HTTP API reference

CP Word List exposes a small HTTP API at https://wordlist.lanpulse.com. Most integrators only need the workflow setup, which wires these up for you — but the endpoints can be called directly for custom integrations.

POST /api/change-dpsk

Looks up the DPSK for an enrollment and replaces it with a word-based passphrase. Also accepts GET. This is the endpoint your Cloudpath notification step calls.

Parameters (query string, or form body on POST):

Parameter	Description
secret	Your tenant Shared Secret. Identifies and authorizes the tenant.
enrollmentId	The Cloudpath enrollment ID. Must start with Enrollment- or Message- (e.g. Enrollment-abc123).

Success (200):

{ "success": true, "enrollmentId": "...", "dpskGuid": "...", "dpskName": "...", "passphrase": "apple-red-truck" }

Errors:

Code	Meaning
401	Missing secret, or no active tenant matches it.
400	Missing enrollmentId, invalid enrollmentId format, or the tenant isn’t fully configured.
404	Enrollment not found, or no DPSK is assigned to it.
409	A device is already connected on the DPSK, or three generated phrases in a row collided with existing DPSKs — either way the passphrase is not changed.
500	The DPSK’s resource links from Cloudpath couldn’t be parsed.
502	Cloudpath API authentication failed or the server was unreachable.

If Cloudpath itself rejects the passphrase update, the service relays Cloudpath’s status code and includes its message in a detail field.

Note

If a generated phrase collides with an existing DPSK in the pool, the service retries with a new phrase up to 3 times before giving up.

GET /api/get-dpsk

Returns the new passphrase for a given old DPSK. Used by the display-page snippet.

Parameters (query string):

Parameter	Description
dpsk	The old DPSK passphrase (the lookup key).
tenant	Your Tenant ID.

Success (200):

{ "success": true, "passphrase": "apple-red-truck", "dpskGuid": "...", "dpskName": "..." }

Behavior and errors:

Code	Meaning
400	dpsk or tenant is missing.
404	No mapping was found — it expired, or the change hasn’t happened yet. Also returned when tenant matches no account.

If dpsk already matches the word-word-word format, it’s echoed back immediately with no cache lookup — this is how returning users get an instant answer. Otherwise the mapping is looked up, and mappings expire 5 minutes after the change.

Responses carry Access-Control-Allow-Origin set to your Cloudpath server’s origin (https://<your-fqdn>), so other sites can’t read a cached mapping from a browser. When the tenant parameter matches no account, or that account has no FQDN saved, the header falls back to *; the only body such a response can carry is an error or the caller’s own dpsk echoed back. The OPTIONS preflight answers 204 and allows any origin, because the tenant isn’t known until the GET arrives.

GET /api/health

A simple liveness check. Returns:

{ "status": "ok", "service": "cp-wordlist" }

Cloudpath REST API calls

During one passphrase change, CP Word List makes these calls to your Cloudpath server’s REST API, in order:

Step	Call	Purpose
1	POST /admin/publicApi/token	Authenticate. Returns a JWT valid for 5 minutes.
2	GET /admin/publicApi/enrollments/{enrollmentId}/dpsks	Find the DPSK(s) for the enrollment.
3	GET /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}	Fetch the full DPSK object (required before updating).
4	PUT /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}	Write back the object with the new passphrase.

Credentials are decrypted only at the moment of use — see Security controls.

Note

There is no public endpoint that takes a hostname or URL from the caller. The Cloudpath server the service contacts is always the FQDN saved on your account, and Test Connection runs from your signed-in dashboard session (POST /dashboard/test-connection), not from the public API.

Next steps

• Add the enrollment workflow steps — the supported way to call change-dpsk.
• Troubleshooting — what to do about each error code in practice.
• Passphrase format and strength — what the passphrase field always looks like.