Question

how can we invoke REST API calls inside a BPM Service?

Answer 1

From a service (server side) you have three ways to call a REST API, in order of preference:

1. REST external service (BPM 8.5.7+ / BAW): import the Swagger / OpenAPI, get typed business objects and a Server definition per environment - no code (question 1057).
2. BPMRESTRequest + tw.system.invokeREST for BPM's own REST API (tasks, instances, users) - question 3127.
3. Java's HTTP client from a script for any other API without a Swagger:

// service flow script: POST JSON, read JSON (works on every 8.5.x / BAW release; needs the endpoint's signer in the truststore for https)
var url = tw.env.crmBaseUrl + "/customers";
var con = new java.net.URL(url).openConnection();
con.setRequestMethod("POST"); con.setConnectTimeout(10000); con.setReadTimeout(30000); con.setDoOutput(true);
con.setRequestProperty("Content-Type", "application/json"); con.setRequestProperty("Accept", "application/json");
con.setRequestProperty("Authorization", "Bearer " + tw.local.token);            // or Basic (question 67)
var payload = JSON.stringify({ name: tw.local.customer.name, email: tw.local.customer.email });
var os = con.getOutputStream(); os.write(new java.lang.String(payload).getBytes("UTF-8")); os.close();
var status = con.getResponseCode();
var stream = status >= 400 ? con.getErrorStream() : con.getInputStream(), text = "", line;
var rd = stream == null ? null : new java.io.BufferedReader(new java.io.InputStreamReader(stream, "UTF-8"));
while (rd != null && (line = rd.readLine()) != null) text += line;
if (rd != null) rd.close();
if (status >= 300) throw new Error("CRM " + status + ": " + text.substring(0, 300));
var json = JSON.parse(text);
tw.local.customer.id = json.id;

Rules: base URLs, credentials and timeouts from environment variables / Server definitions; always set timeouts (a hanging call blocks a thread); throw on HTTP errors so that the BPD's error handling sees them; wrap the code in a toolkit service ("REST Call" with method, url, headers, body in - status, body out, question 2888) so that apps do not repeat it; on hardened servers where scripts may not use Java, use a Java integration with the same code. Client side (coach) calls are a different topic (question 756).

References

• BAW documentation - REST external services
• JavaScript API - BPMRESTRequest, server-side Java access