Has anyone seen the xml tag for the "station security code" when using the API. I am trying to use some of the avaya APIs and I have not seen it. Quite a few of them on are int he SMGR UPM_WS guide but have not seen this one.

Which specific API are you interested in?
DMCC - which variant .NET, Java or the XSDs?
AE Services system management web service?
SMGR user management web service?

The field is titled differently in the various APIs where it appears. For example in the dmcc-trace.log file when FINEST tracing is enabled, you can see the security code within the "password" XML tag once you track down the unmarshaled print for the RegisterTerminalRequest message.

<135>Jun 29 16:23:15 aeserver DmccMain[11021] -06:00 2020 362 1 com.avaya.aes | :CstaUnMarshalerNode-2: com.avaya.mvcs.proxy.CstaUnmarshallerNode FINEST - Unmarshalled xml=<?xml version="1.0" encoding="UTF-8"?>#012<RegisterTerminalRequest xmlns="http://www.avaya.com/csta"><device typeOfNumber="other" mediaClass="voice" bitRate="constant">80000:S8800:0.0.0.0:0</device><loginInfo><forceLogin>true</forceLogin><unicodeScript>0</unicodeScript><sharedControl>false</sharedControl><password>123456</password><mediaMode>NONE</mediaMode><dependencyMode>MAIN</dependencyMode><mediaTonesAnnc>true</mediaTonesAnnc></loginInfo></RegisterTerminalRequest> to object=session[null] com.avaya.csta.binding.RegisterTerminalRequest@89df10