Clientdiscovers them and accesses their methods through generated proxies. The runtime supports configured signal and analyser families; applications select optional capabilities per device and supply acquisition or operation providers. See PA-DIM. - Energy Consumption Management (OPC 34100), Full —
Opc.Ua.ECM,Opc.Ua.ECM.ServerandOpc.Ua.ECM.Clientprovide provider-backed measurement, standby and WOL bindings with typed client access.EcmConformanceContributorreports configured capabilities and their required profiles. Physical equipment and wake transport remain application-owned. See Energy Consumption Management. - Robotics (OPC 40010-1) over Industrial Automation (OPC 10000-200) —
Opc.Ua.Robotics/Opc.Ua.Robotics.Server/Opc.Ua.Robotics.Clientlibrary trio implementing the released Robotics 1.02 model over IA and Device Integration, with validated fluent topology builders for motion device systems, controllers, motion devices, axes, power trains, motors, gears, drives, safety states, and task controls. See Robotics. - Role Management (Part 18) — Server-side role administration plus a
pluggable identity-provider model for anonymous,
username, X.509, and token-issuer flows. The server automatically
assigns the OPC UA Part 3 §4.9
TrustedApplicationrole; see also Role-Based User Management. - Auditing — The server raises audit events for security-relevant
service calls (channel/secure-channel/session/activate/cancel). The
audit and redaction APIs are provided by
Opc.Ua.Server. - Model Change Tracking — Server-side
ModelChangeAggregatorwith auto-emittedGeneralModelChangeEventfromCustomNodeManager; client-side per-nodeINodeCache.InvalidateNode. See Model Change Tracking. - Durable Subscriptions — Subscriptions that persist across reconnects. See Durable Subscriptions.
- Complex Types — Custom structures and enumerations; see Complex Types.
- Async server NodeManagers — TAP-based
AsyncCustomNodeManageris the recommended base for new NodeManagers, and every NodeManager shipped with the stack has migrated to it. See Async Server Support. - Session-less invocation (Part 4 §6.3) - opt-in invocation of the permitted service sets through the existing identity/authorization pipeline; this does not enable session-less subscriptions. See Session-less invocation.
- Final-value publication before node removal - a node manager can await inclusion of final values in server Publish responses before retiring dynamic nodes. This is an SDK lifecycle facility, not a separately certified profile or transport-acknowledgment guarantee. See Node managers.
- Server redundancy (Part 4 §6.6) —
AddServerRedundancy(...)publishes theServer.ServerRedundancyobject, drivesServer.ServiceLevel, and supports everyRedundancySupportmode (None / Cold / Warm / Hot / HotAndMirrored / Transparent). Non-transparent modes advertise theNTRSdiscovery capability and return the peer set fromFindServers;RequestServerStateChangesupports administrator-driven Maintenance / NoData failover. Opt-in distributed high availability — address-space, session, and subscription mirroring over an in-package CRDT (eventual) or Raft (strong) shared store, plus a Kubernetes deployment — is provided by theOpc.Ua.Redundancy,.Server,.Client, and.Kubernetespackages. See High Availability.
This catalogue lists only implemented families. Full and Partial use the support definitions below. Generated declarations, runtime behavior, advertised conformance units and external certification are separate evidence. A provider requirement is an application integration boundary; a missing protocol or withheld facet is a support gap.
