EndpointDescription
An EndpointDescription is the structure GetEndpoints returns for each endpoint. It carries EndpointUrl, the server's ApplicationDescription, the server certificate, SecurityMode, SecurityPolicyUri, the accepted UserIdentityTokens, the TransportProfileUri and a SecurityLevel hint. Everything a client needs to decide how to connect is in this one structure.
The fields that decide the connection
SecurityPolicyUri and SecurityMode define the cryptography. UserIdentityTokens lists the token types the endpoint will accept, each with its own PolicyId that you must echo back in ActivateSession. TransportProfileUri says which wire mapping applies, which matters as soon as HTTPS or WebSocket endpoints appear. ServerCertificate is the DER-encoded application instance certificate you will validate and, on first contact, decide to trust.
The server certificate arrives here
This is where a client first sees the server's certificate, before any secure channel exists. That is why the discovery call is normally made with security None: it is a bootstrap. Your client checks the certificate against its trust list, and on failure copies it to the rejected store so an operator can promote it. It is also where ApplicationUri and the certificate SAN are cross-checked, producing BadCertificateUriInvalid on a mismatch.
SecurityLevel is a hint, not a ranking you should trust
SecurityLevel is a relative number the server assigns to indicate which of its own endpoints it considers more secure. It is comparable only within one server, servers assign it inconsistently, and a client that just picks the highest number can still land on something you did not intend. Pick the policy and mode your site standard requires and treat SecurityLevel as informational.
Example
One decoded EndpointDescription
EndpointUrl opc.tcp://plc01.plant.local:4840/UA/Server
Server
ApplicationUri urn:plc01:Vendor:UAServer
ProductUri http://vendor.example/UAServer
ApplicationType Server
ServerCertificate <DER, 1180 bytes> SAN: URI:urn:plc01:Vendor:UAServer, DNS:plc01.plant.local
SecurityMode SignAndEncrypt
SecurityPolicyUri http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
UserIdentityTokens [ {PolicyId: "username_basic256sha256", TokenType: UserName} ]
TransportProfileUri http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityLevel 3Defined in: Part 4 - Services, GetEndpoints and the EndpointDescription structure.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.