REST Endpoints
What are REST Endpoints?
Use Groovy scripts to define REST endpoints allowing you to integrate with external systems and exchange data. An endpoint is a URL that runs a script. ScriptRunner REST Endpoints allows you to create custom endpoints to suit your needs.
How to use REST Endpoints
REST endpoints are configured programmatically. You can define REST endpoints in ScriptRunner to:
Use in dashboard gadgets.
Receive information from external systems.
Plug gaps in the official REST API.
Allow all your XHRs to proxy through to other systems.
For example, you want to show a custom popup dialog to your users if they click a button in your Confluence instance. To do this, you could create a rest endpoint that returns HTML to build the custom dialog and then use that with a custom web item to display the dialog to your users when they click a custom button within your Confluence instance.
Alternatively, you may want to create a REST endpoint to receive information from an external system. For example, you have an external system you use to log all new cars in your showroom. You want to be able to call the endpoint and have ScriptRunner add a new custom field option for each new car added to the external system.
The REST Endpoint page in ScriptRunner shows a list of all available endpoints, here you can edit, disable, and delete previously configured endpoints and create new ones.
Before you Start
See our Introduction to Atlassian Java API module to learn about using the Java API documentation.
Creating your own REST endpoint can be tricky. Before starting make sure you understand what the REST API is and how to use it.
Adding a REST Endpoint
Follow these steps to create a custom REST endpoint:
Select the Cog icon, and then select General Configuration.
Scroll to the ScriptRunner section in the left-hand navigation, and then select REST Endpoints.
Select Add a New Item, and then select the Custom Endpoint
Use the following REST endpoint example to examine the different parts of the script:
Line 8: This line makes methods in your script recognizable as endpoints, which is required.
Line 10: The name of the REST endpoint, which forms part of the URL. In this example, it is doSomething.
Line 11: This line configures the endpoint and determines which HTTP verb to handle and what groups to allow.
Line 12: This line contains parameters that are provided to your method body.
Line 13: The body of your method, where you will return a javax.ws.rs.core.Response object.
You can add this REST endpoint to the list of configured endpoints as an inline script or by copying into a file and adding that file as a script file. To test this endpoint, type this text into your browser:
<confluence_base_url>/rest/scriptrunner/latest/custom/doSomething
Notice the last part of the text is the name doSomething.
Alternatively, you could type this into the command line utility:
curl -u admin:admin <confluence_base_url>/rest/scriptrunner/latest/custom/doSomething {"abc":42}
- Again, notice the name
doSomethingin each command. admin:admincorresponds to a username and password.
If you are using a file, you can change the response. You may need to select the Scan button on the REST Endpoints page before calls to the endpoint return the new response. See the section on Script Root Scanning below.
Configuration
The general format of a method defining a REST endpoint is:
groovymethodName (Map configuration, Closure closure)
For the configuration, only the following options are supported:
| Key | Value |
|---|---|
httpMethod | Choose one of: |
groups | One or more groups. If the requesting user is in any of the groups, the request is allowed. |
Either or both of these can be omitted. If you omit the groups attribute, the endpoint will be available to unauthenticated users.
Use these parameters for the closure:
| Parameter | Type | Description |
|---|---|---|
queryParams | This corresponds to the URL parameters. | |
| Content | This is the body of the request for |
Request | This returns the requesting user for the instance. |
You can use any of these forms for your closure:
something() { MultivaluedMap queryParams -> something() { MultivaluedMap queryParams, String body -> something() { MultivaluedMap queryParams, String body, HttpServletRequest request -> something() { MultivaluedMap queryParams, HttpServletRequest request->
The contents of your closure depends on what you need access to.
Where the closure signature contains the body variable, the request input stream is read before your closure is executed, and the read data is passed to the closure in the body.
The request input stream can only be read once. If you want to avoid the request input stream from being read before your code executes, for instance if you are reading file uploads, use the final form of the closure:
groovysomething() { MultivaluedMap queryParams, HttpServletRequest request->
Access Request URL
Sometimes you may need to use the URL path after your method name. In the following example, you want to retrieve /foo/bar:
groovy<base_url>/rest/scriptrunner/latest/custom/doSomething/foo/bar
Use the 3-parameter form of the closure definition and call the getAdditionalPath method from the base class.
