# CP Word List documentation --- --- > Cloudpath webhook Worker that replaces random DPSK passphrases with memorable three-word phrases (e.g. "apple-red-truck") during enrollment. Google sign-in; a dashboard stores Cloudpath API credentials and exports property-unit passphrase sheets. --- --- # What is CP Word List? Source: https://docs.neuralconfig.com/cp-word-list/ CP Word List is a hosted service that makes RUCKUS Cloudpath DPSK passphrases easy to read and type. When a user enrolls, Cloudpath normally hands them a random string like `x8kP2mQ9`. CP Word List replaces that string with a memorable three-word phrase such as `apple-red-truck` — and shows it to the user on the enrollment page. It runs as a Cloudflare Worker at `https://wordlist.lanpulse.com` and connects to your Cloudpath server through the Cloudpath REST API. You do not install or host anything: you sign in, connect your Cloudpath server, and add two steps to your enrollment workflow. ## Why use it - **Passphrases people can remember.** Three lowercase words joined by dashes (for example `apple-red-truck`) are far easier to read off a screen and type on a phone than a random string. See [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/). - **No change to how Wi-Fi works.** The passphrase is still a normal Cloudpath DPSK. Security, VLANs, and device limits are unchanged. - **It never blocks network access.** If the service is unreachable, the passphrase is never changed, and the enrollment page falls back to the original Cloudpath passphrase, which still works. See [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/) for the one edge case where the fallback shows a passphrase that has already been replaced. ## How it works, at a glance CP Word List plugs into your Cloudpath enrollment workflow in two steps that run after Cloudpath generates the DPSK: 1. **A notification step** (invisible to the user) calls CP Word List with the enrollment ID. The service looks up the DPSK for that enrollment, generates a memorable phrase, and updates the DPSK on your Cloudpath controller. 2. **A display-message step** (what the user sees) shows the new word-based passphrase and the name of the Wi-Fi network to connect to. For the enrollment-time detail — including re-enrollment and the fallback behavior — see [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/). ## Getting started Four things get you running: 1. [Activate your account](https://docs.neuralconfig.com/cp-word-list/getting-started/) — sign in with Google and connect your Cloudpath server. 2. [Configure your Cloudpath connection](https://docs.neuralconfig.com/cp-word-list/configuration/) — FQDN, API credentials, and SSID name. 3. [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/) in Cloudpath. 4. Enroll a test device and confirm the passphrase shows as three words. ## Explore the docs - [Activate your account](https://docs.neuralconfig.com/cp-word-list/getting-started/): Sign in with Google, accept the terms, and connect your Cloudpath server. - [Cloudpath connection settings](https://docs.neuralconfig.com/cp-word-list/configuration/): The dashboard configuration fields — FQDN, API credentials, and SSID name. - [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/): Wire CP Word List into a Cloudpath enrollment workflow, step by step. - [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/): What happens during enrollment and re-enrollment, and what happens if the service can't be reached. - [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/): Three words from a 1,294-word list, 11 to 17 characters, and what you can't change about that. - [HTTP API reference](https://docs.neuralconfig.com/cp-word-list/api-reference/): Every endpoint, including the change-dpsk Cloudpath webhook. - [Bulk DPSK export](https://docs.neuralconfig.com/cp-word-list/property-unit-export/): Generate a Cloudpath property and unit export from the dashboard. - [Security controls](https://docs.neuralconfig.com/cp-word-list/security/): AES-256-GCM encryption of Cloudpath credentials, and how access is scoped. - [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/): Accounts stuck pending review, and passphrases still arriving as random strings. - [Delete your account](https://docs.neuralconfig.com/cp-word-list/delete-account/): Remove your configuration, credentials and history yourself, and what is kept afterwards. - [Limits and quotas](https://docs.neuralconfig.com/cp-word-list/limits/): Every fixed number in one table: export size, lookup window, snippet timeout, retries, sessions, and retention. Need help? Reach the [support team](https://support.neuralconfig.com/cp-word-list?from=docs) or email `support+cp-word-list@support.neuralconfig.com`. --- # Activate your account Source: https://docs.neuralconfig.com/cp-word-list/getting-started/ Getting started with CP Word List takes three things: sign in with Google, accept the Terms and Privacy Policy, and enter your Cloudpath server address to activate the service. 1. **Sign in with Google** Go to `https://wordlist.lanpulse.com/dashboard/login` and choose **Sign in with Google**. CP Word List uses your Google account for sign-in — there is no separate password to create. The email on your Google account becomes your tenant identity. 2. **Accept the Terms and Privacy Policy** The first time you sign in, you land on a click-through screen. Check the box to accept the [Terms](https://neuralconfig.com/terms), the [Privacy Policy](https://neuralconfig.com/privacy), and the [Word List product privacy addendum](https://neuralconfig.com/privacy/cp-word-list/), then continue. Your account is created only after you accept. Your acceptance is recorded with a timestamp. :::note If the Terms or Privacy Policy are updated later, you'll be asked to accept the new version the next time you open any dashboard page, including in a session that is already signed in. Enrollments already running through your Cloudpath workflow keep working during that time, and the **Account** page (where you can [delete your account](https://docs.neuralconfig.com/cp-word-list/delete-account/)) stays available without accepting. ::: 3. **Activate by entering your Cloudpath FQDN** A new account starts **inactive**. Open the dashboard, enter your **Cloudpath FQDN** (the hostname of your Cloudpath server, for example `na1.cloudpath.net`) in the Cloudpath Configuration form, and save. ## What activation depends on What happens when you save the FQDN depends on the server: | Cloudpath server | Result | |---|---| | **Hosted** — any `*.cloudpath.net` address (e.g. `na1.cloudpath.net`) | **Approved automatically.