What is Transport profile in OPC UA?

Glossary · Connection

Transport profile

A transport profile URI names the exact combination of URL scheme, wire encoding and security mechanism an endpoint uses - uatcp-uasc-uabinary for opc.tcp, wss-uasc-uabinary for binary over WebSockets, and so on. Every EndpointDescription carries a TransportProfileUri, and a client that does not implement that profile cannot use the endpoint.

The profiles that exist in practice

uatcp-uasc-uabinary over opc.tcp; https-uabinary, which tunnels one secure-channel chunk per HTTP POST; https-uajson and its OpenAPI variant; wss-uasc-uabinary in WebSocket binary frames under sub-protocol opcua+uacp; wss-uajson in text frames; and the WebSocket OpenAPI variant. The historical SOAP and WS-* mappings still have WSDL files in the schema directory but are effectively dead - no current stack implements them.

Whether a UA secure channel exists at all

This is the distinction that matters. The uasc profiles negotiate a UA Secure Conversation channel and support None, Sign and SignAndEncrypt. The JSON and OpenAPI profiles do not: servers must advertise them with MessageSecurityMode None and SecurityPolicyUri None, and all confidentiality and integrity comes from TLS. Authentication on those surfaces is Anonymous, Bearer JWT, HTTP Basic or mutual TLS.

Reading it during triage

When a client refuses an endpoint that looks correct on policy and mode, check TransportProfileUri before anything else. Most PLC and gateway clients implement only uatcp-uasc-uabinary, so an HTTPS or WebSocket endpoint published alongside is simply invisible to them. Equally, a browser-based client can only ever use the wss profiles, which is why servers publish both.

Example

Profiles, schemes and whether a UA secure channel is negotiated

profile                  scheme               encoding      UA SecureChannel  security modes
uatcp-uasc-uabinary      opc.tcp://           UA Binary     yes               None/Sign/SignAndEncrypt
https-uabinary           opc.https:// https:// UA Binary     yes (1 chunk/POST) None/Sign/SignAndEncrypt
https-uajson             opc.https:// https:// UA JSON       no - TLS only     None only
https-uajson-openapi     opc.https:// https:// OpenAPI JSON  no - TLS only     None only
wss-uasc-uabinary        opc.wss:// wss://    UA Binary     yes               None/Sign/SignAndEncrypt
wss-uajson               opc.wss:// wss://    UA JSON       no - TLS only     None only
wss-uajson-openapi       opc.wss:// wss://    OpenAPI JSON  no - TLS only     None only

The mistake people make: Reading SecurityMode None on a JSON or OpenAPI endpoint as a misconfiguration and trying to raise it. Those profiles are required to be advertised that way; the security lives in TLS. The real question is whether TLS is terminated somewhere you do not control, because that is where the plaintext appears.

Defined in: Part 7 - Profiles defines transport profile URIs; Part 6 - Mappings defines the mappings themselves.

Related concepts

opc.tcp WebSocket transport HTTPS transport OpenAPI / REST mapping Endpoint EndpointDescription MessageSecurityMode

Status codes you will meet

BadSecurityPolicyRejected BadSecurityModeRejected BadNotSupported BadServiceUnsupported

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.