--- title: Create custom endpoints to launch scripts description: Custom endpoints let you run arbitrary scripts through the REST API. component: pingidm version: 7.2 page_id: pingidm:scripting-guide:script-custom-endpoints canonical_url: https://docs.pingidentity.com/pingidm/8.1/scripting-guide/script-custom-endpoints.html llms_txt: https://docs.pingidentity.com/pingidm/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md superseded_by: https://docs.pingidentity.com/pingidm/8.1/scripting-guide/script-custom-endpoints.html section_ids: adding-custom-endpoints-structure: Custom endpoint configuration custom-endpoint-scripts: Custom endpoint scripts custom-script-errors: Script exceptions --- # Create custom endpoints to launch scripts *Custom endpoints* let you run arbitrary scripts through the REST API. ## Custom endpoint configuration A custom endpoint configuration *(tooltip: You can create and change custom endpoint configurations over REST at the config/endpoint/\ endpoint, or in files named conf/endpoint-\.json, where \ generally describes the purpose of the endpoint.)* has the following structure: ```json { "context" : "context path", "type" : "script language", "source" : "script source" | "file" : "script file", "apiDescription" : "API descriptor object" } ``` * `context` string, optional The root URL path for the endpoint, in other words, the *route* to the endpoint. An endpoint with the context `endpoint/test` is addressable over REST at the URL `http://localhost:8080/openidm/endpoint/test` or by using a script such as `openidm.read("endpoint/test")`. Endpoint contexts support wild cards, as shown in the preceding example. The `endpoint/linkedview/*` route matches the following patterns: ``` endpoint/linkedView/managed/user/bjensen endpoint/linkedView/system/ldap/account/bjensen endpoint/linkedView/ endpoint/linkedView ``` The `context` parameter is not mandatory in the endpoint configuration file. If you do not include a `context`, the route to the endpoint is identified by the name of the file. For example, in the sample endpoint configuration provided in `openidm/samples/example-configurations/custom-endpoint/conf/endpoint-echo.json`, the route to the endpoint is `endpoint/echo`. * `type` string, required The script type. * `file` or `source` The path to the script file, or the script itself, inline. For example: ```none "file" : "workflow/gettasksview.js" ``` or ```none "source" : "require('linkedView').fetch(request.resourcePath);" ``` ## Custom endpoint scripts The custom endpoint script files in the `samples/example-configurations/custom-endpoint/script` directory demonstrate all the HTTP operations that can be called by a script. Each HTTP operation is associated with a `method` (`create`, `read`, `update`, `delete`, `patch`, `action`, or `query`). Requests sent to the custom endpoint return a list of the variables available to each method. All scripts are invoked with a global `request` variable in their scope. This request structure carries all the information about the request. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Read requests on custom endpoints must not modify the state of the resource, either on the client or the server, as this can make them susceptible to CSRF exploits.The standard READ endpoints are safe from Cross Site Request Forgery (CSRF) exploits because they are inherently read-only. That is consistent with the *Guidelines for Implementation of REST*, from the US National Security Agency, as "…​ CSRF protections need only be applied to endpoints that will modify information in some way." | Custom endpoint scripts *must* return a JSON object. The structure of the return object depends on the `method` in the request. The following example shows the `create` method in the `echo.js` file: ```javascript if (request.method === "create") { return { method: "create", resourceName: request.resourcePath, newResourceId: request.newResourceId, parameters: request.additionalParameters, content: request.content, context: context.current } } ``` Depending on the method, the variables available to the script can include the following: * `resourceName` The name of the resource, without the `endpoint/` prefix, such as `echo`. * `newResourceId` The identifier of the new object, available as the results of a `create` request. * `revision` The revision of the object. * `parameters` Any additional parameters provided in the request. The sample code returns request parameters from an HTTP GET with `?param=x`, as `"parameters":{"param":"x"}`. * `content` Content based on the latest revision of the object, using `getObject`. * `context` The context of the request, including headers and security. For more information, see [Request context chain](request-context.html). * Paging parameters The `pagedResultsCookie`, `pagedResultsOffset`, and `pageSize` parameters are specific to `query` methods. For more information see [Page Query Results](../objects-guide/queries.html#paging-query-results). * Query parameters The `queryId` and `queryFilter` parameters are specific to `query` methods. For more information see [Construct Queries](../objects-guide/queries.html#constructing-queries). ## Script exceptions Some custom endpoint scripts require exception-handling logic. To return meaningful messages in REST responses and in logs, you must comply with the language-specific method of throwing errors. A script written in JavaScript should comply with the following exception format: ```json throw { "code": 400, // any valid HTTP error code "message": "custom error message", "detail" : { "var": parameter1, "complexDetailObject" : [ "detail1", "detail2" ] } } ``` Any exceptions will include the specified HTTP error code, the corresponding HTTP error message, such as `Bad Request`, a custom error message that can help you diagnose the error, and any additional detail that you think might be helpful.