Skip to content

MindConnect MQTT API

Idea

The MindConnect MQTT API provides functionality for applications to manage the certificates for securely connecting the MQTT agents with Industrial IoT. With appropriate authentication, the API can be easily integrated into applications hosted in an enterprise system or likewise.

For further information about the MindConnect MQTT Sync API, refer to the MindConnect MQTT API specification.

Info

  • The MindConnect MQTT Service is currently available in the region Europe 1 and Private Cloud.
  • MindConnect MQTT Service is not available for VPC.

Access

For accessing this service, your application or service needs to have the respective roles listed in MindConnect MQTT roles and scopes.

Basics

CA Certificate

All MQTT-based devices that wish to connect to Insights Hub must authenticate using a unique certificate identity.

Registration Code

The user needs to get the registration code to use it as the common name of the verification certificate.

Verification Certificate

For Insights Hub to make sure that the certificate uploader also possesses the corresponding private key, the user needs to prove the possession of the private key by issuing a verification certificate with the common name provided by Insights Hub using the private key.

Credentials

Credentials provide an alternative authentication mechanism for MQTT clients connecting to Insights Hub. Instead of using certificate-based authentication, tenants can manage username/password-based client credentials for MQTT client access.

Each credential is associated with a specific clientId and consists of:

  • Username – A unique identifier assigned to the MQTT client.
  • Password – A secret value used together with the username to authenticate the client connection to the MQTT broker.
  • Client ID – The identifier that links the credential to a specific MQTT client.

Info

Credentials management is only available in Private Cloud.

Connection Methods

When using basic authentication (credentials), MQTT clients can connect to the broker using one of the following methods:

  • TLS-secured MQTT connection (port 30543) – The client connects over an encrypted TLS channel, ensuring that credentials and data are protected in transit. This is the recommended connection method.
  • Direct MQTT connection (port 30361) – The client connects without TLS encryption.

Warning

Direct MQTT connections are not recommended due to security risks. Without TLS, credentials are transmitted in plain text and are vulnerable to interception. Always use a TLS-secured connection to protect sensitive data.

Auto-Generated Agent Certificate

The MQTT agent needs to authenticate with an agent certificate. MindConnect MQTT agents can request auto-generated agent certificate using the "create auto-generated agent certificate" endpoint. It is available in the region Europe 1.

Agent Certificate

An agent can be onboarded using an agent certificate issued by the environment's CA certificate.

To successfully connect, onboard, and communicate with the MQTT broker, each client needs to use a clientId in the following format:

<clientId>=<tenant>_<AgentCertificate.Subject.CommonName>

Features

The MindConnect MQTT exposes its API for realizing the following:

  • Upload a new CA certificate
  • Get the uploaded CA certificates
  • Get the CA Certificate with ID
  • Delete the CA certificate by ID
  • Verify the existing CA certificate
  • Get a CA certificate's registration code

The following credentials endpoints are currently available in Private Cloud:

  • Get all client credentials
  • Create or update client credentials
  • Reset client credentials
  • Get client credentials details

The following tasks are currently available in the region Europe 1:

  • Create auto-generated agent certificate
  • Get auto-generated agent certificates
  • Get auto-Generated Agent Certificate with ID
  • Delete auto-Generated Agent Certificate by ID

Limitations

In order to give optimal performance, MindConnect MQTT API provides technical limits on API usage and resources which needs to be incorporated while using it. API technical limits are documented in the MindConnect MQTT - Usage quota and limits chapter.

The following are the technical limits for resource usage:

Resource Technical Limit
Maximum CA certificates count per environment 2

Note

These limits are enforced on Capability Package based environments only.

Example Scenario

The ACME company has an IT department regulating the security of the enterprise. The security system manages the issuing of the device certificates using an enterprise application. This system has authorized the administrators to upload the CA and verification certificates using these APIs. This application issues the device certificates to IT users when they want to connect the device.

Last update: June 18, 2026

Except where otherwise noted, content on this site is licensed under the Development License Agreement.