← All use cases

OPC UA Level 2 to Web API Level 4

Move selected industrial data through Level 3 and the Level 3.5 DMZ using only outbound connections from Level 2.

A layered OT-to-IT data path.

The Level 2 DataMule initiates the OPC UA connection and sends the approved data outward to a Level 3 DataMule. The flow then continues to the Level 3.5 DMZ DataMule and finally to the Web API in Level 4 IT.

LEVEL 2
OPC UA ServerMachine / SCADA data
←
LEVEL 2
DataMuleReads OPC UA · outbound only
→
LEVEL 3
DataMuleReceives from L2 · forwards outward
→
LEVEL 3.5 · DMZ
DataMuleReceives · buffers · relays
→
LEVEL 4 · IT
Web APIApproved application endpoint
PURDUE DATA FLOW

From Level 2 OPC UA to a Level 4 Web API

Industrial sessions terminate below the enterprise boundary. OTDataMule maps approved values into a governed JSON model, buffers requests and initiates outbound authenticated HTTPS delivery.

LEVEL 4Enterprise
Authenticated Web APIHTTPS POST · REST endpoint · TLS validationPOST /api/v1/telemetry
Business applicationData platformAnalytics
↑Outbound HTTPS only2xx success · 4xx reject · 5xx retry
LEVEL 3.5Security boundary
Controlled egressDestination allow-list · proxy/firewall policy · certificate trust
TLSAPI key / OAuthCredential vault
↑Queued JSON requestsRetry with backoff
LEVEL 3Site operations
OTDataMule mappingAllow-list · rename · scale · enrich · route
{"asset":"line-1","temp":72.4,"quality":"good"}
Persistent request queueDisk-backed · ordered retry · capacity alarm
↑OPC UA subscriptionValue · source timestamp · quality
LEVEL 2Supervisory control
OPC UA ServerSCADA · machine server · gateway
PLC / DCSHMI / SCADASelected tags
2xx AcceptedRemove request from queue and update delivery timestamp.
4xx RejectedQuarantine payload; expose authentication or validation error.
5xx / TimeoutKeep request, apply backoff and retry without re-reading OPC UA.
Reference architecture. Authentication, response policy, retry limits and payload schema must match the target API contract and site security policy.
API latencyRequest and response durationHTTP status2xx, 4xx and 5xx ratesFreshnessAge of latest delivered source valueQueue depthPending requests and oldest age

Only outgoing connections from Level 2.

Outbound to Level 2

The Level 2 DataMule initiates the OPC UA session to the selected server. No inbound session is opened toward the Level 2 DataMule.

Outbound to the DMZ

The Level 2 DataMule initiates delivery to the Level 3 DataMule. No higher-level component initiates a connection into Level 2.

DMZ-to-IT delivery

The DMZ DataMule validates and relays the approved payload to the Level 4 Web API.

Purpose-built for segmented architectures.

No inbound Level 2 rule

Firewall policy can remain directional: connections originate inside Level 2 and move outward toward their defined peers.

DMZ isolation

The second DataMule separates OT collection from IT-facing API delivery and absorbs temporary endpoint outages.

Controlled payload

Only selected OPC UA fields, normalized into an approved API payload, cross the zone boundaries.

Validate the boundary with one data flow.

Define the OPC UA source, DMZ route and Web API contract.

Discuss an OT-to-Web API deployment