frappe-syntax-whitelisted

To secure Frappe whitelisted methods, apply frappe.has_permission or frappe.only_for checks inside every endpoint to enforce proper authorization, rather than relying solely on user authentication. This prevents unauthorized access to sensitive data.

The @frappe.whitelist decorator configures public endpoints by passing the allow_guest parameter. This explicitly exposes the method as a public HTTP API, bypassing standard authentication requirements for unauthenticated external REST calls.

You validate JSON request inputs in a Frappe API method through explicit parameter parsing and data coercion before processing. Safe error handling with frappe.throw ensures predictable response formats when clients submit invalid data.

You call Frappe whitelisted methods from a JavaScript client using the frappe.call or frm.call functions. These handle /api/method routing automatically and parse the structured response formats returned by your whitelisted Python functions.

Frappe whitelisted methods return unexpected response formats when inputs are not explicitly parsed and coerced, or when errors are unhandled. Using frappe.log_error patterns and returning structured dictionaries ensures predictable client-server integration.

Yes, you can expose document controller actions as Frappe REST API endpoints by applying the @frappe.whitelist decorator. You must enforce frappe.has_permission checks within the controller to maintain strict document-level authorization.