Access to REST Endpoint without token?


i want read thing data from:

  1. within a javascript rule (filebased)
  2. within a script as part from a webview ui element (timeline picker)

At the moment, i must create a token and past this token in the javascript rule file and past the same token in the script for the webview. This is for single use okay.

My intention is to share the rules and other user can copy and past the files without the nesseary to modify the content.

Exist a way to simplify this procedere and make it more usable, can i grant access to a single api endpoint without a token?

You can access the Things from inside your JavaScript without a token by using the programming API instead of the REST API. See openhab-js/things.js at main · openhab/openhab-js · GitHub which is part of the helper library for how to get at the ThingRegistry (I’m assuming you are working with JS Scripting EMCAScript 11).

That will eliminate at least one of the places to put the token.

Consider posting it to the Marketplace as a Template. Then they don’t even need to copy and paste. They can just install, instantiate and configure. That also means that if you don’t switch to the programming API, you can make the API key be one of the configuration properties of the rule template.

No, it’s all or nothing.

Thank’s for your answer @rlkoshak.
I will use the programming API so it’s not nessesary to modify the ‘inner’ rule. This is perfect. For the webview UI- script i will use a url-parameter. This is not so comfortable but much more better as than the user must modify the script as self.

I’m the developer of the timeline picker and so i don’t have to publish the single script. For this widget it’s nessesary to publish a bunch of files, including html, css and js files.
Are these files also published as template or can the user only install the js rule for automation with the marketplace and has to install the html, css,… install separately?

Unfortunately, for now each post can only have a single rule template, widget, Blockly Library, or add-on depending on which category it’s published to. I’ve talked with Yannick about what it would take to bundle multiple rule templates and widgets together but it’s not a high priority yet.

Okay. I think that in this case it’s better to keep in the current workflow. All files are available for downloading on gitlab and the willing user must copy the complete bunch.

I’m not sure but in the programming api i can pull the status of things and the existing things. I can’t pull the embedet channels of a thing, as is possible with REST API.
Is this right or have I overlooked something?

It should be possible since there’s nothing the REST API can do that one l isn’t supported in the internal APIs, but that stuff might be held in a different registry.

You can see the class javadoc at

Your link contains a “s” with doesn’t belong there, the correcg link is

1 Like

I’m on my phone and don’t have my glasses. I should have copied and pasted. Thanks for the correction!

1 Like

@opus and @rlkoshak many thank you for your quick reply!