** The service activates as soon as you save a valid FQDN. | | **Self-hosted** — any other hostname | **Held for review.** Your account stays pending until an admin approves it. Email `support+cp-word-list@support.neuralconfig.com` to request review. | While an account is pending, outbound calls to your Cloudpath server — both **Test Connection** and the live enrollment webhook — are disabled. The webhook answers `401` to Cloudpath until the account is active. Once approved (or auto-approved), both are enabled. An account therefore moves through three states: it is created **inactive** when you accept the terms, becomes **active** the moment you save a hosted `*.cloudpath.net` FQDN, and sits in **pending review** if you save any other hostname until an admin approves it. ```mermaid stateDiagram-v2 state "Pending review" as PendingReview [*] --> Inactive: Accept the Terms and Privacy Policy Inactive --> Active: Save a hosted cloudpath.net FQDN Inactive --> PendingReview: Save a self-hosted FQDN PendingReview --> Active: Admin approves after review note right of Active Enrollment webhook and Test Connection enabled end note ``` ## Next steps - [Configure your Cloudpath connection](https://docs.neuralconfig.com/cp-word-list/configuration/) — add your API credentials and SSID name, and grab your Tenant ID and Shared Secret. - [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/) in Cloudpath. If you don't see the option to sign in, or your account stays pending after you've entered a hosted FQDN, see [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/). --- # Cloudpath connection settings Source: https://docs.neuralconfig.com/cp-word-list/configuration/ The dashboard's Cloudpath Configuration page is where you tell CP Word List how to reach your Cloudpath server and how to display the passphrase. This page covers each field and the two identifiers you'll need for the [workflow setup](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/). ## Configuration fields | Field | What it is | |---|---| | **Cloudpath FQDN** | The hostname of your Cloudpath server, e.g. `na1.cloudpath.net`. This is also what activates your account — see [Activate your account](https://docs.neuralconfig.com/cp-word-list/getting-started/). | | **Cloudpath Username** | The username of a Cloudpath API account the service uses to look up and update DPSKs. | | **Cloudpath Password** | The password for that account. Enter it twice to confirm. | | **SSID Name** | The Wi-Fi network name shown to the user on the enrollment page ("Connect to the **MyWiFi** network"). | :::tip Create a **dedicated Cloudpath API account** with only the permissions it needs, rather than reusing a personal admin login. The service authenticates to Cloudpath as this account on every passphrase change. ::: Your Cloudpath username and password are **encrypted at rest** and are never shown back to you — once saved, the fields read "Configured (encrypted)". To change them, enter new values; leave them blank to keep the existing ones. For how credentials are protected, see [Security controls](https://docs.neuralconfig.com/cp-word-list/security/). :::caution **Changing the FQDN re-runs the approval check.** The FQDN is what activates an account, so saving a different one is re-evaluated on the spot: a hosted `*.cloudpath.net` address stays (or becomes) active, and anything else drops the account back to **pending review** — disabling Test Connection and the enrollment webhook until an admin approves it. Changing only the username, password, or SSID leaves your account state alone. ::: ## Test Connection After saving your FQDN and credentials, click **Test Connection**. The service authenticates to your Cloudpath server's REST API using the stored credentials and reports success or the exact error. Test Connection only works once your account is active. If your account is pending review, or the FQDN or credentials are missing, the test returns a message saying so. Common failures are covered in [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/). ## Tenant ID and Shared Secret The dashboard's Cloudpath Workflow Setup section shows two identifiers you paste into Cloudpath: - **Tenant ID** — identifies your account to the client-side lookup on the enrollment page. - **Shared Secret** — authenticates the enrollment webhook. The dashboard shows it inside the request body for the recommended POST setup, and inside the API Call URL for the URL-only setup; either way it goes into your Cloudpath notification step. Both are generated for you. You can **Regenerate Secret** at any time — but doing so immediately invalidates the old one, so any Cloudpath workflow still using the old secret will start failing until you paste in the new request body or API Call URL. See [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/). :::caution Treat the Shared Secret like a password. Anyone with it can trigger passphrase changes against your tenant. If it leaks, regenerate it and update your Cloudpath workflow with the new value. ::: ## Next steps - [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/) — paste the API Call URL and snippet into Cloudpath. - [Security controls](https://docs.neuralconfig.com/cp-word-list/security/) — how your Cloudpath credentials are encrypted and what the service stores. - [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/) — what each Test Connection message means. --- # Add the enrollment workflow steps Source: https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/ CP Word List hooks into your existing Cloudpath DPSK enrollment workflow with two steps. Both must come **after** the "Generate a DPSK" step — the DPSK has to exist before the service can look it up and change it. The exact values you paste (API Call URL and snippet) are shown pre-filled on the dashboard's **Cloudpath Workflow Setup** section; copy them from there so they carry your Tenant ID, Shared Secret, and SSID name. 1. **Add a "Send a notification" step** Place it after "Generate a DPSK", then: - Set **Display Name** to something descriptive, e.g. `API-word-list`. - Check **Notification Enabled**. - Set **Notification Method** to **Call a URL (REST API)**. - Fill in the call. The dashboard shows two forms, and the service accepts either: | Form | What you paste | |---|---| | **Recommended: POST with a body** | URL `https://wordlist.lanpulse.com/api/change-dpsk`, method POST, and the form-encoded body `enrollmentId=${GUID}&secret=` | | **URL only** | `https://wordlist.lanpulse.com/api/change-dpsk?enrollmentId=${GUID}&secret=` | `${GUID}` is a Cloudpath template variable that resolves to the enrollment ID at runtime. `` is your tenant Shared Secret — the dashboard fills this in for you. The POST form keeps the secret out of the request URL. Use it if your Cloudpath notification step lets you set the method and a request body; otherwise use the URL-only form, which still works. - Click **Save**. This step is invisible to the user. It's what triggers the passphrase change on your controller. 