REST API

Two nodes in one. In ingress mode it publishes an endpoint that starts the pipeline when called; in egress mode it makes an outbound HTTP request.

Type: rest-api · Category: API · Ports: one input · one output

When to use it

• Accepting orders, recipes or schedules pushed by an ERP or MES
• Calling a webhook, a chat service or a third-party API
• Exposing a value to something that cannot read tags

Settings

Setting	Key	Default	Purpose
Mode	mode	ingress	Receive requests, or make them.
Method	method	GET	HTTP method; * for any (ingress).
URL pattern	urlPattern	/api/v1/example	Ingress: the route's path. The editor shows the full address under it — /gateway/<project-slug> followed by the pattern. Egress: the URL to call.
Timeout	timeout	30 s	Ingress: how long the caller waits for the pipeline. Egress: how long the call may take.
Auth	authType	Public (No Auth)	API Key (X-API-Key), or Public (No Auth). A new node starts public, with an amber warning saying so — choose API Key for anything outside a test bench.
Allowed IPs	allowedIPs	—	Comma-separated CIDR allow-list.
Rate limit / burst	rateLimit, burstLimit	0 (off)	Requests per second, and burst size.
Max payload size	maxPayloadSize	1 MB	Request body cap.
CORS	corsEnabled, allowedOrigins	false, *	Browser access control.
Static headers	egressStaticHeaders	{}	Headers added to outbound calls.

A route is a path, not a template. There are no :id placeholders. A request matches the route with the same method and path; failing that, a route whose method is *; failing that, the route whose path the request's path begins with — so /api/v1/orders/SO-1042 reaches a route published as /api/v1/orders. Pass identifiers in the query string, or read the full path from the message's origin (below).

What the pipeline receives

The request becomes the message payload:

Field	Holds
params	The query string, one value per name: ?line=L1 → {"line": "L1"}
body	A JSON body, parsed. Any other body arrives as text
form · files	A form post's fields, and its uploaded files (name, size, type and the content as base64)

The request itself — method, path (including the project slug), query, headers and the caller's client_ip — is in the message's origin context, message["origin"]["ctx"] in a Python node. Credentials never reach the pipeline: Authorization, Cookie, X-Api-Key and X-Auth-Token are stripped from the headers, and so are X-Forwarded-For and X-Real-Ip, which a caller can forge — client_ip is the address the gateway trusts.

Example A — ingress, accepting an order from an ERP

Mode:        ingress
Method:      POST
URL pattern: /api/v1/orders
Auth:        API Key (X-API-Key)
Rate limit:  10

Out

{
  "payload": {
    "params": {},
    "body": { "orderId": "SO-4471", "line": "LINE1", "quantity": 1200 }
  }
}

Example B — egress, posting to a webhook

Mode:        egress
Method:      POST
URL pattern: https://hooks.example.com/plant-alerts
Timeout:     10

Gotchas

• The address includes the project. A route published as /api/v1/orders in project plant-a is called at http://<host>:8090/gateway/plant-a/api/v1/orders.
• Set an egress timeout shorter than the caller's patience. A 30-second outbound call inside a pipeline triggered every 10 seconds builds a backlog you will not notice until it is deep.
• Every ingress path must reach an HTTP Response, or the caller waits for the route's timeout and gets a 504.

See also

• REST endpoints
• Tutorial: expose a REST endpoint