| Model or family | Support | Implemented behavior and limits |
|---|---|---|
| Base Network Model, OPC 10000-22 | Full | Provider-backed Resources model, typed clients and simulator, with defined optional interface, mapping, TSN and LLDP capabilities when supplied; applications supply production network providers |
| Device Integration, OPC 10000-100 | Partial | Device composition, locking and software updates; offline/online representations, some loading modes and UpdateStatus remain incomplete |
| Asset Management Basics, OPC 10000-110 | Full | Identity, health, maintenance, documentation, locations, dictionary classification, opt-in Part 11 history and explicit cross-server sub-asset traversal; applications provide history providers and remote-session resolution policy |
| Industrial Automation, OPC 10000-200 | Full | Stacklights, statistics and calibration targets with provider bindings, typed clients and a sample; physical drivers and calibration remain application-owned |
| Machinery, OPC 40001-1/-2/-3/-4/-101 | Full | Building blocks, process values, jobs, energy and result transfer; select capabilities and supply equipment/storage providers |
| MachineTool and WMTP, OPC 40501-1 and OPC 40505 | Full | Monitoring, tools, production, jobs, files, peripheral measurements/configuration/records and typed clients; physical CNC/Bluetooth behavior belongs to providers |
| GMS, OPC 40210 | Partial | Systems, sensors, calibration observations, jobs/parts and results; Production facet withheld because upstream leaves GMS_ProductionStatisticsType undefined |
| Cranes and Hoists, OPC 40020-1 | Full | Robotics-derived topology, load/protection observations and authorized limit requests; not a motion or safety controller |
| Pumps, OPC 40223 | Full | Fluent builders, typed identity writes, retained identification, DI NE107/limit conditions, event notification, shared raw/aggregate/event history and files; profile advertisement follows configured inherited facets; Table 155's Base dependency uses the Table 153 Pump Base URI while the CAS Base link remains a publication discrepancy; no physical pump executor |
| AutoID Devices, OPC 30010 | Full | Reader hosting, RuntimeParameters/ScanActive, diagnostic formatting, typed clients, RFID/RTLS operations, verifier scans, provider-published image files and application-defined IOData composition. Devices expose configured capabilities; Full Server Facet is available for qualifying readers. Undefined optional RTLS GetUnits is omitted; mandatory unit properties remain available |
| Scales, OPC 40200 | Partial | Weighing, products, registered catchweigher/price-labeler items, completed hopper fills, piece-count registration and opt-in product totals, recipes, PackML, per-vehicle signed/absolute totals, typed clients and opt-in analog/edge waits over registered local sources. Without PackML, recipe starts require explicit application release or an allowing callback. Notification metadata, statistical equations and immediate GiveAway refresh after nominal writes are implemented. Ordinary notification reentry permits writes from overlapping callbacks. Existing mixed-category reporting and measured-only totals are preserved; Weighed does not represent fixed category participation. Physical equipment operation remains application-owned |
| ISA-95, OPC 10030 and OPC 10031-4 | Full | Common resources and Job Control V1/V2 server/client interfaces; providers supply execution, catalogues and persistence |
| Positioning, OPC 10000-210/-211 | Full | RSL/GPOS models, spatial lists, model changes, positions, locations, zones and transforms; hardware observations require providers |
| Robotics, OPC 40010-1 | Full | Released motion-device topology and controller/program interfaces; physical motion and safety behavior remain equipment responsibilities |
| Machine Vision, OPC 40100-1/-2 | Full | Control, configuration, recipes, results, asset/condition monitoring and clients; providers supply acquisition, separate from the Perception draft |
| WoT Connectivity, OPC 10100-1 | Full | Published 1.02 asset-connection API, server and client; additive registry extensions have separate scope |
| WoT Binding, OPC 10101 | Partial | Published 1.00 consumer mode and conversions; general UA Binary payload codec and complete TD/TM/Binding-result schema validation are missing |
| PackML, OPC 30050 | Partial | Generated model and Scales recipe/state integration; not a standalone implementation of every PackML unit mode |
| PA-DIM, OPC 30081 | Full | Provider-backed DI devices, signal/analyser families, operations, typed clients and sample; applications select optional capabilities per device and supply acquisition or operation providers |
| Energy Consumption Management, OPC 34100 | Full | All defined measurement, standby and WOL capabilities with provider-backed server bindings, typed clients and fluent DI composition; equipment behavior remains application-owned |
| LADS, OPC 30500-1 | Full | Devices, functions, programs, results, maintenance, cooperative running operations, stored-data restoration, opt-in AMB building blocks and optional DI subtree locking. BaseServer configurable identification requires a stable URI and persistent AMB store; physical execution requires application providers |
| Plastics and rubber common types, OPC 40083 | Full | Common controls, monitoring, maintenance, materials, diagnostics and production datasets; independently authored 1.03 interface implementation on the licensed 1.02 basis |
| Granulate drying, OPC 40082-6 | Full | Device construction, selectable conformance units, provider-backed commands, observations, events and typed clients |
| Extrusion, OPC 40084-1/-2/-3/-4/-5/-7/-8/-9/-10/-11/-12 | Full | General types and concrete device/line runtimes, jobs, datasets, events and clients; equipment authority remains with explicit providers |
| Extrusion Filter, OPC 40084-6 | Partial | Filter model/runtime implemented; profile withheld pending clarification of the published requirement for the Part 5 Melt Pump conformance unit |
Implemented draft extensions are separate from the published-specification matrix:
| Extension | Implemented behavior and limits |
|---|---|
| Perception and Robot Intent | Perception/media/inference/feedback and robot task-intent interfaces; provisional identifiers and provider-dependent behavior |
| AI, xRegistry, OpenUSD | Model/deployment/inference services, registry/version/federation and scene/address-space integration; draft models with backend-specific limits |
Package preview status is governed by the release policy, not by a specification's publication date. The MachineTool/GMS and released Vision package families follow the root version; CranesHoists remains preview-only. Draft identifiers are not promoted to standard identifiers by shipping a package.
