frappe-core-api

Frappe REST API authentication requires token auth, OAuth2, or session/cookie auth. You must enforce JSON headers, apply permission checks, and validate inputs to prevent authorization failures and ensure safe external requests.

Frappe API calls return HTML responses when missing JSON headers or using incorrect endpoints. Enforce JSON response headers, use correct REST/RPC routes, and apply consistent response handling to avoid silent failures in production.

Calling @frappe.whitelist RPC endpoints uses client-side frappe.call or frappe.xcall patterns. You must apply strict authentication, method restrictions, and predictable response structures for safe server-side function execution.

Frappe webhook security verification uses HMAC signatures to validate payload integrity. You must apply secure webhook verification alongside token authentication to prevent unauthorized external requests from triggering server actions.

Frappe v14, v15, and v16 REST APIs support different v1 versus v2 routes for CRUD operations, document methods, copy, and metadata/count calls. Choosing the correct endpoint version prevents routing errors and request failures.

ERPNext API requests require enforcing pagination for large result sets and setting external request timeouts. Combining these operational safety rules with input validation prevents silent failures and security issues during data retrieval.