Skip to main content
Technical Preview

Overview

WinCC Unified is the Siemens SCADA / HMI system in TIA Portal. From V19 on, Unified Runtime on a PC includes a GraphQL server for reading and writing runtime data: tags, logged (historical) tag values and alarms. Siemens documents it in the online help WinCC Unified GraphQL (RT Unified). The WinccUnifiedGraphql connector sends GraphQL queries and mutations over HTTPS. Every event is a POST /graphql/ with a JSON body {"query": "...", "variables": {...}}. The topic picks the preset and the payload carries the GraphQL document, so you control exactly which fields come back. Typical uses: mirror HMI tags onto MQTT, write setpoints from MQTT, pull tag history into a historian or analytics pipeline, and acknowledge alarms from another system. Each event publishes the server’s reply on <topic>/response.

Prerequisites

  1. WinCC Unified Runtime on a PC (V19 or later) with a project running and the GraphQL server available. Siemens documents it online for V20 and V21. Unified Comfort Panels are not covered by the Siemens GraphQL help.
  2. The Runtime IIS web server reachable from the broker host on HTTPS 443. The GraphQL server is published at https://<runtime-host>/graphql/. The GraphQL service listens on port 4000 on the runtime PC, but Siemens does not support direct access to it. Always go through IIS.
  3. The broker must trust the Runtime web server certificate, either the self-signed certificate or a CA created with WinCC Unified Certificate Manager. The host name or IP in BASE_ADDRESS must be in that certificate. Use IPv4 when you connect by host name.
  4. A UMC user configured for Runtime. Read rights are needed for queries, write rights for writeTagValues and the alarm mutations. Objects the user cannot read are left out of responses, and a write without permission aborts the operation.

Authentication

  1. Log in: publish the login mutation to historian/siemens-wincc-unified/session/create (example below). The response has data.login.token and data.login.expires. A wrong user or password returns data.login.error.code 101 and no token. 102 is a UMC error.
  2. Send "token": "<data.login.token>" with every other event. The connector sends it as Authorization: Bearer <token>.
  3. A session stays open while there is activity. ExtendSession (session/update) renews it, and Logout (session/delete) ends it. allSessions: true ends every session of the user. Changing the user’s password and logging out with allSessions: true also closes them.
  4. Without a valid token, the server answers with an errors array instead of data. When that happens, log in again.
Unlike some APIs, the token is in the response body, so a LoT action can read it with GET JSON "data.login.token" and keep it internally (see Examples).
Keep the WinCC Unified user and password in Hub secrets and add them with GET SECRET. Never put them in the connector file or in retained topics. Restrict who may publish to the write and alarm topics: writeTagValues writes to the HMI tags and, through them, to the PLC.

Configuration

  • Replace YOUR_WINCC_UNIFIED_HOST in BASE_ADDRESS with the Runtime PC’s host name or IP. That name must match the Runtime web server certificate. Keep USE_SSL "true".
  • Every event is POST /graphql/ with Content-Type: application/json. The body is {value.json.body}, sent unchanged. Use GraphQL variables for values. That keeps quotes out of the query string and makes the payload easy to build in LoT.
  • GraphQL answers HTTP 200 for most errors. Check the errors array (syntax, validation, not logged in) and, per item, error.code: 0 success, 2 cannot resolve name, 3 argument error, 201 cannot convert value to data type, 202 only leaf elements of a structure tag, 301 alarm filter syntax error, 302 / 303 invalid language, 304 / 305 alarm state does not allow the action.
  • Tag names follow the WinCC Unified addressing rules, for example HMI_Tag_1 or a structure element Motor_1.Speed. BrowseTags lists them with wildcards (*, ?).
  • loggedTagValues takes logging tag names (Tag:LoggingTag) or a tag name when that tag has only one logging tag. Set startTime or endTime. If you set only one of them, also set maxNumberOfValues. Timestamps are ISO 8601 UTC, for example 2026-10-05T07:00:00.000Z.
  • activeAlarms and loggedAlarms take an optional filterString. This is the WHERE part of a ChromQueryLanguage (SQL-like) filter, for example Priority >= 10. Alarm names are full alarm paths, for example HMI_RT_1::Line1_Temperature:HighHigh. instanceID 0 targets every instance.
  • writeTagValues takes an optional timestamp and quality ({"quality": "GOOD_CASCADE"}) for the whole list, or per tag in input.

Examples

Log in (publish to historian/siemens-wincc-unified/session/create):
Response on historian/siemens-wincc-unified/session/create/response:
Read live tag values (historian/siemens-wincc-unified/tag-value/get):
Write a setpoint (historian/siemens-wincc-unified/tag-value/update):
Browse tags (historian/siemens-wincc-unified/tag/browse):
Read the last hour of a logging tag (historian/siemens-wincc-unified/logged-tag-value/list):
List active alarms with priority 10 or higher (historian/siemens-wincc-unified/active-alarm/list):
Acknowledge an alarm (historian/siemens-wincc-unified/alarm/acknowledge):
Read logged alarms (historian/siemens-wincc-unified/logged-alarm/list):
Keep the session alive (historian/siemens-wincc-unified/session/update):
Example actions: log in with Hub secrets, keep the token internally, keep the session alive, poll tags and alarms, write a setpoint and acknowledge alarms from MQTT. Send anything to internal/wincc-unified/login once to log in.

Testing

Technical preview, not yet live-tested. The app package’s smoke script parses and validates every preset GraphQL document (and every example on this page) against the WinCC Unified GraphQL schema, and checks the example variables against each document. It then runs every event against a local mock server that executes that schema. The mock run covers login, session, browse, read, write and read-back, logged values by logging tag and by tag name, active alarms with a filter, acknowledge (state changes to RAISED_ACKNOWLEDGED), reset, shelve / unshelve, disable / enable, logged alarms, extend session and logout. Negative controls cover a missing, bad or logged-out token, a wrong password (101), an unknown tag (2), a value that cannot be converted (201), an alarm that is already acknowledged (305), a bad alarm filter (301), logged values without a time range (3), an invalid document, a subscription over HTTP, and a write by a read-only user. There is no public WinCC Unified runtime, so no real server has been called. See TEST.md in the app package.

Not covered

  • Subscriptions (tagValues, activeAlarms, reduState). They need a WebSocket with the graphql-transport-ws protocol, which REST_API connectors do not use. Poll ReadTagValues / ListActiveAlarms on a timer instead.
  • loginSWAC (UMC SWAC single sign-on with nonce and a signed claim) and identityProviderURL. You can still send them through GraphqlRequest.
  • Unified Comfort Panels, WinCC Unified Openness / ODK, and the Industrial Edge WinCC Unified apps.
  • Engineering in TIA Portal (projects, screens, users). This connector only reads and writes runtime data.
Last modified on October 21, 2026