SecurityEventNotification

Reports a security-relevant event: a failed login, a firmware signature failure, a reboot, a tampered enclosure.

Version: OCPP 2.0.1
Direction: Charge Point → CSMS
Functional block: Security

There is no 1.6 equivalent. 2.0.1 defines a set of critical security event types that a station must report, which is what makes an auditable security log possible across a mixed fleet.

The spec lists the event types a station is required to send; vendors may add their own.

Request

Field	Type	Required	Description
`type`	string	Required	The event type. Up to 50 characters.
`timestamp`	dateTime	Required	When the event occurred.
`techInfo`	string	Optional	Additional detail. Up to 255 characters.

json

[2, "19223201", "SecurityEventNotification", {
  "type": "InvalidFirmwareSignature",
  "timestamp": "2026-09-09T03:14:00Z",
  "techInfo": "Signature check failed for firmware 3.2.0"
}]

Response

No fields — the payload is an empty object {}.

json

[3, "19223201", {}]

Values

Critical event types (selected)

Value	Meaning
`FirmwareUpdated`	New firmware was installed.
`FailedToAuthenticateAtCsms`	The station could not authenticate to the CSMS.
`CsmsFailedToAuthenticate`	The CSMS could not authenticate to the station.
`InvalidFirmwareSignature`	A firmware signature check failed.
`InvalidFirmwareSigningCertificate`	The firmware signing certificate was invalid.
`InvalidCsmsCertificate`	The CSMS certificate was invalid.
`InvalidChargingStationCertificate`	The station certificate was invalid.
`InvalidTLSVersion`	A TLS version below the required minimum was offered.
`InvalidCipherSuite`	An unacceptable cipher suite was offered.
`SettingSystemTime`	The system clock was changed.
`StartupOfTheDevice`	The station started up.
`ResetOrReboot`	The station was reset or rebooted.
`SecurityLogWasCleared`	The security log was cleared.
`MemoryExhaustion`	The station ran out of memory.
`TamperDetectionActivated`	Physical tampering was detected.

Implementation notes

Alert on the authentication failures. FailedToAuthenticateAtCsms and CsmsFailedToAuthenticate in volume mean either a certificate rotation went wrong or something is impersonating one side.

SettingSystemTime matters for billing integrity: a clock that moves during a transaction changes what the meter data appears to say.

The full security log is retrieved with GetLog using logType: "SecurityLog".