frappe-impl-whitelisted

Implement secure Frappe @frappe.whitelist() API endpoints with permission checks and validation.

163|53|Updated Jan 14, 2026

Search Tags:#rate limiting #permissions #file upload #api security #frappe #whitelisted methods #curl testing

Ready to run

npx skills add https://github.com/Impertio-Studio/Frappe_Claude_Skill_Package --skill frappe-impl-whitelisted-impertio-studio

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: frappe-impl-whitelisted
Source: https://github.com/Impertio-Studio/Frappe_Claude_Skill_Package/tree/main/skills/source/impl/frappe-impl-whitelisted
Command: npx skills add https://github.com/Impertio-Studio/Frappe_Claude_Skill_Package --skill frappe-impl-whitelisted-impertio-studio

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents production failures and security vulnerabilities when implementing @frappe.whitelist() API endpoints in Frappe by enforcing correct permissions, validation, error handling, and client integration patterns.

Core Features & Use Cases

Endpoint design workflow: Decide where the endpoint lives (controller vs API module), what HTTP methods it should allow, and what permission model to apply.
Security-first implementation: Apply safe patterns that avoid permission bypasses, SQL injection, guest data exposure, and leaking internal errors.
Production-ready integrations: Cover frontend invocation (frappe.call / frm.call), curl-based REST testing, file upload handling, and background job triggering with frappe.enqueue.
Version-aware behavior: Includes guidance for Frappe v14/v15/v16 differences, including type validation (v15+) and rate limiting (v15+ with fallbacks for v14).

Quick Start

Use the frappe-impl-whitelisted skill to implement a secure guest or authenticated REST endpoint for your custom DocType and verify it with curl.

Frequently Asked Questions about frappe-impl-whitelisted

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure Frappe whitelisted API endpoints for custom DocTypes?▼

Secure Frappe whitelisted APIs by selecting the correct permission model, enforcing input validation, applying parameterized data access, and implementing consistent error handling to prevent production security vulnerabilities like SQL injection and permission bypasses.

What's the best way to test Frappe whitelist() methods using curl?▼

Test Frappe whitelist() methods using curl by structuring REST requests that verify authenticated and allow_guest endpoints, ensuring you validate HTTP method restrictions, CSRF awareness for browser calls, and proper file upload handling.

Does Frappe v15 support rate limiting for allow_guest API endpoints?▼

Frappe v15 supports rate limiting for allow_guest endpoints, including type validation, with fallback patterns available for v14 implementations to prevent unauthorized data exposure and maintain API security.

How do I prevent permission bypasses in Frappe background job triggers?▼

Prevent permission bypasses in Frappe background job triggers by applying safe endpoint design workflows, validating parameters, and ensuring correct permission checks are applied before executing frappe.enqueue operations.

When should I use a controller versus an API module for Frappe webhook endpoints?▼

Choose between controllers and API modules for Frappe webhook endpoints based on your integration needs, determining the correct code location, HTTP methods, and permission models to ensure secure and maintainable API design.

Why does my Frappe file upload handler expose internal errors to guests?▼

Frappe file upload handlers expose internal errors to guests when consistent error handling and input sanitization are missing, requiring strict validation and permission checks to secure allow_guest endpoints against data leakage.