REST API Body Type Difference Between App Query and Resource

Good day everyone...this is my first time posting.

I have a REST Api Resource I have created for use in an app. The resource requires connection information as well as an action in the body of the POST (shown below). I'm able to place the secure information in the REST Api Resource and the action in the body in the app query. However, in the app query I have the option to make it json. In the Api Resource, I don't have that option. The call builds a json body correctly, but the connection information doesn't come through as json...it comes through as a string. I thought to try to use JSON.parse in the Api Resource body, but that doesn't seem to work. I don't want to add the connection info to the app query for security reasons.

Is there a way to force the API resource to use Json?

{
"request": {
"blobUrl": "azurebloburl...."
},
"secretsPackage": "{clientId: "xxxxxxc6c5", clientSecret: "xxxxxxxQGc1Q", tenentId: "xxxxxxxx2c7266e"}"
}

Hi @bbwfs,

We haven't found a great workaround here yet (other than passing this obj in every app query). We can submit a feature request, but we're wondering if you have any other authentication options (or if you have any documentation for the api you're using)?

The resource body values are accessible in the metadata of the query, but passing sensitive data in via the resource headers, for example, would give you an option to sanitize the values

Could you use custom auth for this api? Custom auth allows you to define secret variables & use some Javascript

Hi Tess, thank you very much for following up with this. I agree that authentication through the headers would be best, but the API isn't set up that way currently. It's an in house utility type api and not something we can do much about currently. I was able to get around it by creating an endpoint that takes the json string from the retool request and reformats it as raw json and forwards it to the actual api. I just referenced this "proxy" endpoint from Retool instead of the api directly and it's working.

I appreciate your help.

Will

1 Like

Ah got it! Thanks for letting us know; I'm glad you were able to move forward with your project

1 Like