The client (Opc.Ua.Client) supports the standard UA Client functionality
through two coexisting paths:
- Classic
Session— the lowest-level OPC UA session primitive, paired withSessionReconnectHandlerfor caller-driven reconnect. ManagedSession— recommended for new code. Encapsulates the connection state machine, reconnect policy, and pluggable subscription engine behind a fluent builder. See Sessions, Reconnection, and Subscription Engines.
Client-side feature coverage:
- Base Network Model (Part 22) —
AddNetworkModelClientprovides typed discovery, reads, observations and mapping methods. Mapping calls preserve operation and argument results without replaying commands. See Base Network Model. - Subscriptions and monitored items — Both the classic publish
engine and the V2 subscription engine (
ISubscriptionManager/DefaultSubscriptionEngine) are supported and selectable per session. The V2 surface includes a declarative + imperativeSetTriggeringAPI with N:M support and automatic replay on recreate / reconnect, plus anIStreamingSubscription(IAsyncEnumerable-based) facade for state-machine waits and short-lived monitoring (ManagedSession.DefaultStreaming,TakeUntilAsync/WithTimeoutAsynchelpers). See Subscriptions and Monitored Items. - Transfer Subscriptions — Transfer existing subscriptions between sessions;
see Transfer Subscriptions. An opt-in
SubscriptionRecoveryPolicylets the client tolerateGood_SubscriptionTransferrednotifications from the server. - Reverse Connect — Client can accept connections initiated by the server; see Reverse Connect.
- Model Change Tracking — Client-side per-node cache invalidation driven by server-emitted model-change events; see Model Change Tracking.
- File System Operations — Async,
System.IO-style client over OPC UA file methods; see FileSystemClient. - Alarms and Conditions — Typed
AlarmClientevent records, generated{Type}Record.EventFilters.Build()event filters, andIAsyncEnumerablealarm streaming viaAlarmStreamExtensions; see Alarms and Conditions. - Historical Access —
HistoryClient(session.Historian()) for raw, modified (includingModificationInfo), at-time, processed (aggregate), annotation, and event history reads / updates; see Historical Access. - State Machines — Streaming and read helpers
(
GetCurrentFiniteStateAsync,ObserveFiniteTransitionsAsync,WaitForStateAsync) on the source-generated*TypeClientproxies; see State Machines. - NodeSet Export — Extract a server's address space to NodeSet2 XML; see NodeSet Export.
- Source-generated typed proxies —
*TypeClientproxies for ObjectTypes inside loaded models give strongly-typed method-call signatures; see Source-Generated NodeManagers. - Complex types — Decode and consume server-defined structures and enumerations on the client; see Complex Types.
- Generation-bound session clients - capture a transport/session generation and namespace mappings; invalidated bindings reject requests instead of retargeting them after reconnect. This is an additive SDK capability, not a separate conformance profile. See Session bindings.
- Typed companion workflows - the model families above include their documented discovery, read, operation and observation helpers. Companion and general stack workflows are also exposed through bounded MCP profiles, with separate host grants for privileged/live execution. MCP catalogue selection is neither an execution grant nor an OPC UA Client conformance profile.