2. **Add a "Display a message" step** Place it after the notification step, then: - Enter an **HTML Title**, e.g. `Your Wi-Fi Password`. - In the **HTML Message** field, paste the **snippet** shown on the dashboard. The snippet displays the new word-based passphrase and tells the user which SSID to connect to. It already contains your SSID name and Tenant ID. - Uncheck **Show continue button** and check **Kill Session** to close the enrollment cleanly. - Click **Save**. :::note The snippet has a built-in 15-second timeout. If it can't get the new phrase in time, it shows the original Cloudpath passphrase instead. That passphrase works if the change never happened (for example, CP Word List was unreachable), but not if the change succeeded and only the lookup failed. See [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/). ::: 3. **Publish the workflow** Click **Publish** at the top of the workflow editor to make your changes live. Then enroll a test device: the display page should show a three-word passphrase like `apple-red-truck`. ## Cloudpath template variables These are substituted by Cloudpath at runtime: | Variable | Meaning | |---|---| | `${GUID}` | The enrollment ID for the session (e.g. `Enrollment-abc123`). Used in the API Call URL to identify which DPSK to change. | | `${DPSK}` | The current DPSK for the enrollment. In the display step this is the **old** passphrase (already replaced on the controller), used by the snippet as a lookup key. On re-enrollment it's already in word-list format. | ## Next steps - [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/) — what these two steps actually do at enrollment time. - [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/) — what the user will see on the display page. - [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/) — if the test passphrase still shows as a random string. --- # How enrollment and fallback work Source: https://docs.neuralconfig.com/cp-word-list/how-it-works/ CP Word List runs at two moments in a Cloudpath enrollment: an invisible notification that changes the DPSK, and the display page the user sees. This page explains what happens in each case, and why the service can never stop someone from getting online. ## First enrollment When a user enrolls for the first time: 1. **Cloudpath generates the DPSK** — a random string like `x8kP2mQ9`. 2. **The notification fires.** Cloudpath calls `/api/change-dpsk` with the enrollment ID (`${GUID}`) and your Shared Secret. CP Word List authenticates to your Cloudpath server, looks up the DPSK for that enrollment, generates a memorable phrase like `apple-red-truck`, and updates the DPSK on the controller. 3. **The mapping is cached** — the old random string mapped to the new phrase — and can be looked up for 5 minutes. 4. **The display page loads.** Its snippet takes the old DPSK from Cloudpath's `${DPSK}` variable and calls `/api/get-dpsk` to fetch the new phrase, then shows it and the SSID to connect to. The user reads `apple-red-truck` off the screen and connects. ```mermaid sequenceDiagram participant U as User browser participant CP as Cloudpath participant WL as CP Word List participant C as Controller CP->>CP: Generate DPSK (x8kP2mQ9) CP->>WL: Notification /api/change-dpsk (enrollmentId, secret) WL->>C: Authenticate · look up DPSK · set phrase (apple-red-truck) WL->>WL: Cache old→new mapping for 5 min CP->>U: Serve display page (carries the old ${DPSK}) U->>WL: /api/get-dpsk (old DPSK as lookup key) WL-->>U: New phrase apple-red-truck Note over U: Show phrase and SSID, user connects Note over U,WL: Fallback — if no phrase comes back the snippet polls ~15s (up to 7 times),
then shows the original Cloudpath passphrase ``` ## Re-enrollment When a returning user re-enrolls, their DPSK is often **already** in word-list format. CP Word List handles this gracefully: - The notification step still fires. The service does **not** check whether the DPSK is already word-based: it skips the change only when a device is already connected on the DPSK (**409**) or no DPSK is found for the enrollment (**404**). Either way it's invisible to the user. - The display snippet detects that the DPSK is already in `word-word-word` format and shows it **immediately, with no API call**. That means CP Word List is **not a dependency** for returning users viewing their existing passphrase. :::caution If a returning user's word-based DPSK has **no device connected**, the notification replaces it with a new phrase, but the display page still shows the old word-based one it received from Cloudpath. The new phrase is the one set on the DPSK in Cloudpath. ::: ## The 5-minute cache The old-to-new passphrase mapping is cached for **5 minutes** so the display page can look it up. The display page polls during this window. After 5 minutes the mapping expires — but the new passphrase is already set on the controller and stays active indefinitely. A scheduled job runs every 5 minutes and deletes expired mappings, so no mapping is stored for more than about 10 minutes. ## Downtime never blocks network access CP Word List is an enhancement layer. It cannot prevent anyone from connecting: whichever passphrase is on the DPSK in Cloudpath — the original, or the word-based one after a change — is valid. If the service is unreachable or erroring: - The passphrase change never happens, so the original Cloudpath passphrase stays valid. The display snippet waits up to **15 seconds** (polling up to 7 times), then falls