PI Web API 2023 SP1 release notes

Save PDF

Last UpdatedMay 27, 2026
8 minute read

PI Web API 2023 SP1

1.19.0.621

Overview

The PI Web API is a RESTful service in the Developer Technologies suite, designed to provide cross-platform web and mobile programmatic interfaces to the PI System. The PI Web API presently contains basic functionality needed to retrieve and manipulate time series data from the PI Data Archive, Asset and Event Frame data from the PI Asset Framework, and to index and search on objects within the PI System.

The PI Web API belongs to the OSIsoft Developer Technologies family of products, which is designed to support the implementation of custom applications on top of the PI System, as well as the integration of PI System data with other applications and business systems such as Microsoft Office or SQL Server, Enterprise Resource Planning systems (ERPs), reporting and analytics platforms, web portals, geospatial and maintenance systems, just to name a few. The Developer Technologies cover a wide range of use cases in various environments, programming languages, operating systems, and infrastructures.

Fixes and enhancements

Fixes

This section lists items that were resolved in this release of PI Web API.

Work Items	Description
648858	Performance degradation occurs if the user account does not have access to the PI Web API’s node default AF Server.

Enhancements

PI Web API 2023 SP1 introduces the following enhancements:

SSL Certificate information is added to the “/system/status” endpoint.
The “assetdatabases/{webId}/import” endpoint is removed.
Support for OMF PI Points with Future Data.
Support for writing SYSTEM Digital States to OMF PI Points with Quality Mapping.
Improved caching for more efficient processing of OMF Type create, OMF Container create, and OMF Container update messages in certain scenarios.
When the Interpolation property value of a dynamic OMF Type is “discrete”, PI Points created from that OMF Type will have the compressing setting turned off.

Known Issues

This section lists problems and/or enhancements that have been deferred until a future release:

Work Items	Description
61475	PI Web API silent installation fails if InstallationConfig.json path has spaces.
63862	PI Web API Admin Utility adds CA-signed certificate to local machine Trusted People store.
64081	The OMF feature will not be available after modifying an installation using the control panel and will return 404 not found error. To work around the issue, run the PI Web API Admin Utility after the installation.
64268	If a user is removed from the “PI Web API Admins” group and later runs the installer, that user will not be re-added to the group. As a workaround, the user can be manually added to the “PI Web APIAdmins” group.
130566	Non-ASCII characters cannot be used in usernames or passwords in Basic Authentication.
192785	Retrieving Digital State values may fail if the Digital Set has been changed.
256431	Changing the EventLogDebugAnalyticCharacterLimit app.config setting stops OMF request/responsesfrom being logged.
258584	PI Web API incorrectly converts string stream values that are formatted as valid ISO8601 timestamps toDateTime format.
268437	OMF Property that is marked as both ‘IsIndex’ or ‘IsName’ and ‘IsQuality’ breaks type.
276901	OMF DATA of type ‘number’ doesn’t emit loss of precision warnings.
N/A	In a Remote Desktop Session to a Windows Server 2016 machine, the PI Web API Admin Utility can become unresponsive upon enumerating available SSL certificates. As a workaround, make the Remote Desktop Session lose focus (for example, click outside the Remote Desktop Connection window), and then restore focus to the PI Web API Admin Utility. No work item has been created to address this issue.
N/A	On a Windows Server Core machine, the PI Web API Admin Utility cannot use “OpenID ConnectAuthentication” option to connect to a claims-enabled AF/DA server with an error “Class notregistered”. As a workaround, use Windows Authentication to connect. The root cause is that no“default web browser” is set up on the Windows Core machine. No work item has been created to address this issue.

System Requirements

Operating Systems

This release is supported on the following operating systems:

Windows Server 2022
Windows Server 2019
Windows Server 2016

Windows 11 (64-bit only) may be used in a limited capacity for development and testing purposes only. Please make sure that two entries (RegisteredOwner and RegisteredOrganization) exist under the Registry Key (HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion).

If they do not exist, add the two entries with empty string values.

Note: Earlier versions of Windows and non-x64 versions of Windows are not supported.

Server Platforms

Core:

PI Data Archive 2018 SP3 Patch 3 (3.4.440.477) or later is recommended.
PI AF Server 2018 SP3 Patch 3 (2.10.9.593) is recommended.

OMF:

PI Data Archive 2018 SP3 Patch 3 (3.4.440.477) or later is recommended.
PI AF Server 2018 SP3 Patch 3 (2.10.9.593) is recommended.

AVEVA PI Server 2023 or later is required for OIDC authentication for Core and OMF.

Not all features, bug fixes, and performance enhancements may be available with older PI Data Archive or PI AF Servers.

Distribution Kit Files

The installer is released as a self-extracting distribution kit containing:

Installation files for PI AF Client 2023 Patch 2 (x64), which includes the AF Client installer, and installers for its prerequisites:
- Microsoft Visual C++ 2022 Redistributable (x86 and x64)
- PI Network Subsystem 3.5.500.617
- PI Buffer Subsystem 4.9.0.37
The PI Web API Windows Installer Database (MSI) file signed by AVEVA

Installation and Upgrade

Before You Install

Verify that the system you plan to use is running a supported operating system.
Verify that you can run the installer as an Administrator.

Installation and Upgrade

The PI Web API installer has a graphical user interface, which allows you to perform an installation or upgrade of PI Web API. At the end of an installation or upgrade, the PI Web API Admin Utility is automatically launched.

