Returns a single mapping function by its id.
OAuth2 client-credentials flow for machine-to-machine access.
Exchange a client id/secret at /dw/register/oauth/token for a bearer token, then send it
as Authorization: Bearer <access_token>. Client credentials are provisioned in the
Lobster administration UI.
This is the client-credentials token endpoint of the Platform API. /oauth/token, the
token_endpoint advertised at /.well-known/oauth-authorization-server, serves the authorization
code flow of the OAuth2AuthorizationCode scheme.
OAuth 2.1 authorization code flow with PKCE, for acting as a signed-in user. It works with Microsoft and other single sign-on providers: the provider only confirms the user's identity to the platform, which then issues its own token.
POST /oauth/register(no authentication) with the JSON body{"redirect_uris": ["<redirect URI>"]}returns aclient_id. The user's browser has to reach the redirect URI.- Open
/oauth/authorizein the user's browser withresponse_type=code,client_id,redirect_uri,stateand acode_challengewithcode_challenge_method=S256.stateis a fresh unguessable value per request, andcode_challengeis the S256 hash of acode_verifierfreshly generated per request from a cryptographically secure random source (43 to 128 characters, RFC 7636). The user signs in on the platform's login page, and the browser is redirected to the redirect URI withcodeandstate; a callback whosestatediffers from the one sent is to be rejected. - The code is valid for 30 seconds. Exchange it at
POST /oauth/token, form-encoded, withgrant_type=authorization_code,code,redirect_uri,code_verifierandclient_id. - The answer carries
access_token(valid 30 minutes),refresh_token(valid 48 hours) andexpires_inin milliseconds. Refresh withgrant_type=refresh_token,refresh_tokenandclient_id.
Bearer token obtained from an authenticated browser or guest-user session.
Flow 1 — UI login: Log in via the Lobster web UI at /, then call
GET /auth/sessionBearerToken to exchange the session cookie for a bearer token.
Flow 2 — Guest user login token: Append a GuestUser loginToken as a URL
query parameter to the base URL to establish a password-free session:
GET <host>?loginToken=<GuestUser token>
Then call GET /auth/sessionBearerToken to obtain the bearer token.
Function id.
Function returned.
Standard Platform API success envelope. Every response carries exactly one of data (success) or error (failure) at top level.
A mapping function of this instance, called by id from a core.FunctionConfiguration in the functions chain of a target field or node. Read-only; includes the instance's custom functions.
The type of this object, always core.MappingFunction. Required where the member it is sent in accepts several types.
Whether the function is deprecated: it still runs, but a new profile should not use it.
What the function does and returns.
The group the function belongs to; the group query parameter filters on it.
The function id a core.FunctionConfiguration refers to. Ids from 5000 up are the instance's custom functions and differ between instances.
The name, with the parameters as letters; a parameter in brackets ([b]) may be empty but must still be sent.
The parameters in order (a, b, ...), the order of the functionParameters of a core.FunctionConfiguration, which carries one entry for each, an unused one as an empty VALUE.
One parameter of a mapping function. Its position in the function's parameters is its position in the functionParameters of a core.FunctionConfiguration.
The type of this object, always core.MappingFunctionParameter. Required where the member it is sent in accepts several types.
What the parameter means. Absent where the function does not describe it.
What kind of value the parameter refers to; absent for a plain value. E.g. CHANNEL_SELECTION takes a channel id, PARTNER_SELECTION a partner id, PROFILE_SELECTION a profile name, CERTIFICATE_SELECTION a certificate id, DB_ALIAS_SELECTOR a database alias, REGEX_EDITOR a regular expression, DATETEMPLATE_HELPER a Java date pattern, CHARSET_SELECTION an encoding name.
Whether the parameter needs a value. A parameter that is not mandatory may be empty, but must still be sent as an entry of functionParameters.
The parameter's letter, as the function's name refers to it: a for the first, b for the second, and so on.
The fixed values this parameter accepts, e.g. ["hex", "base64", "raw"], passed as a VALUE. Absent when the parameter has no fixed set.
Whether the parameter carries a credential. A VALUE in such a position is returned encrypted; send it as PLAIN:<text>, or send the encrypted value back unchanged.
The type the function expects. Absent when it accepts any type. A VALUE parameter carries numbers and booleans as text.
The type of the value the function returns. Absent when it returns any type, or none.
The request could not be understood. BAD_REQUEST for a body that does not decode — its message names the property at fault — and VALIDATION_FAILED with one details entry per offending parameter for a malformed request target (an unknown query parameter or sort key). Also BAD_REQUEST for a response unit naming a channel this client cannot reference.
{
"error": {
"code": "BAD_REQUEST",
"message": "The request is invalid."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
Authentication is required or the supplied credentials are invalid.
{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication is required to access this resource."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The caller lacks the permission for this operation on this resource (FORBIDDEN).
{
"error": {
"code": "FORBIDDEN",
"message": "Access to this resource is denied."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The requested resource does not exist. The code is resource-specific, e.g. PARTNER_NOT_FOUND, PROFILE_NOT_FOUND or CHANNEL_NOT_FOUND.
{
"error": {
"code": "PARTNER_NOT_FOUND",
"message": "Partner not found: 42"
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
An unexpected server error occurred.
{
"error": {
"code": "INTERNAL_ERROR",
"message": "An unexpected error occurred."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.