back to showing that **original Cloudpath passphrase** — a working credential. - For returning users whose DPSK is already word-based, **no API call is made at all** — the passphrase shows instantly. The only effect of an outage is that a new enrollment sees a random passphrase instead of a memorable one. Network connectivity is never affected. :::caution The fallback shows the **original** passphrase whenever the snippet gets no new phrase within 15 seconds — including the case where the change **succeeded** but the lookup failed or was slow. That original passphrase has already been replaced and no longer works. The new word-based passphrase is on the DPSK in Cloudpath. ::: ## Next steps - [HTTP API reference](https://docs.neuralconfig.com/cp-word-list/api-reference/) — the underlying endpoints and the Cloudpath REST API calls behind each step above. - [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/) — what the generated phrase looks like and how it's chosen. - [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/) — if a test enrollment still shows a random string. --- # Passphrase format and strength Source: https://docs.neuralconfig.com/cp-word-list/passphrases/ Every passphrase CP Word List generates has the same shape: **three lowercase words joined by dashes**, like `apple-red-truck`. Nothing about that shape is configurable — the same generator produces both live enrollment passphrases and the ones in a [bulk export](https://docs.neuralconfig.com/cp-word-list/property-unit-export/). ## The format | Property | Value | |---|---| | Words per passphrase | **3**, always | | Separator | A single dash (`-`) | | Word length | 3–5 letters | | Total length | **11–17 characters**, including the two dashes | | Character set | Lowercase `a`–`z` and `-` only | | Word source | The [EFF short word list](https://www.eff.org/dice), minus entries containing hyphens — **1,294 words** | | Randomness | Cryptographically secure (`crypto.getRandomValues`) | Words are chosen independently, so a passphrase may repeat a word. ## Strength Three words drawn from 1,294 give **2,166,720,184 combinations** — roughly 2.17 billion, or about **31 bits** of entropy. Two things are worth knowing about what that means in practice: - **Length is never the problem.** The shortest possible passphrase is 11 characters (`art-aim-cub`), comfortably above the 8-character minimum a WPA2 pre-shared key requires. - **It is a deliberate memorability trade-off.** A random Cloudpath DPSK packs more entropy into fewer characters. CP Word List trades some of that for a passphrase a resident can read off a screen and type on a phone. The protection that matters most is still Cloudpath's: each DPSK is unique per unit or user, and its device limit caps how many devices can ever use it. :::note Because words are lowercase letters only, a passphrase is unambiguous to read aloud or copy from a printed sheet — no case, digits, or symbols to confuse. ::: ## Collisions If a generated phrase happens to match a passphrase already in the Cloudpath DPSK pool, the update fails and the service generates a new phrase and tries again, **up to 3 attempts**. At 2.17 billion combinations this is rare. If all three collide, the webhook returns `409` and the enrollment keeps its original Cloudpath passphrase, which is still valid. ## How long the old-to-new mapping is kept The mapping from the original Cloudpath passphrase to the new one can be looked up for **5 minutes**, and a job that runs every 5 minutes deletes expired mappings, so none is stored for more than about **10 minutes**. The new passphrase itself stays set on the DPSK in Cloudpath indefinitely. See [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/#the-5-minute-cache). ## What you cannot change These are fixed properties of the service, not settings: - The **number of words** is always three. There is no four-word or longer mode. - The **word list** is built into the service. You cannot upload or select a custom list. - The **separator** is always a dash. - Passphrases are generated per enrollment or per exported row; you cannot supply your own. If the format is a problem for your deployment, email `support+cp-word-list@support.neuralconfig.com` — the service is actively developed. ## Next steps - [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/) — where a passphrase gets generated and how it reaches the user. - [Bulk DPSK export](https://docs.neuralconfig.com/cp-word-list/property-unit-export/) — generate the same passphrases in bulk for a property import. - [Security controls](https://docs.neuralconfig.com/cp-word-list/security/) — how passphrase data is stored and for how long. --- # HTTP API reference Source: https://docs.neuralconfig.com/cp-word-list/api-reference/ CP Word List exposes a small HTTP API at `https://wordlist.lanpulse.com`. Most integrators only need the [workflow setup](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/), which wires these up for you — but the endpoints can be called directly for custom integrations. ## POST /api/change-dpsk Looks up the DPSK for an enrollment and replaces it with a word-based passphrase. Also accepts `GET`. This is the endpoint your Cloudpath notification step calls. **Parameters** (form-encoded body on `POST`, or query string on `POST` or `GET`). Sending them in a `POST` body is recommended, because it keeps the Shared Secret out of the request URL. If a parameter appears in both, the query string value wins: | Parameter | Description | |---|---| | `secret` | Your tenant Shared Secret. Identifies and authorizes the tenant. | | `enrollmentId` | The Cloudpath enrollment ID. Must start with `Enrollment-` or `Message-` (e.g. `Enrollment-abc123`). | **Success (200):** ```json { "success": true, "enrollmentId": "...", "dpskGuid": "...", "dpskName": "...", "passphrase": "apple-red-truck" } ``` **Errors:** | Code | Meaning | |---|---| | `401` | Missing secret, or no active tenant matches it. | | `400` | Missing `enrollmentId`, invalid `enrollmentId` format, or the tenant isn't fully configured. | | `404` | Enrollment not found, or no DPSK is assigned to it. | | `409` | A device is already connected on the DPSK, or three generated phrases in a row collided with existing DPSKs — either way the passphrase is not changed. | | `500` | The DPSK's resource links from Cloudpath couldn't be parsed. | | `502` | Cloudpath