Control Server Power over Redfish

Switch a Brainsalt server on and off straight from a third-party control system — Crestron, AMX, Q-SYS or any other controller that can send HTTPS requests — by talking to the server's management controller (BMC) over the network with Redfish. This is the same conversation the Brainsalt Hub Desktop App has with the BMC, written out request by request so it can be rebuilt in a controller program.

The steps describe each request as the controller sends it. To try the requests by hand first, Try it from a Mac and Try it from a Windows PC further down walk through every one of them, starting from how to open the program you type them into.

Before you start

• The BMC's IP address is known, and the control system can reach it on TCP port 443
• The user name and password you sign in to the Brainsalt Hub with. By default the BMC uses the same credentials as the Hub — only if a separate BMC credential was set for the series in the Hub settings, use that one instead
• The control system accepts the BMC's self-signed HTTPS certificate
• The server is connected to mains power. The BMC runs on standby power, so it answers even while the server is switched off
• On a B7 Series Server: the BMC licence that enables Redfish is installed

Steps

1. Log in once and keep the session

Open one Redfish session and reuse it for every request that follows.

POST https://<BMC-IP>/redfish/v1/SessionService/Sessions
Content-Type: application/json

{"UserName": "<user>", "Password": "<password>"}

The BMC answers 201 Created with two headers to keep: X-Auth-Token goes on every later request, and Location is the session's own address, which you delete when you are done.

If the login itself is answered with 400, 404, 405 or 501, that BMC has no session service. Only then fall back to sending user name and password with each request (HTTP Basic authentication), and poll slowly. A 401 means the credentials are wrong — it does not mean sessions are unsupported.

2. Find the system and its reset action

Ask for the list of systems and take the first member's address, then read that system. Send the token with both requests.

GET https://<BMC-IP>/redfish/v1/Systems
X-Auth-Token: <token>

GET https://<BMC-IP><first member's @odata.id>
X-Auth-Token: <token>

In the system's answer, PowerState is the current state and Actions → #ComputerSystem.Reset → target is the address every power command goes to. The system's address differs between series, so read it from the BMC rather than hard-coding it. Store the reset target; it does not change.

3. Read which power commands the server accepts

The accepted commands are listed next to the reset target, but where they are listed depends on the series — see Differences between B7, B8 and B9 Series Servers below. Send only a command from that list.

4. Send a power command

POST https://<BMC-IP><reset target>
X-Auth-Token: <token>
Content-Type: application/json

{"ResetType": "On"}

Any 2xx status means the BMC accepted the command — not that the server has finished switching, so confirm with the next step. The commands you will use:

5. Poll the power state

Read the system again with the same token (the second request of step 2) and check PowerState — On or Off. Every 20 seconds is plenty — it is the interval the Brainsalt Hub uses. Faster polling gains nothing and loads the BMC.

6. Log in again when the session has expired

A BMC ends a session that has been idle too long. The next request then answers 401. Log in again once (step 1), replace the token, and repeat the request. Do not loop: if the fresh login fails too, the credentials are the problem.

7. Log out when the control program stops

DELETE https://<BMC-IP><Location from step 1>
X-Auth-Token: <token>

This frees the session's slot on the BMC instead of leaving it held until it times out.

Switching a server off reliably

A graceful shutdown can fail and leave the server in an uncertain state. The Brainsalt Hub's weekly schedule switches off like this, and a controller should do the same:

1. Send GracefulShutdown.

2. Wait 60 seconds.

3. Read PowerState from the BMC. If it is still On, send ForceOff.

4. If a command is not accepted, try again up to three times, 20 seconds apart.

Differences between B7, B8 and B9 Series Servers

The requests above are identical on every series. What differs is only where the list of accepted commands sits.

Try it from a Mac

A Mac already has everything needed: the Terminal app, and the curl command that sends the requests. Nothing has to be installed.

Open Terminal

1. Press ⌘ Command + Space to open Spotlight.

2. Type Terminal and press Return. A window with a text prompt opens.

3. Copy each block below, paste it into that window with ⌘ Command + V, and press Return.

Terminal is also in Applications › Utilities in the Finder.

Run the requests

First, tell Terminal the BMC's address and your credentials. Replace the three values, keeping the quotes:

BMC='192.168.10.50'
BMC_USER='operator1'
BMC_PASS='your-password'

Log in. This keeps the token and the session address for everything that follows, so there is nothing to copy by hand:

HEADERS=$(curl -sk -D - -o /dev/null -X POST "https://$BMC/redfish/v1/SessionService/Sessions" -H "Content-Type: application/json" -d "{\"UserName\":\"$BMC_USER\",\"Password\":\"$BMC_PASS\"}")
TOKEN=$(echo "$HEADERS" | awk 'tolower($1)=="x-auth-token:" {print $2}' | tr -d '\r')
SESSION=$(echo "$HEADERS" | awk 'tolower($1)=="location:" {print $2}' | tr -d '\r')
echo "Token: $TOKEN"

If Token: is followed by nothing, the login failed — check the address, the user name and the password, and run the block again.