The stack implements the following transport profiles:
-
UA TCP Transport (
opc.tcp://) — Primary OPC UA binary transport over TCP.- Full UA Secure Conversation (UASC)
- Binary encoding
- Reverse-connect capability
-
HTTPS Binary Transport (
opc.https://andhttps://) — OPC UA binary protocol over HTTPS with TLS. -
HTTPS JSON Transport (
opc.https://andhttps://) - OPC UA JSON (compact / reversible) over HTTPS (OPC UA Part 6 §7.4.5)- Compact JSON encoding (
application/opcua+uajson) - TLS/SSL encryption only — no UA SecureChannel layer
- Restricted to
MessageSecurityMode.None; transport security is provided exclusively by TLS
- Compact JSON encoding (
-
WebSocket Secure (UA Binary) (
opc.wss://andwss://) - UA Binary + UASC over secure WebSockets (OPC UA Part 6 §7.5.2, sub-protocolopcua+uacp)- Same UASC SecureChannel pipeline as
opc.tcpcarried over WebSocket binary frames (one frame per MessageChunk) - Supports all security modes (None / Sign / SignAndEncrypt)
- TLS/SSL encryption at the WebSocket layer
- Same UASC SecureChannel pipeline as
-
WebSocket Secure (JSON) (
opc.wss://andwss://) - OPC UA JSON over secure WebSockets (Part 6 §7.5.2, sub-protocolopcua+uajson)- Compact JSON encoding per WebSocket text frame
- TLS/SSL encryption only — no UA SecureChannel layer
- Restricted to
MessageSecurityMode.None
-
HTTPS OpenAPI (
opc.https://andhttps://) - OPC UA OpenAPI Mapping (Part 6 §G.3) — official OPC Foundation profile/2338, URIhttp://opcfoundation.org/UA-Profile/Transport/https-uajson-openapi- Path-routed REST surface:
POST /<service>(e.g./read,/browse,/createsubscription) - Body is the bare
<Service>Request/<Service>Response— no{UaTypeId, UaBody}envelope at the HTTPS layer - Compact (default, mandatory per §5.4.9) and Verbose JSON flavours selected via the
application/json; encoding=compact|verbosemedia-type parameter - TLS/SSL encryption only — no UA SecureChannel layer
- Restricted to
MessageSecurityMode.None - Authentication via Anonymous, Bearer JWT, HTTP Basic, or Mutual TLS (see WebApi.md)
- Server-side discovery emission:
HttpsServiceHostemits this sub-profile as a discovery-only twin alongside eachSecurityMode.NoneHTTPS-binary endpoint, so discovery-driven clients can find the OpenAPI endpoint without hard-coding the URL. - Shipped as part of the
OPCFoundation.NetStandard.Opc.Ua.Bindings.Httpspackage (net10+ only) - Surfaced via
Profiles.HttpsOpenApiTransport
- Path-routed REST surface:
-
WSS OpenAPI (
opc.wss://andwss://) - OPC UA OpenAPI Mapping over secure WebSockets (Part 6 §7.5.2, sub-protocolopcua+openapi/opcua+openapi+<accesstoken>) — official OPC Foundation profile/2339, URIhttp://opcfoundation.org/UA-Profile/Transport/wss-uajson-openapi- Same on-wire
{TypeId, Body}OPC UA JSON envelope asopcua+uajson, multiplexed over WebSocket text frames; distinguished by the negotiated sub-protocol and the advertised TransportProfileUri - Bearer-token variant negotiates the access token in the sub-protocol name (no
Authorizationheader — required for browser fetch compatibility); the server extracts the token from the sub-protocol name and feeds it through the standardISessionlessIdentityProviderpipeline - Server-side discovery emission: the WSS factories emit this sub-profile as a discovery-only twin alongside each
SecurityMode.NoneWSS binary endpoint, mirroring the HTTPS OpenAPI emission. - Client surface:
src/Opc.Ua.Client/WebApi/WebApiWssTransportChannel.cs; fluent shortcutManagedSessionBuilder.UseWssOpenApiEndpoint(url); DI registration viaservices.AddWebApiTransportChannel()(registers both HTTPS and WSS WebApi channel factories). - Surfaced via
Profiles.WssOpenApiTransport
- Same on-wire
The PubSub library supports the following PubSub transport
facets (URIs surfaced by Profiles.PubSub*Transport constants in
src/Opc.Ua.Core/Security/Constants/SecurityConstants.cs). Facet
machinery and conformance unit semantics are defined by
Part 7 §4.3.
- PubSub UDP UADP — UDP transport with UADP message encoding.