API authentication failed or the server was unreachable. | If Cloudpath itself rejects the passphrase update, the service relays Cloudpath's status code and includes its message in a `detail` field. :::note If a generated phrase collides with an existing DPSK in the pool, the service retries with a new phrase up to **3 times** before giving up. ::: ## GET /api/get-dpsk Returns the new passphrase for a given old DPSK. Used by the display-page snippet. **Parameters** (query string): | Parameter | Description | |---|---| | `dpsk` | The old DPSK passphrase (the lookup key). | | `tenant` | Your Tenant ID. | **Success (200):** ```json { "success": true, "passphrase": "apple-red-truck", "dpskGuid": "...", "dpskName": "..." } ``` **Behavior and errors:** | Code | Meaning | |---|---| | `400` | `dpsk` or `tenant` is missing. | | `404` | No mapping was found — it expired, or the change hasn't happened yet. Also returned when `tenant` matches no account. | If `dpsk` already matches the `word-word-word` format, it's echoed back immediately with `200` and no cache lookup, even when `tenant` matches no account — this is how returning users get an instant answer. `tenant` must still be present (without it the response is `400`), and when it matches no account the `200` carries no CORS header, so a browser blocks it. Otherwise the mapping is looked up, and mappings expire **5 minutes** after the change. Responses carry `Access-Control-Allow-Origin` set to your Cloudpath server's origin (`https://`), so other sites can't read a cached mapping from a browser. When the `tenant` parameter matches no account, or that account has no FQDN saved, the header is **omitted**, so browsers refuse the response. The `OPTIONS` preflight answers `204` and is scoped the same way: it reads `tenant` from the query string and allows only that tenant's Cloudpath origin, with no CORS headers for an unknown tenant. ## GET /api/health A simple liveness check. Returns: ```json { "status": "ok", "service": "cp-wordlist" } ``` ## Cloudpath REST API calls During one passphrase change, CP Word List makes these calls to **your** Cloudpath server's REST API, in order: | Step | Call | Purpose | |---|---|---| | 1 | `POST /admin/publicApi/token` | Authenticate. Returns a JWT valid for 5 minutes. | | 2 | `GET /admin/publicApi/enrollments/{enrollmentId}/dpsks` | Find the DPSK(s) for the enrollment. | | 3 | `GET /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}` | Fetch the full DPSK object (required before updating). | | 4 | `PUT /admin/publicApi/dpskPools/{poolGuid}/dpsks/{dpskGuid}` | Write back the object with the new `passphrase`. | Credentials are decrypted only at the moment of use — see [Security controls](https://docs.neuralconfig.com/cp-word-list/security/). :::note There is **no public endpoint that takes a hostname or URL** from the caller. The Cloudpath server the service contacts is always the FQDN saved on your account, and **Test Connection** runs from your signed-in dashboard session (`POST /dashboard/test-connection`), not from the public API. ::: ## Next steps - [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/) — the supported way to call `change-dpsk`. - [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/) — what to do about each error code in practice. - [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/) — what the `passphrase` field always looks like. --- # Bulk DPSK export Source: https://docs.neuralconfig.com/cp-word-list/property-unit-export/ The dashboard's **Property Unit Export** page generates a Cloudpath property-unit import spreadsheet with word-list passphrases already filled in. It's for bulk provisioning — for example, assigning a memorable DPSK to every unit in a property before you import them into Cloudpath. ## Generate a file 1. **Open Property Unit Export** in the dashboard. 2. **Enter the number of units** — between **1 and 10,000**. A larger number is capped at 10,000. 3. **Optionally check "Include guest passphrases"** to generate a separate guest DPSK per unit. 4. **Click Generate & Download.** An `.xlsx` file named `unit_dpsk_export_.xlsx` downloads automatically, with the rows on a sheet called `Units`. Each row gets a freshly generated word-list passphrase (e.g. `apple-red-truck`) in the **Dpsk Secret** column. Every other column is left blank for you to fill in before importing into Cloudpath. :::caution **Keep the file.** Exported passphrases are generated on the fly and are not stored by CP Word List — the service has no record of them and cannot re-create the same file. Once you import them into Cloudpath, Cloudpath is the record. If you lose the file before importing, generate a new one. ::: ## File format The file matches the Cloudpath property-unit import template: | Column | Filled in? | Notes | |---|---|---| | Unit Number (Required) | No | You fill in the unit identifier. | | Description | No | Optional. | | **Dpsk Secret** | **Yes** | Word-list passphrase. | | Unit Vlan | No | Optional VLAN. | | **Guest Dpsk Secret** | **If checked** | Separate guest word-list passphrase. | | Guest Vlan | No | Optional guest VLAN. | | Contact Name (Required) | No | You fill in the contact name. | | Email | No | Optional. | | ISO 2 Country Code | No | Optional. | | Phone Number | No | Optional. | :::note The export only pre-fills the passphrase columns. Fill in the required **Unit Number** and **Contact Name** columns before importing the file into Cloudpath. ::: Because each passphrase is generated the same way as during enrollment, you can mix bulk-imported units and live enrollments freely — both produce memorable three-word phrases. ## Next steps - [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/) — what the generated **Dpsk Secret** values look like and how strong they are. - [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/) — the enrollment path, for units you don't pre-provision. --- # Security controls Source: https://docs.neuralconfig.com/cp-word-list/security/ CP Word List runs as a Cloudflare Worker and stores its data in Cloudflare D1. This page describes the controls that protect your Cloudpath credentials, your passphrase data, and dashboard access. ## Cloudpath API credentials Your Cloudpath API username and password are the most sensitive data the service holds. They are: - **Encrypted at rest** using **AES-256-GCM**, with a per-tenant key derived via **HKDF-SHA256** from a master secret (kept in Cloudflare's encrypted secret store) combined with your tenant context. A database compromise alone does not expose credentials. - **Never shown back to you.