For example:
groovydoSomething() { MultivaluedMap queryParams, String body, HttpServletRequest request -> def extraPath = getAdditionalPath(request) // extraPath will contain /foo/bar when called as above }
In previous versions, an extraPath variable was used in the scripts. However, this is not thread-safe. Use the method above.
Script Root Scanning
As well as manually adding scripts or files via the UI, ScriptRunner scans your script roots for scripts that contain REST endpoints and automatically register them. To enable the scanning, set the property plugin.rest.scripts.package to a comma-delimited list of packages. For example:
groovy-Dplugin.rest.scripts.package=com.acme.rest
On plugin enablement, scripts/classes under this package are scanned and registered if the scripts contain the following line:
groovy@BaseScript CustomEndpointDelegate delegate
Package Declarations and File Paths
Your REST Endpoint's code must begin with a package declaration that matches the package configured in the system property. Likewise, the file path in your script root must match that package declaration as well.
For example, if your plugin.rest.scripts.package system property is com.acme.rest and you want to create a custom REST Endpoint with a file named MyCustomRestEndpoint.groovy, then:
- The first line of the MyCustomRestEndpoint.groovy file should be
package com.acme.rest. - The file should have a line like
@BaseScript CustomEndpointDelegate delegateas normal. - The path to the file within your script root should be com/acme/rest/MyCustomRestEndpoint.groovy .
Subpackages should be okay, so long as the sub-directory matches the package. For example, you might put the file in com/acme/rest/widgets so long as your package declaration is com.acme.rest.widgets in the top line of the file.
If you are receiving unexpected HTTP 500 errors when trying to access your REST Endpoints that were added through Script Root Scanning, check your package declaration. Case sensitivity may be an issue as well, depending on your filesystem.
Examples
Create User
This example demonstrates plugging a gap in the official REST API.
Most of this code validates the JSON and query parameters that are passed to it. This validation ensures that all required fields for a user are present. The appropriate method on the 'response’ class sends the right status code. The status code is 500 (server error) if the user already exists. The status code is 200 (created) if the user is created.
To test, you could use the following code:
curl -v -X POST -H "Content-type: text/json" -u admin:admin --data "@user.json" \ <confluence_base_url>/rest/scriptrunner/latest/custom/user
user.json is a text file that contains:
You can have multiple methods with the same name in the same file, which is useful to do simple CRUD REST APIs.
An example:
POST /user - creates a user PUT /user - updates a user DELETE /user - deletes a user GET /user - gets a use
Get A User
This example demonstrates how to retrieve the user that was created in the previous example.
Note that when the previous user was created, you got the following header in the response:
Location: <confluence_base_url>/rest/scriptrunner/latest/custom/user/newuser
Then use the GET user endpoint in the same script to use that location to retrieve the user from.
To retrieve the user, use the following command:
curl -X GET -u admin:admin <confluence_base_url>/rest/scriptrunner/latest/custom/user/newuser
Make sure to use the appropriate method on the Response class to send the right status code. The status code 500 (server error) if the user does not exist. The status code is 200 (ok) to retrieve the user.
Create Project Pages
This custom REST Endpoint allows you to create complex page structures automatically within Confluence. There are several different ways in which you can use this, including:
Using a custom button (Script Fragment > Custom Web Item) to allow users to trigger the action.
Calling the endpoint from another Atlassian application or 3rd party system, which allows you to create page structures within Confluence.
The following example is of a custom script fragment. This example is a starting point to help you implement your own custom solution. It is not a copy-paste solution.
When you implement your own version of this endpoint, evaluate security concerns, including:
Which groups should have access to the REST endpoint, and restrict as required.
Whether the user has the correct Confluence permissions for the work done by the REST endpoint. In its current state, the endpoint checks to ensure the calling user is in the confluence-administrators or confluence-users group. Additionally, it checks to ensure the calling user has view permissions on the parent page.
The custom fragment defines where the button is located and who has visibility of it.
The Condition in the custom script fragment above states that the button appears when the space key equals PS, and the Link value is <base_url>/rest/scriptrunner/latest/custom/createProjectPages?spaceKey=PS&parentPageId=851970. In this example, the space key is PS and the parent page has an id of 851970. You should change the spaceKey and parentPageId values to suite your needs.
Add or remove query parameters as required for your use case.
Limitations
Currently with this implementation, the space key is passed via a query parameter. A custom fragment for each space is needed if you want the project structure created in the same space as the button.
Alternatively, you could have the fragment button in a single space. When the fragment button is clicked, a new space with the defined page structure is created.