- PubSub Ethernet UADP — Ethernet (Layer 2) transport with UADP message encoding (see PubSub transports).
- PubSub MQTT UADP — MQTT transport with UADP message encoding.
- PubSub MQTT JSON — MQTT transport with JSON message encoding.
- PubSub Kafka UADP
and PubSub Kafka JSON -
Part 14 Annex B.2 broker mapping through
Opc.Ua.PubSub.Kafka; see Kafka transport and backend limits. - DTLS over UDP - supported registered profiles use the UDP transport's platform/cryptographic capabilities; Curve25519/Curve448 DTLS profiles are not registered. See PubSub security limits.
- Datagram-v2 connection profile —
DatagramConnectionTransport2DataType(Part 14 §6.4.1.4) is honoured for UDP transports. TheDiscoveryAnnounceRate,DiscoveryMaxMessageSize, andQosCategoryfields drive discovery cadence and the IP DSCP TOS byte. - PubSub SKS pull / push —
Part 14 §8.5.1
/ §8.5.2: the
AddPubSubSecurityKeyServiceClientextension implements the pull client (callsGetSecurityKeyson a remote SKS), andAddPubSubSecurityKeyServiceServerhosts the in-memory SKS withGet/SetSecurityKeysandAddSecurityGroupmethods bound on the address space. - AES-128-CTR / AES-256-CTR with HMAC-SHA-256 —
Part 14 §8.4.3
message security. Profiles registered as
PubSubAes128CtrPolicy/PubSubAes256CtrPolicy; conformance to NIST SP 800-38A F.5.1 / F.5.5 is asserted by the test suite. - Anonymous certificate-based MQTT auth — the MQTT transport
exposes the
MqttClientAuthenticationOptionswith the certificate-based variant from Part 14 §6.4.2.2.4.
PubSub additionally supports certificate-based MQTT authentication and
considers WriterGroups in MQTT keep-alive calculations.
All transport profiles defined in OPC UA Part 6 §7.4 (HTTPS) and §7.5
(WebSockets) are supported, including the opcua+openapi and
opcua+openapi+<accesstoken> WebSocket sub-protocols (Part 6 §7.5.2
Table 81).
The stack supports the following security profiles for secure
communication. The canonical set is defined in
src/Opc.Ua.Core/Security/Constants/SecurityPolicies.cs.
- Basic256Sha256
- 256-bit AES encryption
- RSA-OAEP for key encryption
- HMAC-SHA256 for message authentication
- Minimum key size: 2048 bits
- Aes128_Sha256_RsaOaep
- 128-bit AES encryption
- RSA-OAEP for key encryption
- HMAC-SHA256 for message authentication
- Aes256_Sha256_RsaPss
- 256-bit AES encryption
- RSA-PSS signatures
- HMAC-SHA256 for message authentication
ECC support is documented in detail in ECC Profiles.
- ECC_nistP256 — NIST P-256 with SHA-256
- ECC_nistP384 — NIST P-384 with SHA-384
- ECC_brainpoolP256r1 — Brainpool P-256r1 with SHA-256
- ECC_brainpoolP384r1 — Brainpool P-384r1 with SHA-384
- ECC_curve25519 — Curve25519 with ChaCha20-Poly1305
- ECC_curve25519_AesGcm — Curve25519 with AES-GCM
- ECC_curve448 — Curve448 with ChaCha20-Poly1305
- ECC_curve448_AesGcm — Curve448 with AES-GCM
Modern AEAD cipher alternatives for traditional ECC curves:
- ECC_nistP256_AesGcm, ECC_nistP256_ChaChaPoly
- ECC_nistP384_AesGcm, ECC_nistP384_ChaChaPoly
- ECC_brainpoolP256r1_AesGcm, ECC_brainpoolP256r1_ChaChaPoly
- ECC_brainpoolP384r1_AesGcm, ECC_brainpoolP384r1_ChaChaPoly
- RSA_DH_AesGcm — RSA Diffie-Hellman key agreement with AES-GCM
- RSA_DH_ChaChaPoly — RSA Diffie-Hellman key agreement with ChaCha20-Poly1305
Platform requirements for ECC. Certificate creation, storage, and validation
are distinct from ECC SecureChannel and user-token security policies. On .NET 10.0 or
later those policies use the platform's raw ECDH agreement and authenticated ciphers;
on .NET Framework the agreement and the AES-GCM and ChaCha20-Poly1305 ciphers run in
the managed BouncyCastle implementation. Curve and cipher availability also depends on
the OS and, on .NET 10+, the runtime probes
(AesGcm.IsSupported / ChaCha20Poly1305.IsSupported). See the
ECC platform limitations for the certificate-operation
and channel-policy boundaries. PubSub has its own
transport security limits.