Find the system:

curl -sk "https://$BMC/redfish/v1/Systems" -H "X-Auth-Token: $TOKEN"

The answer contains a part like the one below. Copy the address after @odata.id — here /redfish/v1/Systems/1:

"Members":[{"@odata.id":"/redfish/v1/Systems/1"}]

Put that address into the next block, then read the system:

SYS='/redfish/v1/Systems/1'
curl -sk "https://$BMC$SYS" -H "X-Auth-Token: $TOKEN"

The answer shows "PowerState", the reset target ("target") and, on B8 and B9 Series Servers, the accepted commands. Switch the server on — the reset target is normally the system's address followed by /Actions/ComputerSystem.Reset; if the answer shows a different one, use that:

curl -sk -X POST "https://$BMC$SYS/Actions/ComputerSystem.Reset" -H "X-Auth-Token: $TOKEN" -H "Content-Type: application/json" -d '{"ResetType":"On"}'

For the other commands, replace On with GracefulShutdown, ForceOff and so on. Check the power state:

curl -sk "https://$BMC$SYS" -H "X-Auth-Token: $TOKEN" | grep -o '"PowerState" *: *"[A-Za-z]*"'

When you are finished, log out:

case "$SESSION" in http*) URL="$SESSION" ;; *) URL="https://$BMC$SESSION" ;; esac
curl -sk -X DELETE "$URL" -H "X-Auth-Token: $TOKEN"

Try it from a Windows PC

Windows 10 and 11 already have Windows PowerShell, which can send the requests itself. Nothing has to be installed.

Open PowerShell

1. Click Start (or press the Windows key).

2. Type PowerShell and click Windows PowerShell. A window with a text prompt opens. Administrator rights are not needed.

3. Copy each block below, paste it into that window with a right-click (or Ctrl + V), and press Enter.

Run the requests

First, let this PowerShell window accept the BMC's self-signed certificate, and enter the BMC's address and your credentials. Replace the three values, keeping the quotes:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$BMC = "192.168.10.50"
$BmcUser = "operator1"
$BmcPass = "your-password"

The certificate setting lasts only until the window is closed; paste this block again in a new window.

Log in. This keeps the token and the session address for everything that follows:

$login = Invoke-WebRequest -UseBasicParsing -Method Post -Uri "https://$BMC/redfish/v1/SessionService/Sessions" -ContentType "application/json" -Body (@{ UserName = $BmcUser; Password = $BmcPass } | ConvertTo-Json)
$h = @{ "X-Auth-Token" = [string]$login.Headers["X-Auth-Token"] }
$session = [string]$login.Headers["Location"]
"Token: " + $h["X-Auth-Token"]

Red text instead of Token: … means the login failed — check the address, the user name and the password, and run the block again.

Find the system, read it, and show its power state. PowerShell reads the addresses out of the answers itself:

$systems = Invoke-RestMethod -Uri "https://$BMC/redfish/v1/Systems" -Headers $h
$sysUri = "https://$BMC" + $systems.Members[0].'@odata.id'
$sys = Invoke-RestMethod -Uri $sysUri -Headers $h
$reset = $sys.Actions.'#ComputerSystem.Reset'
$sys.PowerState
$reset.'ResetType@Redfish.AllowableValues'

The last line lists the accepted commands on B8 and B9 Series Servers; on a B7 Series Server it shows nothing — see the differences above. Switch the server on:

Invoke-RestMethod -Method Post -Uri ("https://$BMC" + $reset.target) -Headers $h -ContentType "application/json" -Body '{"ResetType":"On"}'

For the other commands, replace On with GracefulShutdown, ForceOff and so on. Check the power state:

(Invoke-RestMethod -Uri $sysUri -Headers $h).PowerState

When you are finished, log out:

if ($session -notmatch "^https?://") { $session = "https://$BMC$session" }
Invoke-RestMethod -Method Delete -Uri $session -Headers $h

If you use the newer PowerShell 7 instead of Windows PowerShell, leave out the two [Net.ServicePointManager] lines and add -SkipCertificateCheck to every Invoke-WebRequest and Invoke-RestMethod command instead.

Common Mistakes

• The BMC stops answering after a while — the controller logs in for every request, or sends user name and password each time. Each one takes a session slot. Log in once and reuse the token (step 1).

• Power on works from the Hub but not from the controller — the controller is talking to the server's IP address. Power commands go to the BMC's address, which is different.

• 401 although the password is right — a separate BMC credential was set for that series in the Hub settings, so the Hub sign-in does not apply. Use the credential set there.

• The server reads On right after a successful ForceOff — a 2xx status means the command was accepted, not completed. Poll PowerState until it changes.

• A hard-coded /Systems/1 fails on another series — the system's address differs. Read it from /redfish/v1/Systems (step 2).

• PowerShell says the connection was closed, or that a trust relationship could not be established — the certificate lines were not run in this window. Paste the first block again.

Tips

• Treat ForceOff as the fallback of a shutdown, never as the shutdown itself. It skips Windows' shutdown, which risks the media and the project files.

• After sending GracefulShutdown, check the power state again a minute later and send ForceOff if the server is still on. A graceful shutdown sometimes fails and leaves the server in an uncertain state, and forcing it off is then correct — unless Windows updates have been enabled and one may be running (see Switching a server off reliably).

• Allow 8 seconds for the login and for a power command, and 5 seconds for a status read — the timeouts the Hub uses. A BMC answers slowly under load; a shorter timeout turns a slow answer into a failure and a retry into a second session.

• Poll at most every 20 seconds, per BMC, over the one session — status and commands share it.

• Trying the requests by hand opens a session too. Log out at the end, or it holds a slot until the BMC times it out.

Related

Control Server Power — every power action and where the Hub and System Management offer it

Configure Server Network Settings — finding and setting the BMC's IP address

Use the Brainsalt Hub Desktop App — the Hub sign-in, and where a separate BMC credential per series would be set