ci-server-engineer/knowledge/manuals/IM36K10L45-01EN.md

---
manual: IM 36K10L45-01EN
title: Data Access Engineering
edition: 5th Edition, Feb. 2026 (R1.05); first summarised from the 3rd Edition, Sep. 2023 (R1.03)
version: R1.05 (first written for R1.03)
status: from docs. R1.03 (2026-10-01): installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA). R1.05 (2026-10-08, read-only on the test server): setup files (opxuas.sup, opxsys.sup, epauac_eqp.sup, opxuac_mon.sup, odbsrv.sup, dbc.sup, jrstsrv.sup, dssana.sup), ServerConfig.xml, PKI folders, processes, ports, data dictionary and dataset definitions compared with R1.03; loopback not re-run. ODBC not working on either system (ISS-008); OPC DA/A&E, RESTful API calls, methods and the imported information model from docs
---

# Data Access Engineering (R1.05)

ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), the
**RESTful API** (R1.04+), **OPC Classic** (DA and A&E, client and server, DCOM) and **OPC UA**
(client and server). Section numbers refer to the 5th edition. R1.04 inserted ch. 4 (RESTful
API), so OPC chapters moved up by one compared with R1.03 (R1.03 §4–§10 = R1.05 §5–§11; in the
OPC UA client chapter R1.03 §9.5–9.11 = R1.05 §10.7–10.13). Engineering Module forms:
`IM36K10E20-01EN.md`. Hands-on: skill `data-access`.

## 1. ODBC (§1–§3)

- Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client;
  **SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of
  existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be
  created or deleted over ODBC. Needs an ODBC licence.
- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
  `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
  `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). Unchanged in R1.05
  (verified).
- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
  (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
  `CiSimbaClientDriver32`, server IP and port 1583. SimbaServer is installed and removed with
  CI Server (§3.2). Delete the DSN when ODBC is no longer used. Removing Simba parts from
  before R1.03 is now in App. 1.2.
- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
  running / port mismatch / BUS Service not reachable.

**Installed (R1.03 and R1.05 test systems)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the
folder `%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
defaults once (when `%TLS_DAT_PATH%\access.new` exists).

## 2. OPC Classic basics (§5)

DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
- Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E
  quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte;
  OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised →
  NOT_CONNECTED, else GOOD.
- Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String,
  `VT_BOOL` → Boolean.
- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
  visible* (and every parent section visible).

## 3. OPC DA client (§6)

- One client process per DA line (name given in the line), started/stopped with CI Server;
  stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
  after the process; delete it (client stopped) if it gets inconsistent.
- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
  2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
  status item: 1 active / 0 not active (items offline).
- Setup (`<client>.sup`, else `opxsys.sup`; §6.3): `OPXDAC_SAFE_CON` (allow connecting to a
  CI Server DA server — **never to the own node or a DURM-connected node: deadlock**),
  `OPXDAC_PING` (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`,
  `…_HBEAT` (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`,
  `…_DISABLE_BROWSING`, `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default
  asks VT_R8), `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
- Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
  Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
  `POINT_DF` of one station made in the Engineering Module.
- **DCOM tunnelling** (§6.6): run the client on a PC in the OPC server's domain (CI Server with
  BUS, DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR
  (`durm_<n>_udp.sup`, port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to
  host* on the client's setup file; on the host add the line with *Equipment node* = tunneller
  node. Use `intmon` node monitoring with *Set slave items offline when node unavailable*.

## 4. OPC DA server (§7)

- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
  COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
- Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE
  pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue
  overflow. Timestamp = time written into the server cache.
- `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`,
  `OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access,
  fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL`
  (not described).
- Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation
  Identify, access/launch permissions for an OPC account; identity of the server = that account),
  `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
  `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
  Security Tool is applied. Same account/password on both sides in a workgroup.
- Troubleshooting (§7.9): `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
  `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
  `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.

## 5. OPC A&E client and server (§8, §9)

- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
  (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
  `…_TRACE`); maps condition events to items; one server per client advised.
- Server `opxaes`, ProgID `Yokogawa.CIOpcAes.<version>`, DUR name `OPXAES`; publishes items
  with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients),
  `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
  CI Server-specific event attributes (old/new value, quality, status, alarm state, item
  description, units, node, group, number, sub-number). Installed: all on.
- Installed R1.05 only (verified 2026-10-08, not in the manual, ISS-085): `OPXAES_DIR_ALM`
  (YES) switches "Direct" alarm events of the A&E server.

