HTTP API reference

CP Word List exposes a small HTTP API at https://wordlist.lanpulse.com. Most integrators only need the workflow setup, which wires these up for you — but the endpoints can be called directly for custom integrations.

POST /api/change-dpsk

Looks up the DPSK for an enrollment and replaces it with a word-based passphrase. Also accepts GET. This is the endpoint your Cloudpath notification step calls.

Parameters (form-encoded body on POST, or query string on POST or GET). Sending them in a POST body is recommended, because it keeps the Shared Secret out of the request URL. If a parameter appears in both, the query string value wins:

Parameter	Description
secret	Your tenant Shared Secret. Identifies and authorizes the tenant.
enrollmentId	The Cloudpath enrollment ID. Must start with Enrollment- or Message- (e.g. Enrollment-abc123).

Success (200):

{ "success": true, "enrollmentId": "...", "dpskGuid": "...", "dpskName": "...", "passphrase": "apple-red-truck" }

Errors:

Code	Meaning
401	Missing secret, or no active tenant matches it.
400	Missing enrollmentId, invalid enrollmentId format, or the tenant isn’t fully configured.
404	Enrollment not found, or no DPSK is assigned to it.
409	A device is already connected on the DPSK, or three generated phrases in a row collided with existing DPSKs — either way the passphrase is not changed.
500	The DPSK’s resource links from Cloudpath couldn’t be parsed.
502	Cloudpath API authentication failed or the server was unreachable.

If Cloudpath itself rejects the passphrase update, the service relays Cloudpath’s status code and includes its message in a detail field.

Note

If a generated phrase collides with an existing DPSK in the pool, the service retries with a new phrase up to 3 times before giving up.

GET /api/get-dpsk

Returns the new passphrase for a given old DPSK. Used by the display-page snippet.

Parameters (query string):

Parameter	Description
dpsk	The old DPSK passphrase (the lookup key).
tenant	Your Tenant ID.

Success (200):

{ "success": true, "passphrase": "apple-red-truck", "dpskGuid": "...", "dpskName": "..." }

Behavior and errors:

Code	Meaning
400	dpsk or tenant is missing.
404	No mapping was found — it expired, or the change hasn’t happened yet. Also returned when tenant matches no account.

If dpsk already matches the word-word-word format, it’s echoed back immediately with 200 and no cache lookup, even when tenant matches no account — this is how returning users get an instant answer. tenant must still be present (without it the response is 400), and when it matches no account the 200 carries no CORS header, so a browser blocks it. Otherwise the mapping is looked up, and mappings expire 5 minutes after the change.

Responses carry Access-Control-Allow-Origin set to your Cloudpath server’s origin (https://<your-fqdn>), so other sites can’t read a cached mapping from a browser. When the tenant parameter matches no account, or that account has no FQDN saved, the header is omitted, so browsers refuse the response. The OPTIONS preflight answers 204 and is scoped the same way: it reads tenant from the query string and allows only that tenant’s Cloudpath origin, with no CORS headers for an unknown tenant.

GET /api/health

A simple liveness check. Returns:

{ "status": "ok", "service": "cp-wordlist" }

Cloudpath REST API calls

During one passphrase change, CP Word List makes these calls to your Cloudpath server’s REST API, in order:

Step	Call	Purpose
1	POST /admin/publicApi/token	Authenticate. Returns a JWT valid for 5 minutes.
2	GET /admin/publicApi/enrollments/{enrollmentId}/dpsks	Find the DPSK(s) for the enrollment.
3	GET /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}	Fetch the full DPSK object (required before updating).
4	PUT /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}	Write back the object with the new passphrase.

Credentials are decrypted only at the moment of use — see Security controls.

Note

There is no public endpoint that takes a hostname or URL from the caller. The Cloudpath server the service contacts is always the FQDN saved on your account, and Test Connection runs from your signed-in dashboard session (POST /dashboard/test-connection), not from the public API.

Next steps

• Add the enrollment workflow steps — the supported way to call change-dpsk.
• Troubleshooting — what to do about each error code in practice.
• Passphrase format and strength — what the passphrase field always looks like.