erpnext-impl-whitelisted

Secure ERPNext REST API endpoints are built using Frappe whitelisted methods with enforced permission guards, input validation, parameterized data access, and standardized error handling. This Skill provides decision trees and template workflows to structure these endpoints safely.

Structuring Frappe API permissions involves applying decision trees for API type and permission models to separate public guest endpoints, authenticated document APIs, and role-restricted admin APIs using distinct template workflows and permission guards.

ERPNext version 15 and above supports rate limiting for custom API endpoints. Implementing whitelisted methods includes applying rate limiting patterns alongside parameter validation and standardized response formats to ensure API stability.

Validating inputs and handling errors in Frappe integration webhooks requires applying standardized error handling patterns and parameter validation within whitelisted methods to ensure consistent response formats and reduce data processing failures.

ERPNext whitelisted API endpoints fail permission checks when permission guards are improperly implemented or parameterized data access is missing. Using structured implementation patterns with explicit role checks and validation resolves these security failures.