CoAP · Study deck
CoAP Messages: Codes, Tokens, and Options
A CoAP request can share a message ID yet belong to a different exchange.
Broker Bex is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: Key Takeaway: The 4-byte header efficiency is CoAP's main advantage over HTTP - it encodes everything needed for request-response matching, reliability selection, and method identification in just 32 bits.
- Explain: Just like how a bottle label is tiny compared to the letter inside, CoAP's header is tiny (4 bytes!) compared to HTTP's headers (hundreds of bytes!).
- Explain: On constrained links, 60 application/cbor carries structured data in a compact binary representation; 40 application/link-format has the separate job of encoding discovery links.
- Map CoAP method and response codes to their wire values.
Major section
Minimum Viable Understanding: CoAP Message Structure
The fixed header contains version, message type, token length, method/response code, and message ID.
- Key Takeaway: The 4-byte header efficiency is CoAP's main advantage over HTTP - it encodes everything needed for request-response matching, reliability selection, and method identification in just 32 bits.
Major section
The 4-Byte Fixed Header
Choosing between CON and NON is one of the most important decisions in a CoAP implementation.
- The wrong choice either wastes battery on unnecessary retransmissions or silently loses critical commands.
- Rule of thumb: If losing the message would require human intervention to notice or correct, use CON.
Major section
Message in a Bottle
The CoAP header is like the label you put on the bottle.".
- Code: What you want - "Can I have the temperature?" (GET).
- Just like how a bottle label is tiny compared to the letter inside, CoAP's header is tiny (4 bytes!) compared to HTTP's headers (hundreds of bytes!).
Major section
Token Security Consideration
In secure deployments (DTLS), tokens should be unpredictable (randomly generated) to prevent response spoofing attacks.
- A malicious actor who can predict tokens could inject fake responses.
Major section
CoAP Options
Extended delta: 0, 1, or 2 extra bytes when the delta does not fit in 4 bits.
- Option 1: Uri-Path = "sensors" uses delta 11, length 7, and encodes as 0xB7 | "sensors".
- Option 2: Uri-Path = "temp" uses delta 0, length 4, and encodes as 0x04 | "temp".
Major section
CoAP Options (continued)
The Content-Format option tells the receiver how to decode the payload, so select it as part of the resource contract rather than after serialization.
- 0 text/plain fits a human-readable scalar, while 50 application/json supports familiar structured objects.
- On constrained links, 60 application/cbor carries structured data in a compact binary representation; 40 application/link-format has the separate job of encoding discovery links.
- A receiver must interpret the numeric code before parsing payload bytes.
Major section
Worked Example: GET /sensors/temp with JSON Response
Real-world HTTP requests with cookies, user-agent, and other headers typically reach 300-800 bytes.
- The ACK + response is piggybacked -- one message serves as both "I received your request" and "here is the data.".
Major section
Putting Numbers to It
We can calculate the exact battery impact over the device lifetime.
- Battery impact: At 0.5 mJ per byte (typical LoRa SF12), the CoAP exchange costs 32 mJ vs 160 mJ for HTTP per reading.
Deck summary
Key takeaways
The fixed header contains version, message type, token length, method/response code, and message ID.
- Choosing between CON and NON is one of the most important decisions in a CoAP implementation.
- The CoAP header is like the label you put on the bottle.".
- In secure deployments (DTLS), tokens should be unpredictable (randomly generated) to prevent response spoofing attacks.
- Extended delta: 0, 1, or 2 extra bytes when the delta does not fit in 4 bits.
Retrieval practice
Recall check 1 of 3
Broker Bex says: answer from memory, then check your reasoning.
Q1A CoAP client sends PUT /actuator/valve {"position": 50} to set a valve to 50% open. The server successfully updates the valve. What response code should the server return?
Show answer
Answer: B Correct!
Retrieval practice
Recall check 2 of 3
Broker Bex says: answer from memory, then check your reasoning.
Q2A CoAP client has two in-flight requests: GET /temperature (Token=0xAA, MsgID=0x0001) and GET /humidity (Token=0xBB, MsgID=0x0002). The CON for temperature times out and is retransmitted. What values should the retransmission carry?
Show answer
Answer: A Correct!
Q3Complete the CoAP message construction:
Show answer
Answer: A CoAP messages use mtype=CON for confirmable (reliable) delivery.
Retrieval practice
Recall check 3 of 3
Broker Bex says: answer from memory, then check your reasoning.
Q4You capture a CoAP packet with first byte 0x50. What can you determine about this message?
Show answer
Answer: A Correct!
Print reference
Answers
Answer key.
- B · Correct!
- A · Correct!
- A · CoAP messages use mtype=CON for confirmable (reliable) delivery.
- A · Correct!