** Once saved, the dashboard displays "Configured (encrypted)" rather than the value. - **Decrypted only at the moment of use**, for server-to-server calls to your Cloudpath server. They are never included in browser-side code or shown to end users. :::tip Use a **dedicated Cloudpath API account** with the minimum permissions required, rather than a personal admin account. See [Cloudpath connection settings](https://docs.neuralconfig.com/cp-word-list/configuration/). ::: ## Access control and sessions - **Dashboard sign-in** uses Google OAuth — there's no tenant password for the service to store. Admin console access uses passwords stored with one-way hashing (PBKDF2-SHA256); plaintext passwords are never stored or logged. Admin sign-in attempts are rate-limited to 5 per minute per IP address. - **Sessions expire after 1 hour** and are set with `HttpOnly`, `Secure`, and `SameSite` cookies. - **Admin and tenant sessions are isolated** — one cannot access the other's routes. ## Tenant isolation - Each tenant has a **unique Shared Secret** and can only reach its own configuration, passphrase data, and activity logs. - The `/api/get-dpsk` lookup is **CORS-scoped to your Cloudpath server's origin**, so other domains can't query your passphrase data from a browser. - All database queries are parameterized. ## Passphrase handling - The old DPSK shown in the enrollment page's JavaScript has **already been replaced** on the controller — by the time it appears in the browser it is no longer a valid credential. - Old-to-new passphrase mappings are cached for **5 minutes only**, then purged automatically. A scheduled job sweeps expired rows every 5 minutes, so nothing lingers waiting to be read. - **Activity logs never contain passphrases.** A log entry records the event type, the enrollment ID, and an error reason — not the credential. - **Application logs carry no secrets.** The log lines the service writes record event names, status codes and counts only — never your Shared Secret, a passphrase (old or new), or an enrollment ID. If your Cloudpath workflow uses the URL-only webhook form, though, the Shared Secret is part of the request URL, and request URLs can be recorded by the hosting platform's request logs. That's why the dashboard recommends sending it in a POST body instead. - If a device is already connected on a DPSK, the passphrase change is blocked to avoid disrupting an active user. ## What the service stores, and for how long | Data | Retention | |---|---| | Cloudpath FQDN, API credentials (encrypted), SSID name | Until you change or delete them | | Tenant ID and Shared Secret | Until you regenerate the secret | | Old-to-new passphrase mappings | Looked up for **5 minutes**; deleted by a job that runs every 5 minutes, so at most about **10 minutes** | | Activity log entries (event, enrollment ID, error reason, timestamp) | **90 days**, then deleted by a daily job | | Terms acceptance records (version, timestamp, IP address, browser user agent) | Retained as the record of consent, including after you delete your account | | Sign-in sessions | Valid for **1 hour**; expired sessions are deleted by a daily job | | Pending sign-ups awaiting terms acceptance | **10 minutes**, then discarded | | Feedback you submit (message, optional name, IP address) | **90 days**, then deleted by a daily job | You can remove everything except the terms acceptance records yourself — see [Delete your account](https://docs.neuralconfig.com/cp-word-list/delete-account/). Data leaves Cloudflare's network only to reach **your** Cloudpath server (to change passphrases) and Google (to sign you in). The service never sees or stores an end user's device details. ## Outbound calls The service only ever contacts **your** Cloudpath server at the FQDN saved on your account. There is no public endpoint that accepts a hostname or URL from a caller, so the service cannot be used to reach an arbitrary destination. **Test Connection** runs from your signed-in dashboard session, and it is disabled entirely while an account is pending review. ## Infrastructure The service runs on Cloudflare's global network: TLS 1.3 in transit (with hybrid post-quantum key agreement), automatic DDoS mitigation, edge compute with no origin server to expose, and data stored in Cloudflare D1. It is served only at `https://wordlist.lanpulse.com`. The admin console is protected by its PBKDF2-hashed password and the per-IP sign-in rate limit above. ## Audit trail Every passphrase change and error is logged with a timestamp and enrollment ID. Tenants can review their own history on the **Activity Logs** page in the dashboard. Entries are kept for 90 days. Administrative actions are not recorded in the activity log. ## Next steps - [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/) — how much entropy a generated passphrase carries. - [Cloudpath connection settings](https://docs.neuralconfig.com/cp-word-list/configuration/) — the credentials this page describes, and how to rotate the Shared Secret. - [HTTP API reference](https://docs.neuralconfig.com/cp-word-list/api-reference/) — the endpoints exposed and what authenticates each one. Questions about security or compliance? Contact [support](https://support.neuralconfig.com/cp-word-list?from=docs) or email `support+cp-word-list@support.neuralconfig.com`. --- # Troubleshooting Source: https://docs.neuralconfig.com/cp-word-list/troubleshooting/ Common issues and how to resolve them. If none of these fit, contact [support](https://support.neuralconfig.com/cp-word-list?from=docs) or email `support+cp-word-list@support.neuralconfig.com` with your Cloudpath FQDN and roughly when the problem happened. For a feature request or a general comment, the service also has a feedback form at `https://wordlist.lanpulse.com/feedback`. ## My account is stuck "pending review" Only **hosted** Cloudpath servers (`*.cloudpath.net`) are approved automatically. If you entered a **self-hosted** FQDN, your account waits for an admin to approve it, and outbound calls stay disabled until then. Email `support+cp-word-list@support.neuralconfig.com` to request review. See [Activate your