## 6. OPC UA client (§10)

- OPC UA TCP only; security by X.509 certificates (application authentication), user
  anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
  Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
- Data types (§10.3.4, new in R1.04): Boolean → Boolean; SByte, Byte, Int16, UInt16, Int32,
  Integer → Integer; UInt32, Int64, UInt64, Float, Double, Number, UInteger, Duration → Real; String, ByteString,
  LocalizedText, DateTime / UtcTime (only `YYYY-MM-DDThh:mm:ss.sssZ`) → String of up to 250
  bytes; ExtensionObject only for EURange and EngineeringUnits; enumerations as Int32. Unsigned
  types take no negatives, 64-bit types no decimals. One array element per point (methods take
  no arrays). A failed conversion is logged and the item gets status Bad. OPC UA status →
  CI Server quality: 0 good, 1 bad, 2 uncertain.
- A&C (§10.4): **only with `OPXC_ENABLE_EXTENDED_FUNC = YES`** in the client's setup file (R1.04+,
  default NO). External alarms from ConditionType and derived types (ALARM/NORMAL events), other
  events INFORMATIONAL; filters by event type, component, event node; severity → priority
  table (901–1000 → 1 … 1–100 → 15), per station; don't manage NonExclusiveLimitAlarmType.
- Model change events (§10.5, R1.04): `GeneralModelChangeEvent` is handled per change type —
  node/reference added: the affected points are recreated; node/reference deleted: the linked
  items go offline and external alarms get a ConditionRefresh; data type changed: nothing.
  `BaseModelChangeEvent` (no detail; recreate all points and event nodes) only with
  `OPXC_BASE_MODEL_CHANGE_EVENT = YES` (default NO). Bursts within 10 s are handled once,
  handling waits during alarm floods, and the server must support Read and Browse.
- Methods (§10.6, R1.04): a CI Server object per method with attribute `MTD_KEY` and signals
  `MTD_TRG`, `MTD_RET`, `MTD_IN_ARG_n`, `MTD_OUT_ARG_n` (≤ 10 each; sample Java class
  `UAC_MTD_JBASE`); a method record per station and one point (namespace and node ID
  `CIX_UAC_MTD`, Input + Output) connected to `MTD_TRG`; symbol/display (demo
  `AOG_UAC_Method_Demo`). Dataset `OPCUAC_METHOD_CALL2_DF` (R1.03: `OPCUAC_METHOD_CALL_IN_DF` /
  `…_OUT_DF`, removed). Procedure: skill `data-access`, `opcua-client.md` §7.
- Redundancy (§10.7): no client redundancy (use HAC); servers: transparent, or non-transparent
  cold backup with two endpoints (*Active server item* 0/1/2).
- Engineering objects (§10.9): line (starts a client process; **name must start with `OPX`**,
  max 11 characters), station (= session), subscription, point (= monitored item), alarm
  component / event type filter / event node / template settings, method. The station's
  communication status item is called Boolean in §10.9.2, but IM 36K10E20 4th ed. lists states
  0–5 (ISS-080).
- Certificates (§10.9.10): the client process creates `<host>_<PROCESS>.der` in
  `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
  `OPCUAC_PKI_CERTIFICATES_DF`; verified on R1.03 and R1.05); server certificates arrive in
  `…\pkiclient\rejected` and must be trusted (Engineering Module, or move to
  `…\pkiclient\trusted\certs`); folders `deleted`, `rejected` added by CI Server. The server
  must trust the client's certificate too. Expiry warnings: see `IM36K10E20-01EN.md` §3.
- Setup (§10.11; `<process>.sup`, else the template **`epauac_eqp.sup`** — the R1.03 edition
  named `opxuac.sup`, which is not installed on R1.03 or R1.05, ISS-084): `OPXC_DUR_QUEUE_SIZE`
  (10000 kB), heartbeats, buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s),
  `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed retries every ~35 s on R1.03),
  `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and session time-outs,
  `OPXC_SERVICE_COMPLIANCE`, and new in R1.04 `OPXC_BASE_MODEL_CHANGE_EVENT`,
  `OPXC_ENABLE_EXTENDED_FUNC` (both NO). Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
- **Installed R1.05 `epauac_eqp.sup`** (verified 2026-10-08, ISS-083):
  `OPXC_SERVICE_CALL_TIME_OUT = 60` (manual default 10 s); undocumented `OPXC_DISABLE_SAV_FILE`
  (NO), `OPXC_ALARM_TIME_ATTRIBUTE` (tab *Alarm Time*), hidden `OPXC_CERT_EXP_PERIOD_WARN`
  (2 months). `opxuac_mon.sup` is unchanged from R1.03 (none of the new keywords).
- Quick load (§10.12–10.13): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`,
  `…_POINT_DF` (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected
  server (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`; R1.05 adds `REBROWSE` and
  `READ_NODE_INFO`). Line, station, subscription and point definitions are identical in R1.03
  and R1.05 (verified).
- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
- Upgrade from R1.03 (App. 1.3): set `OPXC_ENABLE_EXTENDED_FUNC` if A&C was used; methods
  driven by dataset field updates no longer work — rebuild classes (`MTD_*`, extended reset),
  symbols and displays, and re-save methods with String or Boolean input arguments. App. 1.4
  (R1.05): one class name per method object.