The following security policies are deprecated but still supported for backward compatibility:
- Basic256 — uses SHA-1
- Basic128Rsa15 — uses SHA-1 and RSA-PKCS#1 v1.5
Note. SHA-1 signed certificates are rejected by default
(RejectSHA1SignedCertificates configuration option). These deprecated
policies should only be enabled for compatibility with legacy systems.
- None — No security.
- For testing or isolated networks only.
- Not recommended for production environments.
The stack supports the following user authentication mechanisms:
- Anonymous — No user authentication.
- Username / Password — User credentials encrypted using the active security policy.
- X.509 Certificate — User authentication via X.509 certificates.
- Issued Token — Includes JSON Web Tokens (JWT) and other
IssuerEndpointUrl-driven flows (OAuth2 / OIDC / Entra). The
Identity Providers pluggable model
(
IClientIdentityProvider,IUserTokenAuthenticator,IAccessTokenProvider,ITokenIssuer,IIdentityClaims) is the recommended way to wire these in.
The stack supports the following certificate types for application authentication:
- RsaSha256ApplicationCertificateType — RSA with SHA-256 signatures
- Default minimum key size: 2048 bits
- Recommended for production use
- EccNistP256ApplicationCertificateType
- EccNistP384ApplicationCertificateType
- EccBrainpoolP256r1ApplicationCertificateType
- EccBrainpoolP384r1ApplicationCertificateType
The RejectSHA1SignedCertificates configuration option (on by default)
prevents SHA-1 signed certificates from being accepted. See
Certificates and Certificate Manager
for storage, ref-counted lifetime, and the segregated-interface design.
The stack ships a Global Discovery Server implementation covering the following OPC UA Part 12 areas:
- Application registration and discovery.
- Pull and Push certificate-management models, including pushing to arbitrary certificate groups and custom certificate groups on the GDS itself.
- Sub-CA revocation without auto-creating an empty CRL.
- Support for both RSA and ECC certificate types and CRLs.
- AuthorizationService (OPC 10000-12 §9) —
OAuth2-style
StartRequestToken/FinishRequestTokenissuance with a pluggableIAccessTokenProvider/ITokenIssuer. - KeyCredentialService (OPC 10000-12 §8) —
Credential issuance for non-OPC UA services such as MQTT brokers and
REST APIs, backed by
IKeyCredentialRequestStore/ISecretStore. - Device registrar components (OPC 10000-21) -
Validated ticket administration, ticket signing, composite-aware identity
selection, ticket-scoped identity trust, registrar authorization and shared
certificate issuance, typed pull/push workflows, and a singleton device host
with retained factory credentials and security reset. Providers own software
approval and state retention; restart durability depends on selecting a
durable provider. The bounded push scheduler accepts work in process and does
not persist the queue. Registrar push provisions managed Client
applications and supports managed Server/ClientAndServer applications when
the host supplies authoritative discovery URLs, installed certificates,
endpoints, user identities and explicit client trust. The default managed-
application verifier supports UA-TCP and HTTPS with independently validated
TLS and application identities. The sample can be configured for
one managed Server or ClientAndServer application after DCA proof. The
provisionable-device factory adds a Part 22
Resourcesparent reference, but shared Resources manager integration is not implemented. Registrar push uses the configured certificate type by default and permits a host-selected type for each managed application; the selected type must be advertised by its certificate group. Per-entry remoteConfigurationFileupdate/confirm and restart recovery use optional application-scoped Part 12 providers. The originally selected certificate type is retained during recovery. The optional external-authentication handoff uses an injectable provider for dedicated CA trust and configured product/DCA approval; typed external pull and registrar push reuse the existing lifecycle. FDO protocols and credential installation remain external. Connected recovery fixtures are present; their execution status is tracked separately. See the implemented scope.
