This blog entry is a short tutorial of how to create a REST call within the flow designer as the Mid-Server as running instance. Note: This is how i did it. I did not find any available documentation for this, nor any content on the community. This may not be the way to go, but i (personally) did not find any other way.

Why do this?

Just to be clear: This is a very specific and very niece use case. Usually you are fie with using the "REST" step or even scripting with the RESTMessageV2() API. Therefore, the first question should be: Why?

Let's set the stage: You have a provisioning workflow, which triggers an automatic creation of user groups and roles within your user-management system. Or maybe you have another system, which manages some infrastructure components you need access to. Or your want to change a configuration there. Or...

Usually, when looking at the integrationhub, first thing to do is: Check for an existing spoke. There are many and we don't need to reinvent the wheel. But sometimes, there isn't. Next thing to check: How is the REST API configured. You got a header based authentication? Great, no need to read any further. You don't. Then this may be the exact case.

In the example where i used it, the REST API needed an authentication token for further interactions. And the place where you can get it returned the token if:

1) you gave the correct username and password combo2) you gave the correct secret

Now here is the issue: This had to be done within the body of the REST call. Why is this an issue? Whenever the body for a "REST step" is created it is automatically logged within the integration hub log. When using the RESTMessageV2() API the ECC queue contains the REST body as well. In both cases the password as well as the secret would be either logged or stored within the ECC queue unencrypted. And that my friends is what we call a security no-go.