Add the enrollment workflow steps

CP Word List hooks into your existing Cloudpath DPSK enrollment workflow with two steps. Both must come after the “Generate a DPSK” step — the DPSK has to exist before the service can look it up and change it. The exact values you paste (API Call URL and snippet) are shown pre-filled on the dashboard’s Cloudpath Workflow Setup section; copy them from there so they carry your Tenant ID, Shared Secret, and SSID name.

1. Add a “Send a notification” step

   Place it after “Generate a DPSK”, then:

   • Set Display Name to something descriptive, e.g. API-word-list.

   • Check Notification Enabled.

   • Set Notification Method to Call a URL (REST API).

   • Fill in the call. The dashboard shows two forms, and the service accepts either:

     Form	What you paste
     Recommended: POST with a body	URL https://wordlist.lanpulse.com/api/change-dpsk, method POST, and the form-encoded body enrollmentId=${GUID}&secret=<your-shared-secret>
     URL only	https://wordlist.lanpulse.com/api/change-dpsk?enrollmentId=${GUID}&secret=<your-shared-secret>

     ${GUID} is a Cloudpath template variable that resolves to the enrollment ID at runtime. <your-shared-secret> is your tenant Shared Secret — the dashboard fills this in for you. The POST form keeps the secret out of the request URL. Use it if your Cloudpath notification step lets you set the method and a request body; otherwise use the URL-only form, which still works.

   • Click Save.

   This step is invisible to the user. It’s what triggers the passphrase change on your controller.

2. Add a “Display a message” step

   Place it after the notification step, then:

   • Enter an HTML Title, e.g. Your Wi-Fi Password.
   • In the HTML Message field, paste the snippet shown on the dashboard. The snippet displays the new word-based passphrase and tells the user which SSID to connect to. It already contains your SSID name and Tenant ID.
   • Uncheck Show continue button and check Kill Session to close the enrollment cleanly.
   • Click Save.

   Note

   The snippet has a built-in 15-second timeout. If it can’t get the new phrase in time, it shows the original Cloudpath passphrase instead. That passphrase works if the change never happened (for example, CP Word List was unreachable), but not if the change succeeded and only the lookup failed. See How enrollment and fallback work.

3. Publish the workflow

   Click Publish at the top of the workflow editor to make your changes live. Then enroll a test device: the display page should show a three-word passphrase like apple-red-truck.

Cloudpath template variables

These are substituted by Cloudpath at runtime:

Variable	Meaning
${GUID}	The enrollment ID for the session (e.g. Enrollment-abc123). Used in the API Call URL to identify which DPSK to change.
${DPSK}	The current DPSK for the enrollment. In the display step this is the old passphrase (already replaced on the controller), used by the snippet as a lookup key. On re-enrollment it’s already in word-list format.

Next steps

• How enrollment and fallback work — what these two steps actually do at enrollment time.
• Passphrase format and strength — what the user will see on the display page.
• Troubleshooting — if the test passphrase still shows as a random string.