account](https://docs.neuralconfig.com/cp-word-list/getting-started/). If you entered a hosted `*.cloudpath.net` FQDN and it's still pending, double-check the FQDN for typos, re-save it, and confirm it ends in `.cloudpath.net`. ## Test Connection fails The dashboard's **Test Connection** returns the specific reason: | Message | Cause and fix | |---|---| | "Your account is pending admin review." | The account isn't active yet — see above. | | "No Cloudpath FQDN configured." | Enter your Cloudpath FQDN and save. | | "No Cloudpath credentials configured." | Enter the Cloudpath API username and password and save. | | "Authentication failed: …" | The credentials were rejected by Cloudpath. Re-enter them and confirm the API account is valid and enabled. | | "Connection failed: …" | The Cloudpath server couldn't be reached at that FQDN. Verify the hostname. | ## The enrollment webhook is failing If passphrases aren't changing, the notification step's call to `/api/change-dpsk` is likely returning an error. The codes mean: | Code | Meaning and fix | |---|---| | `401` | The Shared Secret is missing or wrong, or the account isn't active. Re-copy the request body (or API Call URL) from the dashboard. If you regenerated the secret, the old value stops working — paste the new one. | | `400` | Missing or malformed `enrollmentId`, or the tenant isn't fully configured. Confirm the call sends `enrollmentId=${GUID}` and that your FQDN and credentials are saved. | | `404` | No DPSK was found for the enrollment. Make sure the notification step runs **after** "Generate a DPSK". | | `409` | A device is already connected on the DPSK, so the passphrase wasn't changed. This is expected on re-enrollment and is safe to ignore. Much more rarely, it means three generated phrases in a row collided with existing DPSKs. | | `502` | Cloudpath authentication failed or the server was unreachable. Run **Test Connection** to confirm your credentials and FQDN. | ## Reading the activity log The dashboard's **Activity Logs** page is the fastest way to see what the enrollment webhook actually did, 20 entries at a time. Each row carries an event type, the enrollment ID, and — for failures — a machine-readable reason: | Event | Reason in details | What it means | |---|---|---| | `dpsk_changed` | — | Success. The DPSK GUID and name of the changed DPSK are recorded. | | `error` | `auth_failed` | The service could not authenticate to your Cloudpath server. Check the API credentials with **Test Connection**. | | `error` | `enrollment_not_found` | Cloudpath had no such enrollment. Usually the notification step ran outside a live enrollment. | | `error` | `dpsk_lookup_failed` | The DPSK lookup call to Cloudpath failed for some other reason. | | `error` | `no_dpsks` | The enrollment exists but has no DPSK. The notification step is running **before** "Generate a DPSK". | | `error` | `device_count_nonzero` | A device is already connected on the DPSK, so it was left alone. Expected on re-enrollment. | | `error` | `update_failed` | Cloudpath rejected the passphrase update. The Cloudpath error message is included. | :::note An empty log means the webhook never got far enough to identify your tenant. Rejections for a missing or wrong Shared Secret (`401`) and for a malformed `enrollmentId` (`400`) are not logged — so if nothing appears at all, suspect the API Call URL or a notification step that isn't firing. ::: ## The passphrase still shows as a random string - Confirm both workflow steps are present, in order, **after** "Generate a DPSK", and that you **published** the workflow. See [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/). - Confirm the notification step sends your correct Shared Secret. - If the service was briefly unreachable, the display page falls back to the original Cloudpath passphrase after 15 seconds — that's by design, and the passphrase still works because it was never changed. - If the **Activity Logs** page shows `dpsk_changed` for that enrollment, the change succeeded but the display page didn't get the new phrase in time, so the random string it shows has already been replaced and **does not work**. Look up the DPSK in Cloudpath for the new word-based passphrase. See [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/). ## The passphrase lookup returns "not found" / expired `/api/get-dpsk` mappings are cached for **5 minutes** after a change. If a user leaves the display page open longer than that and it retries, the lookup returns 404 — but the new passphrase is already set on the controller and still works. Re-running the enrollment refreshes the mapping. ## Passphrase conflicts If a generated phrase happens to match an existing DPSK in the pool, the service retries with a new phrase up to 3 times. With the full word list this is rare and usually resolves on its own. --- # Delete your account Source: https://docs.neuralconfig.com/cp-word-list/delete-account/ You can delete your CP Word List account yourself from the dashboard's **Account** page. Deletion takes effect immediately and cannot be undone: your Cloudpath configuration, stored credentials, activity log and sessions are removed, and only the record of which Terms and Privacy versions you accepted is kept. ## How do I delete my account? 1. **Open the Account page.** Sign in at `https://wordlist.lanpulse.com/dashboard/login` and choose **Account** in the dashboard sidebar. 2. **Type your account's email address** into the confirmation box, exactly as the page shows it. Letter case and surrounding spaces don't matter. 3. **Click Delete my account.