See the GDS Developer Guide for the implemented facets, provider-dependent
features, partial support, and hosting integration. This is not a claim that every
optional Part 12 function is implemented or certified. The Local Discovery Server is a separate library
(Opc.Ua.Lds.Server) and reference application (ConsoleLdsServer) that
advertises the
Local Discovery Server 2017
facet.
The stack supports the following message encoding formats:
- UA Binary — OPC UA binary encoding (primary for UA-TCP and HTTPS).
- UA XML — OPC UA XML encoding (for configuration import / export and PubSub Dataset XML).
- UA JSON — OPC UA JSON encoding for PubSub MQTT.
- UADP — UA Data Protocol for PubSub.
The 2.0 release ships a new JSON decoder / encoder, array / matrix
abstractions, and a ByteString type. See the
2.0 migration guide — Encoders and Complex Types
for the encoder/decoder migration details and
Complex Types for client-side decode of
server-defined types.
- OPC UA Specification: Version 1.05.07.
- Certification: Historical reference-server certification does not establish certification of the current release or of an application built with the SDK. Verify the certificate and tested profile scope for the exact product version.
- Testing: Automated repository tests provide implementation evidence, not a substitute for certification. The GDS conformance matrix explicitly distinguishes its test evidence from CTT results.
- Companions and extensions: The catalogue above records implemented interfaces and explicit gaps, not automatic whole-specification conformance. Selected instances, providers, endpoint security and actual advertised CUs determine an application's claim; package channel is a separate policy.
- Redundancy (Part 4 §6.6): Server and client redundancy are implemented
(opt-in) —
RedundancySupport,Server.ServiceLevel, non-transparent (ServerUriArray/RedundantServerArray) and transparent (CurrentServerId) modes,RequestServerStateChange, and client-side transparent failover viaManagedSession.WithServerRedundancy(); see High Availability.
Server profiles are configured in the server configuration file using the
ServerProfileArray element. The reference server's default array is:
<ServerConfiguration>
<!-- see https://profiles.opcfoundation.org/ for the canonical list of profile and facet URIs -->
<ServerProfileArray>
<ua:String>http://opcfoundation.org/UA-Profile/Server/StandardUA2017</ua:String>
<ua:String>http://opcfoundation.org/UA-Profile/Server/DataAccess</ua:String>
<ua:String>http://opcfoundation.org/UA-Profile/Server/Methods</ua:String>
<ua:String>http://opcfoundation.org/UA-Profile/Server/ReverseConnect</ua:String>
<ua:String>http://opcfoundation.org/UA-Profile/Server/ClientRedundancy</ua:String>
</ServerProfileArray>
</ServerConfiguration>To advertise additional facets (Historical Access, Aggregates, Alarms &
Conditions, File Access, Auditing, NodeManagement, State Machine, etc.)
look up the canonical URI for the facet on
https://profiles.opcfoundation.org/ and add it to ServerProfileArray.
Only advertise a facet that the application implements — the
Compliance Test Tool will exercise every claimed facet. Bringing the
reference-server and CTT configs in line with the facets the stack
actually implements is tracked in
#3875.
Node managers that implement IConformanceContributor, such as the
companion node managers, contribute the facets and conformance units they
actually wire. At startup the server registers them with the
ConformanceUnitsManager and publishes the aggregate to
Server/ServerCapabilities/ConformanceUnits and ServerProfileArray.
The startup lifecycle republishes after the actual endpoint descriptions are
installed, so security-dependent companion claims are evaluated against real
endpoint policies rather than a placeholder registry.
The manager keeps the registered contributors and reads them again on every
PublishAsync, because the ServerCapabilities describe the current
configuration of the server (OPC 10000-5 §6.3.2). A contributor whose
support changes at runtime calls PublishAsync afterwards (the manager is
ServerInternalData.ConformanceUnitsManager); a unit or profile
that no contributor reports any more is withdrawn. Unregister removes a
contributor. The profiles from the ServerProfileArray configuration are
always kept.
Security policies are configured in the SecurityPolicies section:
<SecurityPolicies>
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep</SecurityPolicyUri>
</ServerSecurityPolicy>
<!-- ECC security policies -->
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256</SecurityPolicyUri>
</ServerSecurityPolicy>
</SecurityPolicies>See the reference server configuration file
for a complete example, or the
CTT configuration file
for the variant selected by --ctt.
