Inventory of what is published
Reads the WMS, WFS and WMTS GetCapabilities and the OGC API /collections: layers, CRS, extent, operations.
Octo for GeoServer, MapServer and QGIS Server
The server publishes whatever you let it. Knowing what is there is the first step.
GeoServer 3.0 (3.0.0 released on Jun 11, 2026), MapServer 8.6 and QGIS Server publish WMS, WFS and OGC API Features, and everything in them can be configured and tested via REST API, mapfile and HTTP request. Octo publishes to a test workspace, versions SLD styles, checks each service by image and by content and audits what is exposed. What stays public, who can write and when to touch production stay with the administrator and the data owner.
GeoServer3.0.2stable; 3.0.0 on Jun 11, 2026, GPL 2.0
MapServer8.6.6Sep 6, 2026, MIT-style license
OGC API Features1.0.1Part 1, also ISO 19168-1:2020
Sources13listed at the end of the page
01
What Octo does with OGC servers.
Six possible deliverables, drawn from the assessment. All of them start by reading the server without changing anything, and all of them go to the administrator before reaching production.
Publishing via REST
Workspace, PostGIS connection, layer and style in GeoServer via the REST API, in a test workspace and with a dry-run mode.
Deliverable: repeatable script + check by imageVersioned mapfile and project
MapServer mapfile with named operations and listed attributes; QGIS Server project checked in the server properties.
Deliverable: configuration in git with line-by-line reviewSLD style from the class table
Generates the SLD from the table approved by the cartographer, validates it, applies it in test and checks GetMap and GetLegendGraphic.
OGC API Features tests
Landing page, conformance, collections and items with limit and bbox, checked by the JSON and by the approved attributes.
Exposure audit
Open WFS-T, a layer outside the inventory, a sensitive attribute, a version with a pending security fix: all read-only.
Deliverable: list for the administrator to decide
02
Eight arms, a service checked before it opens.
The same Octo cycle, applied to map publishing. Each arm has a narrow role; people decide what is public, who writes and when to touch production.
-
Discovery
Surveys the servers
Which servers exist, versions, container, active services, layers and where each one reads from.
-
Data
Looks at the origin of each layer
Table or file, CRS, extent, attributes, update frequency and the source's license.
-
Security
Looks at what is exposed
Default password, admin interface, WFS-T, personal data (LGPD) and version against security fixes.
-
Architecture
Chooses the path
Which server, OGC API or classic service, tile cache or dynamic map, a separate test workspace.
-
Development
Writes the configuration
REST scripts, mapfile, SLD and tests, with a dry-run mode and credentials always kept out of the code.
-
Review
Checks by content
GetMap image, legend, OGC API JSON, GetFeature attributes. Status 200 is not a check.
-
Release
Only with your OK
Moving to the production workspace, version upgrades and cache truncation in the agreed window.
-
Documentation
Records what is live
Public layers, styles, attributes, since when and who approved each one.
Octo works with read access and as support. It does not decide what stays public, enable writing or test access without written authorization, and it does not change production without approval.
03
Each task, its own path.
The criteria Octo uses to choose, with the documentation for the installed version.
| Task | Path | Note |
|---|---|---|
| Server version | GeoServer /rest/about/manifests; capabilities on all three | Read-only |
| What is published | GetCapabilities; /collections in OGC API | Read-only |
| Connect PostGIS in GeoServer | POST /rest/workspaces/{ws}/datastores | Read-only user; password kept out of the script |
| Publish a table | POST .../featuretypes | In a test workspace first |
| Apply a style | POST /rest/styles + PUT /rest/layers | SLD validated first |
| Publish in MapServer | Versioned mapfile | Named operations, never "*" in WFS |
| Publish in QGIS Server | .qgz project with server properties | Symbology comes from the project |
| Test OGC API Features | /conformance, /collections/{id}/items | Check the JSON |
| Find open WFS-T | Transaction operation in the WFS capabilities | Administrator's decision |
| Truncate the tile cache | GeoWebCache REST | Only with approval |
04
From the one-off audit to a server under control.
Three steps. Each one only makes sense after the previous one has shown results on your team.
A proposal, not a promise
Inventory of what is live
Octo shows what each server publishes and what is exposed, without changing anything.
- Layers by service
- WFS-T, personal data, version
- List of questions for the administrator
Publishing by script
Layers and styles published via REST and mapfile, in a test workspace, checked by image.
- Versioned SLD
- Mapfile and project in git
- OGC API tests by collection
Continuous audit
On every change, the capabilities are read again and compared with the approved inventory.
- Alert for layers outside the inventory
- Tracking of versions and fixes
- History of what was published and by whom
05
Confirmed in a source.
Each point below has a source published by the project or by the organization responsible for the standard. The sources are in the next section.
5
points with a published source, each with its reference shown alongside.
- ConfirmedGeoServer 3.0
- 3.0.0 on Jun 11, 2026, with Spring Framework 7, Tomcat 11 or Jetty 12.1, OIDC as an extension and WCS 1.0/1.1 moved to an extension; 3.0.2 is the recommended stable release.Source: 3.0.0 announcement and download page
- ConfirmedMapServer 8.6.6
- From Sep 6, 2026, with six security fixes; OGC API since 8.0 (2022) and Part 2 (CRS) since 8.2.Source: HISTORY.md in the official repository
- ConfirmedQGIS Server
- Implements WMS, WFS, OGC API Features 1.0 and WCS; follows QGIS, with LTR 3.44.15 and latest 4.2.3 on the roadmap.Source: QGIS Server manual and QGIS roadmap
- ConfirmedOGC API Features
- Part 1 Core 1.0.1 (ISO 19168-1:2020), Part 2 CRS 1.0.1, Part 3 Filtering 1.0.0.Source: ogcapi.ogc.org/features
- ConfirmedGeoServer default password
- New installations come with
admin/geoserver; whether the account was changed is checked on the server, with authorization.Source: GeoServer web interface quickstart
06
What Octo does and what stays with you.
Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Surveys, calculates, organizes and produces the documents: spreadsheets, reports, maps and drafts.
Deliverable: material ready to checkYour team checks
The licensed professional checks what Octo delivered before signing. If something doesn't add up, it goes back to Octo with the correction.
Step: review by the signerThe signer
Octo does not sign. Projects, technical reports, ART/RRT, accountability reports and any official document are still signed by the company's or agency's licensed professional: here, the technical lead for the map or the survey.
Signature: technical lead for the map or survey
07
Sources.
Official project sites, documentation and repositories and the OGC page, consulted on Oct 31, 2026.
- GeoServer, download3.0.2 stable, 2.28.6 maintenance
- GeoServer 3.0.0Jun 11, 2026
- GeoServer, licenseGPL 2.0
- GeoServer, REST APIResources and a note on Swagger
- GeoServer, servicesWMS, WFS, WCS, WMTS, OGC API
- MapServer, history8.6.6 and fixes
- MapServer, licenseMIT-style
- MapServer, OGC APIrequired metadata and TEMPLATE
- GeoServer, web interfacedefault credentials
- QGIS Server, manualImplemented services
- QGIS, roadmap4.2.3 and LTR 3.44.15
- pygeoapi, releases0.24.0
- OGC API FeaturesParts 1, 2 and 3
Your map server, checked by what it publishes.
The assessment starts with an inventory of what your servers advertise in WMS, WFS, WMTS and OGC API, without changing anything. You get the list of what is exposed, what is outdated and the decisions only your team makes, and you decide with it in hand.