Discovery endpoint

What it answers and what it does not

FindServers returns the applications known at that address; GetEndpoints returns the endpoints of one server; an LDS additionally answers FindServersOnNetwork, backed by mDNS. None of these create a session, so none of them can read a value, browse a node or subscribe. Discovery is strictly the bootstrap phase; everything useful needs CreateSession and ActivateSession afterwards.

The discovery URL is not always the session URL

A server frequently listens for discovery on opc.tcp://host:4840 while its real endpoints carry a path, such as opc.tcp://host:4840/UA/MyServer. The path is part of endpoint identity: connecting to the bare host when the server expects the path returns BadTcpEndpointUrlInvalid, which reads like a network fault but is a string mismatch. Always take the session URL from the EndpointDescription rather than assuming it.

The hardening tension

Security guidance says remove the SecurityMode None endpoint. Discovery convention says keep an unsecured way to fetch the server certificate. The usual resolution is to keep the None endpoint restricted to the Discovery Service Set only - it accepts GetEndpoints and FindServers but refuses CreateSession - which most mature server stacks support as an explicit configuration option.

Example

Discovery URL versus session URL

Discovery  opc.tcp://plc01:4840                 -> FindServers, GetEndpoints
Session    opc.tcp://plc01:4840/UA/Server       -> CreateSession, ActivateSession, Read, Subscribe

Connecting a session to opc.tcp://plc01:4840 (no path)
  -> BadTcpEndpointUrlInvalid   the path part of the endpoint URL is wrong

Defined in: Part 4 - Services, Discovery Service Set; Part 12 - Discovery and Global Services.

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.