Go through all the steps in the PI Web API Admin Utility to complete the installation or upgrade. Detailed information and a walk-through of installation is available in the Installation section of the PI Web API User Guide.

The PI Web API installer supports silent installations. See silent installation for detailed information.

Uninstalling PI Web API

Remove the product using Uninstall a program in the Windows Control Panel, or alternatively, re-run the Installation Kit and follow the prompts to remove the product.

Uninstalling the product will not remove:

Any SSL certificates that were created during the installation process
The binding of the selected SSL certificate to the port used by PI Web API in the Windows HTTP service’s configuration
The URL reservation for PI Web API in the Windows Kernel routing table

The above items may be removed manually if desired.

Security information and guidance

We are committed to releasing secure products. This section is intended to provide relevant security-related information to guide your installation or upgrade decision.

We proactively disclose aggregate information about the number and severity of security vulnerabilities addressed in each release. The tables below provide an overview of security issues addressed and their relative severity based on standard scoring.

Overview of New Vulnerabilities Found or Fixed

This section is intended to provide relevant security-related information to guide your installation or upgrade decision. We proactively disclose aggregate information about the number and severity of PI Web API security vulnerabilities that are fixed in this release.

Security Vulnerabilities in PI Web API 2023 SP1 1.19.0 Release

For this release of PI Web API, one vulnerability has been fixed.

Severity Category	CVSS Base Score Range	Number of Fixed Vulnerabilities
Critical	9 - 10	0
High	7.0 - 8.9	1
Medium	4.0 - 6.9	0
Low	0 - 3.9	0

Security Vulnerabilities in PI AF Client 2023 Patch 1 and 2

Related to this release of PI Web API, four vulnerabilities have fixed in PI AF Client 2023.

Severity Category	CVSS Base Score Range	Number of Fixed Vulnerabilities
Critical	9 - 10	0
High	7.0 - 8.9	2
Medium	4.0 - 6.9	1
Low	0 - 3.9	1

Vulnerability Mitigations in PI Web API 2023 SP1 v1.19.0 Release

The following vulnerabilities were identified in PI Web API v1.19.0 Release:

Component	Version	CVE or Reference	CVSS	Mitigation
RazorEngine	3.10.0	CVE-2021-46703 (https://nvd.nist.gov/vuln/detail/CVE-2021-46703)	9.8	The PI Web API does not use the IsolatedRazorEngineService or allow users to externally control the contents of Razor templates.
azure-activedirectory-identitymodel-extensions-for-dotnet	5.6.0	CVE-2024-21319 (https://nvd.nist.gov/vuln/detail/CVE-2024-21319)		Exploiting this vulnerability requires access to a public encryption key used to encrypt a JSON Web Token (JWT) per information from Microsoft regarding this vulnerability (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319). Microsoft further states: "An attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition." PI Web API does not store or use a public encryption key and does not use JSON Web Encryption.
JSON Web Token Handler For the Microsoft .Net Framework 4.5	5.6.0	CVE-2024-21319 (https://nvd.nist.gov/vuln/detail/CVE-2024-21319)	6.8	Exploiting this vulnerability requires access to a public encryption key used to encrypt a JSON Web Token (JWT) per information from Microsoft regarding this vulnerability (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319). Microsoft further states: "An attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition." PI Web API does not store or use a public encryption key and does not use JSON Web Encryption.
SQLite	3.43.0	BDSA-2023-3627	6.3	SQLite contains a heap use-after-free vulnerability due to mishandling of certain input. A local attacker could exploit this by convincing a victim into interacting with supplied malicious input, potentially leading to serious impacts to application confidentiality, integrity, and availability due to the corruption of memory. This vulnerability does not apply to PI Web API as the interdependency using SQLite does not have JSON parsing capability.

Documentation overview

These release notes comprise a part of the following documentation set that supports PI Web API:

PI Web API 2023 SP1 Programmer Reference: This reference is included in the product. It is an online API reference meant for developers who wish to program against the services provided in the product. It is accessible as HTML from https://servername/piwebapi/help, where servername is the hostname of the server on which this product has been installed.
PI Web API 2023 SP1 User Guide: This user guide provides information relevant to the configuration, settings, and administration of the product, and contains steps and helpful information for resolving problems with the product.
PI Square and PI Developers Club: The OSIsoft PI Square Community has free resources to help you with the programming and integration of OSIsoft products. Additional benefits are available on a paid subscription basis to members of PI Developers Club.

Additional information about the PI Developer Platform, PI Data Archive, PI Asset Framework, and other topics of interest can be found in respective books available on Technical Support and Resources.

Technical support and resources

For technical assistance, contact OSIsoft Technical Support at +1 510-297-5828 or log a case through the OSIsoft Customer Portal. Additionally, the Contact Us page on the portal offers contact options for customers outside of the United States. This software and related content are available from the Product section of the OSIsoft customer portal at https://my.osisoft.com.

When you contact Technical Support, be prepared to provide this information:

Product name, version, and build numbers
Computer platform (CPU type, operating system, and version number)
Time that the difficulty started
Log files at that time
Details of any environment changes prior to the start of the issue
Summary of the issue, including any relevant log files during the time the issue occurred

The PI Square community has resources to help you with your technical questions. PI Developers Club program offers specific services to developers and system integrators.

PI Web API