Kepware Integration Architecture
| Platform: | AvailableWebNot availableMobile |
|---|---|
| Plan Type: | Not availableBasicNot availableEssentialAvailablePremiumAvailableEnterprise |
| User Type: | Not availableRequesterNot availableFull UserAvailableAdministrator |
The Kepware integration sends tag data to MaintainX® over a secure, outbound-only architecture. It's built on a set of design principles and core services, with a security model designed for reliable tag data streaming.
Design Principles
Non-Intrusive Design
The Kepware integration is designed to minimize its impact on your Kepware server and operational technology (OT) environment:
- Native plugin: The Kepware agent runs entirely within Kepware's IoT Gateway Plugin, so no custom software or modules are installed on your Kepware server.
- Read-only operation: Tag values flow one way, from Kepware to MaintainX. For more information, see Read-Only Access.
- Existing OT network: Your OT devices continue to communicate only with Kepware, and the Kepware integration requires no changes to that network. For more information, see OT Network Isolation.
Efficient Data Transmission
The Kepware agent keeps data volume predictable so it doesn't overwhelm your Kepware server or network:
- Change-based publishing: Narrow Format sends only the tags whose value or quality has changed since the last scan. For more information, see Configure the Kepware Agent.
- Batched transmissions: Each POST request carries a batch of tag readings, which reduces network overhead.
- Transmission limit: MaintainX accepts up to 1,000 events per transmission. For more information, see Rate Limiting.
- Configurable intervals: The scan rate for each tag and the agent's publishing rate let you balance timeliness with data volume. For recommended settings, see Configure Kepware Tags.
Isolated Connector Instances
Each connector instance links one Kepware deployment to your organization and operates independently:
- Unique access tokens: Each connector instance authenticates with its own token, which you can revoke and replace without affecting other connector instances. For more information, see Token Authentication.
- Multi-site support: Multiple connector instances per organization let you connect Kepware servers across different facilities or sites.
Standard Kepware Payload
The Kepware agent uses the default message format of the Kepware IoT Gateway REST Client, so there's no custom payload to build or maintain. MaintainX parses each reading and uses the Channel.Device.Tag path to identify the tag. For more information, see Payload Format.
Core Services
The Kepware integration consists of two core services that work together to reliably stream tag data from your KEPServerEX 6 to MaintainX: the Kepware agent in your network and the MaintainX platform.
Kepware Agent
You configure the Kepware agent within Kepware's IoT Gateway Plugin. The agent collects tag readings from your KEPServerEX 6 and sends them to MaintainX as HTTPS POST requests at a configurable interval. Your OT devices communicate only with Kepware and are never exposed to the internet directly.
MaintainX Platform
The MaintainX platform receives each POST, parses the tag readings, and associates them with the corresponding connector instance using the access token in the request header.
Security
Read-Only Access
The Kepware integration operates in read-only mode. MaintainX receives tag values from Kepware but never sends commands or writes data back to Kepware or any OT device. Your OT environment isn't affected by MaintainX connectivity.
Secure Outbound Communication
The Kepware agent initiates all communication outbound from your network. MaintainX never opens a connection into your network, so no inbound firewall ports are required.
Network requirements:
| Parameter | Value |
|---|---|
| Protocol | HTTPS (TLS) |
| Direction | Outbound only |
| Destination URL | For details, see On-Premise requirements for your region's endpoint. |
| Port | 443 |
Token Authentication
Every request from Kepware to MaintainX is authenticated using the access token included in the HTTP Authorization header. The token is generated in MaintainX when you create a connector instance and is unique to that connector instance. MaintainX validates the token on every incoming request.
The token is displayed only once at creation time. If a token is lost or compromised, it can be revoked and replaced without affecting other connector instances. For instructions, see Revoke an Access Token.
OT Network Isolation
Your OT devices (PLCs, sensors, etc.) communicate only with Kepware over your internal OT network. Kepware processes the raw OT data and sends only structured tag readings to MaintainX. Raw OT traffic never leaves your network. This preserves the OT/IT boundary that enterprise security requirements typically mandate.
Rate Limiting
MaintainX limits each transmission from the Kepware agent to 1,000 events. The platform rejects any transmission that exceeds this limit.
The following settings determine how many events the Kepware agent includes in each transmission:
- Number of tags: The number of tags you add to the Kepware agent.
- Scan Rate: How frequently Kepware samples each tag value. This is configured per tag.
- Rate (ms): How frequently the Kepware agent sends a POST request to MaintainX.
- Format: Narrow Format sends only the tags whose value or quality has changed since the last scan. Wide Format sends every enabled tag on every scan, which produces far more events per transmission.
To keep each transmission within the limit, use Narrow Format and the recommended scan rate and publishing settings. For more information, see Configure the Kepware Agent and Add Tags to the Kepware Agent.