## 7. OPC UA server (§11)

- Since R1.04 the server offers only Data Access and methods by default. **Alarms &
  Conditions, HistoryRead and PubSub need `OPXUAS_ENABLE_EXTENDED_FUNC = YES`** in `opxuas.sup`
  (ch. 11 intro, §11.6.2; installed default NO, verified on R1.05). An upgrade with the
  automatic configuration merge sets it; otherwise set it by hand if these were used
  (App. 1.3).
- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
  opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
  and `OpxUas_Sdk*.log`.
- Visible data (§11.1.4): sections, objects, items with *OPC visible*; items also need **Read**
  (read values, browse into the item) and **Write** (write values, alarm methods). Parent
  sections must be visible. Without Read the item is listed but browsing into it fails
  (`UncertainNotAllNodesAvailable`). External alarms: OPC visible / read / write / manual reset
  in the station's alarm template settings.
- Users (§11.1.5–11.1.6): anonymous = like `OPC_UA_SERVER_READ`; authorisation actions
  `OPC_UA_SERVER_READ` (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
  Anonymous access is governed by the `dssana.sup` user interface "Anonymous Via OPC UA
  Server" (`OPXUASANY`): installed default (R1.03 and R1.05) is no login with profile
  `CI_NO_LOGIN_OPCUAS` for local clients and *Manual CI Server* for remote clients. With AD
  integration, "Via OPC UA Server" + *Automatic* needs no AD password.
- Address space (§11.3, now called the **native information model**): `Objects` → sections
  (folders) → objects → items (`CIItemNumericType`, `…BooleanType`, `…StringType`,
  `…NumericSubType`) with child nodes such as `Value`, `Status`, `Blocked`, `Offline`, `HMIInfo`,
  and alarm condition nodes. Types are in `http://www.yokogawa.com/CI_Server/` (ns 3 in the
  manual). **CI Server entities (sections, items) are in namespace
  `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing on R1.03; the manual does not
  name it, ISS-032).
- NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
  `{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
  (case sensitive; verified on R1.03). The `nsid` changes when the item is recreated — prefer
  `itnm`. `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
  BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (since R1.03).
- History (§11.3.3; extended functions): items in a history group show HistoryRead; max 5000
  values per node per call.
- Alarm methods (extended functions): Acknowledge, Confirm (= acknowledge), Disable/Enable
  (force to normal); external alarms Acknowledge/Confirm passed to the source;
  `CIManualReset` for CENTUM.
- **Imported information model (§11.4, new in R1.05)**: a standard NodeSet file (UANodeSet 1.05
  schema) is mapped to CI Server entities with the OPC UA Information Model Mapper
  (`IM36K10E20-01EN.md` §4) and loaded as `%TLS_DAT_PATH%\<queue>_<NodeSet file>.xml` (one per
  server process, reloaded at server start). Mapping: section/object → Object; method object
  (`MTD_*` class; sample `UAS_MTD_JBASE`) → Method; item/sub-item → Variable; item alarm or
  external alarm → Event. OPC visible / Read / Write still apply. Once loaded, the native model
  is hidden unless `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual name `…_NATIVE_MODEL_TREE`) is YES.
  Variables: no arrays, basic types only; out-of-range values give `BadOutOfRange` (item
  status unchanged). Method calls return OPC UA status codes (e.g. `BadUserAccessDenied`,
  `BadNotExecutable` when the item is blocked or the object not OPC visible). Rights:
  `UA_MAPPER_PROJECT_INSERT` / `_MODIFY` / `_DELETE` (in `SYSTEM_MANAGER`), dataset
  `UASERVER_MAPPER_DF`.
- `opxuas.sup` (§11.6): General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
  (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
  `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000, and new
  `…_ENABLE_NATIVE_MODEL_TREE`, `…_ENABLE_EXTENDED_FUNC`), Alarm settings (`EVENTS` = ALARM,
  ACKN, DEACT, INFO), Logging. `OPXUAS_MODEL_CHANGE_EVENTS` now needs the extended functions;
  it sends BaseModelChangeEvents (also on NodeSet load/unload) and GeneralModelChangeEvents for
  root-level entities — deeper levels need an item `NodeVersion` (or `<process>_NodeVersion`,
  OPC visible + Read) at that level.
- **Installed keyword names differ** (verified R1.03 and R1.05): `OPXUAS_DYNAMIC_SCANRATE`
  (manual `…_USE_DYNAMIC_SCANRATE`), extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034); R1.05:
  `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual `…_NATIVE_MODEL_TREE`) and hidden
  `OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) (ISS-082).
- `ServerConfig.xml` (§11.7): the manual still gives `%TLS_ROOT_PATH%\tls\exe`; **installed
  R1.05 has it only in `%TLS_SAV_PATH%`** (R1.03: `tls\exe`; ISS-081). Endpoint
  `opc.tcp://[NodeName]:34493`; trust list `…\pki\opxuas\pkiserver\trusted\certs`, rejected
  `…\pkiserver\rejected` (created at the first rejection), own certificate
  `ciserveruaserver.der`. **Installed (R1.03 and R1.05)**: only Basic256Sha256,
  Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
  anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
  ISS-034); `AutomaticallyTrustAllClientCertificates` false. The R1.05 file adds SDK sections
  (role configuration, user/password management, PubSub settings).
- First connection of any client (§11.1.6): trust the server certificate on the client, then
  move the client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
  suggested test client.
- Extra server instances (for PubSub lines or to test an information model): copy
  `ServerConfig.xml` to `<instance>_ServerConfig.xml` with another port, copy `opxuas.sup` to
  `<instance>.sup`, add a start line in `access_start.cmd`; instance names start with `OPX`
  (IM 36K10E20 4th ed. §3.4).
- Discovery (§11.8): LDS on 4840 only when several servers are on a host; GDS for central
  certificate management (concepts only).