** You're signed out and returned to the sign-in page, which shows "Your account has been deleted." If the text you typed doesn't match, nothing is deleted and the page says "That doesn't match. Type your account's email address exactly to confirm." :::note The Account page works even when the dashboard is asking you to accept updated Terms or Privacy Policy versions, so you don't have to accept new terms in order to leave. ::: ## What is removed? Everything below goes at once, in a single step: | Data | What happens | |---|---| | Cloudpath FQDN, API username and password, SSID name | Removed | | Shared Secret | Replaced with a new random value nobody is shown, and the account is disabled — so any Cloudpath workflow still calling the webhook gets `401` | | Activity log | Deleted | | Cached old-to-new passphrase mappings | Deleted | | Sign-in sessions | Deleted — you're signed out on every browser | | Unfinished Google sign-ins | Deleted | | Your email address, Google account ID and display name | Removed from the account record | Until you delete the account, each kind of data is kept for its own retention period: your Cloudpath settings until you change them, passphrase mappings for at most about 10 minutes, and activity log entries and feedback for 90 days. Sign-in sessions are valid for 1 hour. The full list is in [What the service stores, and for how long](https://docs.neuralconfig.com/cp-word-list/security/#what-the-service-stores-and-for-how-long). ## What is kept? Your **terms acceptance records** — which Terms and Privacy versions you accepted, when, and the IP address and browser user agent at the time — are kept as the legal record of consent. The account record they point at stays behind with no email, Google account ID, credentials or configuration in it. Feedback sent through the public form at `https://wordlist.lanpulse.com/feedback` isn't linked to your account, so deleting the account doesn't remove it. It's deleted automatically after 90 days — see [Security controls](https://docs.neuralconfig.com/cp-word-list/security/) for every retention period. ## Before you delete: take the steps out of Cloudpath Remove the two CP Word List steps from your Cloudpath enrollment workflow first. After deletion, the notification step's call is rejected with `401`, so passphrases are no longer changed, and the display snippet waits up to 15 seconds before falling back to the original Cloudpath passphrase. That passphrase still works, but every enrollment sees the delay until the steps are removed. See [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/) for which steps those are. ## What if I sign in again later? Signing in again with the same Google account creates a **new, empty account**. You accept the Terms and Privacy Policy again, re-enter your Cloudpath settings, and get a **new Tenant ID and Shared Secret** — so both workflow steps need the new values pasted in, including the display snippet, which carries the Tenant ID. Nothing from the deleted account carries over. An admin can also delete an account from the admin console; the effect is the same. ## Next steps - [Security controls](https://docs.neuralconfig.com/cp-word-list/security/): What the service stores and how long each kind of data is kept. - [Add the enrollment workflow steps](https://docs.neuralconfig.com/cp-word-list/cloudpath-workflow-setup/): The two Cloudpath steps to remove before deleting, or to update after signing up again. - [Activate your account](https://docs.neuralconfig.com/cp-word-list/getting-started/): Signing in and activating again with a new account. --- # Limits and quotas Source: https://docs.neuralconfig.com/cp-word-list/limits/ CP Word List has no plans or usage tiers. Every account gets the same fixed limits, listed here. None of them can be changed per account. ## Enrollment and passphrases | Limit | Value | What happens at the limit | |---|---|---| | Passphrase lookup window | **5 minutes** after the change | `/api/get-dpsk` returns `404`. The new passphrase is still set on the DPSK in Cloudpath. | | How long a mapping is stored | At most about **10 minutes** | A job running every 5 minutes deletes mappings older than 5 minutes. | | Display snippet polling | Up to **7** lookups, **2 seconds** apart | The snippet shows the original Cloudpath passphrase. | | Display snippet timeout | **15 seconds** | Same fallback as above, whichever comes first. | | Collision retries | **3** attempts per enrollment | The webhook returns Cloudpath's `409` and the DPSK keeps its original passphrase. | | Accepted `enrollmentId` values | Must start with `Enrollment-` or `Message-` | The webhook returns `400` "Invalid enrollmentId format". | | Passphrase shape | Always 3 words, 11–17 characters | Not configurable — see [Passphrase format and strength](https://docs.neuralconfig.com/cp-word-list/passphrases/). | ## Dashboard | Limit | Value | What happens at the limit | |---|---|---| | Units per bulk export | **1–10,000** | A larger number is capped at 10,000. See [Bulk DPSK export](https://docs.neuralconfig.com/cp-word-list/property-unit-export/). | | Sign-in session | **1 hour** | You're sent back to the sign-in page. | | Finishing sign-up (accepting the terms after Google sign-in) | **10 minutes** | The pending sign-up is discarded; sign in with Google again. | | Completing the Google sign-in round trip | **10 minutes** | The sign-in page shows "Invalid OAuth state. Please try again." | | Activity log page size | **20** entries per page | Use the pager for older entries. | ## Retention | Data | Kept for | |---|---| | Activity log entries | **90 days** | | Feedback form submissions | **90 days** | | Old-to-new passphrase mappings | About **10 minutes** at most | | Expired sign-in sessions | Deleted by a daily job | The full list, including what is kept until you change or delete it, is in [Security controls](https://docs.neuralconfig.com/cp-word-list/security/). ## Feedback form Messages sent through `https://wordlist.lanpulse.com/feedback` can be at most **2,000 characters**. A longer one is rejected with "Message must be under 2000 characters." ## Cloudpath's own API limit CP Word List authenticates to your Cloudpath server's REST API afresh on **every** enrollment webhook call and every **Test Connection** click — it does not reuse tokens between calls. On **cloud-hosted** Cloudpath servers, Cloudpath's REST API guide (release 6.0 R3) limits each account or tenant to **10 API token requests per minute**, so more than about ten enrollments a minute through one Cloudpath API account can run into that limit. When Cloudpath refuses the token, the webhook returns `502` and the activity log records `auth_failed`. The same guide says on-premises and self-hosted Cloudpath servers don't apply this limit. ## Next steps - [Troubleshooting](https://docs.neuralconfig.com/cp-word-list/troubleshooting/): What each webhook error and activity log reason means in practice. - [How enrollment and fallback work](https://docs.neuralconfig.com/cp-word-list/how-it-works/): Where the lookup window and the snippet timeout come into play. - [Security controls](https://docs.neuralconfig.com/cp-word-list/security/): Every retention period and what the service stores.