Overview
WinCC Unified is the Siemens SCADA / HMI system in TIA Portal. From V19 on, Unified Runtime on a PC includes a GraphQL server for reading and writing runtime data: tags, logged (historical) tag values and alarms. Siemens documents it in the online help WinCC Unified GraphQL (RT Unified). The WinccUnifiedGraphql connector sends GraphQL queries and mutations over HTTPS. Every event is aPOST /graphql/ with a JSON body {"query": "...", "variables": {...}}. The topic picks the preset and the payload carries the GraphQL document, so you control exactly which fields come back. Typical uses: mirror HMI tags onto MQTT, write setpoints from MQTT, pull tag history into a historian or analytics pipeline, and acknowledge alarms from another system. Each event publishes the server’s reply on <topic>/response.
Prerequisites
- WinCC Unified Runtime on a PC (V19 or later) with a project running and the GraphQL server available. Siemens documents it online for V20 and V21. Unified Comfort Panels are not covered by the Siemens GraphQL help.
- The Runtime IIS web server reachable from the broker host on HTTPS 443. The GraphQL server is published at
https://<runtime-host>/graphql/. The GraphQL service listens on port 4000 on the runtime PC, but Siemens does not support direct access to it. Always go through IIS. - The broker must trust the Runtime web server certificate, either the self-signed certificate or a CA created with WinCC Unified Certificate Manager. The host name or IP in
BASE_ADDRESSmust be in that certificate. Use IPv4 when you connect by host name. - A UMC user configured for Runtime. Read rights are needed for queries, write rights for
writeTagValuesand the alarm mutations. Objects the user cannot read are left out of responses, and a write without permission aborts the operation.
Authentication
- Log in: publish the
loginmutation tohistorian/siemens-wincc-unified/session/create(example below). The response hasdata.login.tokenanddata.login.expires. A wrong user or password returnsdata.login.error.code101and no token.102is a UMC error. - Send
"token": "<data.login.token>"with every other event. The connector sends it asAuthorization: Bearer <token>. - A session stays open while there is activity.
ExtendSession(session/update) renews it, andLogout(session/delete) ends it.allSessions: trueends every session of the user. Changing the user’s password and logging out withallSessions: truealso closes them. - Without a valid token, the server answers with an
errorsarray instead of data. When that happens, log in again.
GET JSON "data.login.token" and keep it internally (see Examples).
Configuration
- Replace
YOUR_WINCC_UNIFIED_HOSTinBASE_ADDRESSwith the Runtime PC’s host name or IP. That name must match the Runtime web server certificate. KeepUSE_SSL "true". - Every event is
POST /graphql/withContent-Type: application/json. The body is{value.json.body}, sent unchanged. Use GraphQL variables for values. That keeps quotes out of the query string and makes the payload easy to build in LoT. - GraphQL answers HTTP
200for most errors. Check theerrorsarray (syntax, validation, not logged in) and, per item,error.code:0success,2cannot resolve name,3argument error,201cannot convert value to data type,202only leaf elements of a structure tag,301alarm filter syntax error,302/303invalid language,304/305alarm state does not allow the action. - Tag names follow the WinCC Unified addressing rules, for example
HMI_Tag_1or a structure elementMotor_1.Speed.BrowseTagslists them with wildcards (*,?). loggedTagValuestakes logging tag names (Tag:LoggingTag) or a tag name when that tag has only one logging tag. SetstartTimeorendTime. If you set only one of them, also setmaxNumberOfValues. Timestamps are ISO 8601 UTC, for example2026-10-05T07:00:00.000Z.activeAlarmsandloggedAlarmstake an optionalfilterString. This is the WHERE part of a ChromQueryLanguage (SQL-like) filter, for examplePriority >= 10. Alarm names are full alarm paths, for exampleHMI_RT_1::Line1_Temperature:HighHigh.instanceID0targets every instance.writeTagValuestakes an optionaltimestampandquality({"quality": "GOOD_CASCADE"}) for the whole list, or per tag ininput.
Examples
Log in (publish tohistorian/siemens-wincc-unified/session/create):
historian/siemens-wincc-unified/session/create/response:
historian/siemens-wincc-unified/tag-value/get):
historian/siemens-wincc-unified/tag-value/update):
historian/siemens-wincc-unified/tag/browse):
historian/siemens-wincc-unified/logged-tag-value/list):
historian/siemens-wincc-unified/active-alarm/list):
historian/siemens-wincc-unified/alarm/acknowledge):
historian/siemens-wincc-unified/logged-alarm/list):
historian/siemens-wincc-unified/session/update):
internal/wincc-unified/login once to log in.
Testing
Technical preview, not yet live-tested. The app package’s smoke script parses and validates every preset GraphQL document (and every example on this page) against the WinCC Unified GraphQL schema, and checks the example variables against each document. It then runs every event against a local mock server that executes that schema. The mock run covers login, session, browse, read, write and read-back, logged values by logging tag and by tag name, active alarms with a filter, acknowledge (state changes toRAISED_ACKNOWLEDGED), reset, shelve / unshelve, disable / enable, logged alarms, extend session and logout. Negative controls cover a missing, bad or logged-out token, a wrong password (101), an unknown tag (2), a value that cannot be converted (201), an alarm that is already acknowledged (305), a bad alarm filter (301), logged values without a time range (3), an invalid document, a subscription over HTTP, and a write by a read-only user. There is no public WinCC Unified runtime, so no real server has been called. See TEST.md in the app package.
Not covered
- Subscriptions (
tagValues,activeAlarms,reduState). They need a WebSocket with thegraphql-transport-wsprotocol, which REST_API connectors do not use. PollReadTagValues/ListActiveAlarmson a timer instead. loginSWAC(UMC SWAC single sign-on withnonceand a signed claim) andidentityProviderURL. You can still send them throughGraphqlRequest.- Unified Comfort Panels, WinCC Unified Openness / ODK, and the Industrial Edge WinCC Unified apps.
- Engineering in TIA Portal (projects, screens, users). This connector only reads and writes runtime data.