## 8. RDBMS data exposure (not in this manual)

IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10)
and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface;
**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical;
R1.05 files re-checked 2026-10-08). Procedure: skill `data-access`, task `rdbms-exposure.md`.

- Processes `DBCSND` (sender, subscribes to DSS data) and `DBCDEM` (receiver, writes to MS SQL
  Server via ODBC); setup file `dbc.sup` (sender and receiver tabs; connection string
  `DEM_CONNECTION`, default `Driver={SQL Server};Server=localhost\SQLEXPRESS;…`).
- Exposures are records in `DATA_EXPOSURE_DF` (source dataset, remote table, filter `RECORDS`,
  up to 32 field → column pairs or all fields). The target table is created by CI Server.
- `ITEM_VALUES` exposure is driven by the per-item aggregation interval `ITEM_DF.AGG_INTERVAL`
  (60 s–7 days, 0 = off): value, min, max, average, count and a local-time `TIMESTAMP` (seconds
  since 1970) per interval.
- Filter field names must not be quoted (`NAME LIKE "<Section>*"`); the manual's quoted example
  fails and stops all exposures (ISS-057). `ITEM_HISTORY` exposure: manual vs installed change
  log disagree (ISS-058).
- The CI Service account `.\CIX_PROCESS` is local, so a remote SQL Server needs a SQL login and
  mixed mode (ISS-059).

## 9. RESTful API (§4, new in R1.04)

From docs; port 34597 listening and the `jrstsrv.sup` keywords verified on R1.05 (2026-10-08).
No request was sent.

- HTTPS server installed with CI Server and started/stopped by ACCESS Service, on a CI Core or
  on a CI Portal (reaching the core over MDUR). Not supported by CI View, Remote Connect or
  enterprise setups. Nothing to install on the client.
- Authentication: HTTP Basic (CI Server user) plus an API key sent in the `x-api-key` header.
  Keys are made in the Engineering Module (*Authorisation › Users*, *Add API Key*, type RESTful
  API), one per user; stored in dataset `API_KEYS_DF`.
- `jrstsrv.sup` (§4.2.1): `JRST_MAX_RECORDS` (records per reply, default 100),
  `JRST_USE_TWO_WAY_SSL` (default off: client trusts the server's self-signed certificate in
  `%TLS_ALLUSERS_PATH%\pki\jrstsrv\keystore`), `JRST_READ_ONLY_MODE` (default on),
  `JRST_NETWORK_PORT` (34597), `JRST_USER_CACHE_TIME` (600 s, must be > 0),
  `JRST_CUSTOM_DATASETS` (user datasets with read/write rights).
- Requests (§4.3.2): `https://<host>:34597/jrest/v2/<entity type>/<function>` with OData
  options `$filter`, `$select`, `$top`, `$skip`; replies are OData JSON. Entity sets `Tags`,
  `EventCategories`, `EventRecords`. Functions: `GetHistory` (one tag, ISO 8601 times, sample
  interval in s; highest-priority history group), `GetHistoryMultiTag` (≤ 5 tags),
  `GetEventHistory`, `GetAuditInfo`, `GetCurrentAlarms`, `AcknowledgeAlarms` (several per
  request), `UpdateItems` (value, optional quality and status — status must match
  `STATUS_DF.NAME`), `ReadDataset` and `Dataset` (PUT/PATCH/DELETE on custom datasets).
- Status codes (§4.3.3): 200, 204, 400 (bad URL or no data), 401 (rights or credentials), 404,
  405, 500, 503.