Endpoint
In OPC UA, an endpoint is one concrete way to connect to a server: a URL, a security policy, a MessageSecurityMode and a list of accepted user identity tokens, bundled together. A server normally publishes several endpoints on the same port, and a client must select exactly one before it opens a secure channel.
An endpoint is a combination, not a URL
Two endpoints can share the same URL and still be different endpoints, because the security policy or the message security mode differs. Selection is by exact match: a client asks for Basic256Sha256 with SignAndEncrypt, and the server either has that combination or it does not. Asking for a policy the server does not publish returns BadSecurityPolicyRejected; asking for a mode it does not offer returns BadSecurityModeRejected.
One port, many endpoints
A typical server on opc.tcp://host:4840 publishes None/None for discovery and bootstrapping, plus Basic256Sha256 in Sign and in SignAndEncrypt, each with its own list of accepted identity tokens - often Anonymous only on the None endpoint and Username or Certificate on the secured ones. Hardening a server usually means deleting endpoints, not changing a global switch.
The URL you dial and the URL you get back
The EndpointUrl in each returned EndpointDescription comes from the server's own configuration, not from the socket you connected on. If the server is configured with an internal hostname, a container name or an unreachable FQDN, a client that blindly reconnects to the returned URL fails while the URL you dialled works perfectly. Clients such as UaExpert offer an option to substitute the dialled host for exactly this reason.
Example
A typical endpoint list from one server on one port
opc.tcp://plc01:4840/UA/Server
[0] SecurityPolicy None MessageSecurityMode None tokens: Anonymous
[1] SecurityPolicy Basic256Sha256 MessageSecurityMode Sign tokens: UserName, Certificate
[2] SecurityPolicy Basic256Sha256 MessageSecurityMode SignAndEncrypt tokens: UserName, Certificate
[3] SecurityPolicy Aes256_Sha256_RsaPss MessageSecurityMode SignAndEncrypt tokens: UserName
Same host, same port, same path - four endpoints. You pick one index, not one URL.Defined in: Part 4 - Services defines GetEndpoints and the EndpointDescription; Part 6 - Mappings defines the transport profiles an endpoint can use.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.