- What's New in 2.0 — Narrative tour of the 1.5.378 → 2.0 changes, grouped by theme and layer.
- Migration Guide — Prescriptive, per-API migration reference.
- Subscriptions and Monitored Items —
V2
ISubscriptionManager, declarative + imperativeSetTriggering(N:M, replay on recreate / reconnect), andIStreamingSubscription. - Async Server Support — TAP-based
AsyncCustomNodeManagerand theIAsyncNodeManagerfamily. - Dependency Injection —
services.AddOpcUa()and theIOpcUaBuilderhosting surface. - Native AOT — AOT publishing, AOT-clean source generators, and the AOT test matrix.
- Alarms and Conditions (Part 9)
- Historical Access (Part 11)
- Aggregates (Part 13)
- State Machines (Part 16)
- Alias Names (Part 17)
- Base Network Model (Part 22, provider and simulation boundaries)
- Role-Based User Management (Part 18)
- Identity Providers
- Authorization Service (Part 12 §9)
- Key Credential Service (Part 12 §8)
- GDS Developer Guide (Part 12 implemented, partial and provider-gated areas)
- File System Client (Part 20)
- Device Integration (Part 100)
- Relative Spatial Location and Global Positioning (Parts 210 and 211)
- Industrial Automation (OPC 10000-200)
- Robotics (OPC 40010-1 over OPC 10000-200)
- Software Update
- WoT Connectivity (OPC 10100-1)
- Node Management (Part 4)
- Asset Management Basics (OPC 10000-110)
- Machinery (OPC 40001 series, PA-DIM and ECM)
- Energy Consumption Management (OPC 34100)
- PA-DIM (OPC 30081)
- Pumps (OPC 40223)
- AutoID Devices (OPC 30010)
- Scales (OPC 40200 and PackML)
- ISA-95 (OPC 10030 and OPC 10031-4)
- MachineTool and WMTP (OPC 40501-1 and OPC 40505)
- Geometric Measurement Systems (OPC 40210)
- Cranes and Hoists (OPC 40020-1; preview packages)
- Machine Vision and Perception (released OPC 40100-1/-2 and a distinct draft model)
- AI Model Management, xRegistry and OpenUSD (draft extensions)
- Session-less invocation (Part 4 §6.3)
- Generation-bound session clients
- PubSub (Part 14 transports and platform limits)
- WoT Binding (OPC 10101 published consumer mode and gaps)
- Laboratory and Analytical Devices (OPC 30500-1)
- Plastics and rubber common capabilities (OPC 40083 and OPC 40082-6 granulate drying)
- Extrusion (OPC 40084 parts 1-12)
- OPC Foundation Profile Reporting — canonical profile and facet URI registry.
- OPC UA Online Reference — published core and companion specifications and their latest listed versions.
- OPC UA Compliance Test Tool (CTT) — official conformance test tool.
This table includes all 149 specifications listed on the OPC Foundation online reference index when checked on 2026-11-02. Versions reproduce the index's latest listed version for each document, including its original number formatting; they are not NuGet package versions or a statement that every shipped model has that exact revision. Specification names are shortened where needed. Each part of a multipart specification has its own row.
Support describes the implementation in this repository:
- Full: the specification's applicable SDK model and protocol behavior are implemented, with no known functional gap identified in the linked guide. Applications must still select optional capabilities and supply the required equipment, execution and persistence providers.
- Partial: some model, protocol or tooling support exists, but an identified runtime, facet or validation gap remains. Generated declarations alone count as Partial, not a complete runtime implementation.
- No: no specification-specific implementation is shipped. Generic OPC UA browsing, NodeSet import or source generation can help an application implement the specification, but do not change this rating.
These are implementation ratings, not OPC Foundation certification results,
not a promise that every optional facet is enabled, and not an application's
ServerProfileArray. For concepts and guidance documents, the rating refers
to their application in the SDK rather than a separately executable protocol.
The catalogue and linked guides identify
implementation evidence and provider boundaries. The final column records
specific gaps for Partial entries and implementation boundaries where they
clarify Full support; it does not repeat ordinary provider requirements.
The model-only core entries refer to declarations in the shipped
core NodeSet; their presence
does not establish executable management, serialization or logging methods.