HTTP API reference

CP Word List exposes a small HTTP API at https://wordlist.lanpulse.com. Most integrators only need the workflow setup, which wires these up for you — but the endpoints can be called directly for custom integrations.

POST /api/change-dpsk

Looks up the DPSK for an enrollment and replaces it with a word-based passphrase. Also accepts GET. This is the endpoint your Cloudpath notification step calls.

Parameters (query string, or form body on POST):

Parameter	Description
secret	Your tenant Shared Secret. Identifies and authorizes the tenant.
enrollmentId	The Cloudpath enrollment ID. Must start with Enrollment- or Message- (e.g. Enrollment-abc123).

Success (200):

{ "success": true, "enrollmentId": "...", "dpskGuid": "...", "dpskName": "...", "passphrase": "apple-red-truck" }

Errors:

Code	Meaning
401	Missing secret, or no active tenant matches it.
400	Missing enrollmentId, invalid enrollmentId format, or the tenant isn’t fully configured.
404	Enrollment not found, or no DPSK is assigned to it.
409	A device is already connected on the DPSK — the passphrase is not changed.
502	Cloudpath API authentication failed or the server was unreachable.

Note

If a generated phrase collides with an existing DPSK in the pool, the service retries with a new phrase up to 3 times before giving up.

GET /api/get-dpsk

Returns the new passphrase for a given old DPSK. Used by the display-page snippet.

Parameters (query string):

Parameter	Description
dpsk	The old DPSK passphrase (the lookup key).
tenant	Your Tenant ID.

Success (200):

{ "success": true, "passphrase": "apple-red-truck", "dpskGuid": "...", "dpskName": "..." }

Behavior and errors:

• If dpsk already matches the word-word-word format, it’s returned as-is with no lookup — this is how returning users get an instant answer.
• 404 — no mapping was found. Mappings expire 5 minutes after the change.
• Responses are CORS-scoped to your Cloudpath server’s origin.

GET /api/health

A simple liveness check. Returns:

{ "status": "ok", "service": "cp-wordlist" }

Cloudpath REST API calls

During one passphrase change, CP Word List makes these calls to your Cloudpath server’s REST API, in order:

Step	Call	Purpose
1	POST /admin/publicApi/token	Authenticate. Returns a JWT valid for 5 minutes.
2	GET /admin/publicApi/enrollments/{enrollmentId}/dpsks	Find the DPSK(s) for the enrollment.
3	GET /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}	Fetch the full DPSK object (required before updating).
4	PUT /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}	Write back the object with the new passphrase.

Credentials are decrypted only at the moment of use — see Security controls.