A "connector" that other developers can drop into a service flow is a toolkit with (a) a generic REST service, (b) a business object for the request / response, and (c) thin wrapper services per operation. The generic part is one script that uses BPMRESTRequest for BPM's own API or a Java HTTP client for anything else - both are OOB:
// toolkit service flow "REST Call" - inputs: method, url, headers (NameValuePair list), body (String); outputs: status (Integer), response (String)
var con = new java.net.URL(tw.local.url).openConnection();
con.setRequestMethod(tw.local.method); con.setConnectTimeout(15000); con.setReadTimeout(60000);
con.setRequestProperty("Accept", "application/json");
for (var i = 0; i < tw.local.headers.listLength; i++) con.setRequestProperty(tw.local.headers[i].name, tw.local.headers[i].value);
if (tw.local.body != null && tw.local.body != "") {
con.setDoOutput(true); con.setRequestProperty("Content-Type", "application/json");
var os = con.getOutputStream(); os.write(new java.lang.String(tw.local.body).getBytes("UTF-8")); os.close();
}
tw.local.status = con.getResponseCode();
var stream = tw.local.status >= 400 ? con.getErrorStream() : con.getInputStream();
var text = "", rd = stream == null ? null : new java.io.BufferedReader(new java.io.InputStreamReader(stream, "UTF-8")), line;
while (rd != null && (line = rd.readLine()) != null) text += line + "\n";
tw.local.response = text;Wrap it per operation so callers work with typed data: "Get Customer" = build the URL from tw.env.crmBaseUrl + id, call "REST Call", JSON.parse the response into a Customer business object, throw a typed error on status >= 400. Keep authentication in a Server definition or environment variables (basic header built in the wrapper, OAuth token fetched by a "Get Token" service with caching), and put the OOB behaviour back where it matters: service caching on read wrappers, error handling with the Error end event, timeouts as environment variables.
Why still use the OOB REST external service (Swagger import) when you can: it generates the business objects, handles the Server definition / authentication / TLS, and is supported on CP4BA and Workflow Process Service where script access to java.net may be disabled. The custom connector is for APIs without a usable Swagger, dynamic URLs, or non-JSON payloads.
References