# Connect REST API

**URL:** <https://forum.inductiveautomation.com/t/connect-rest-api/108992>\
**Category:** Ignition\
**Created:** [July 28, 2025, 9:32am UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992 "2025-07-28T09:32:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![dpena1](https://avatars.discourse-cdn.com/v4/letter/d/9dc877/32.png) [@dpena1](https://forum.inductiveautomation.com/u/dpena1)\
**Post date:** [July 28, 2025, 9:32am UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/1 "2025-07-28T09:32:51Z")

</div>

Hi,

I have found is possible to bypass SSL certificate validation in scripting using this syntax of httpPost : [system.net.httpPost | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.1/appendix/scripting-functions/system-net/system-net-httpPost) but I am not able to use it, has anybody any sample of it?

The issue is that I have a REST API with self-signed certificate and I am not able to connect it and getting this error message:Error retrieving token: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Thanks

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [July 28, 2025, 10:39am UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/2 "2025-07-28T10:39:51Z")

</div>

> [@dpena1](#):
>
> but I am not able to use it

Show us what you tried.

---

<div class="post-metadata">

**Author:** ![dpena1](https://avatars.discourse-cdn.com/v4/letter/d/9dc877/32.png) [@dpena1](https://forum.inductiveautomation.com/u/dpena1)\
**Post date:** [July 28, 2025, 10:57am UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/3 "2025-07-28T10:57:51Z")

</div>

I tried the standard call this way:

```python
# URL
url = "https://localhost/identitymanager/connect/token"

# Form data as a URL-encoded string
postParams = {"grant_type":"client_credentials","client_id":"Ignition","client_secret":"DefaultPassword"}

# Send the POST request
try:
    response = system.net.httpPost(url,postParams)
    event.source.parent.getComponent('Text Area').text = "Token response:\n" + response

    # Optionally decode JSON
    #tokenData = system.util.jsonDecode(response)
    #accessToken = tokenData["access_token"]
    #system.perspective.print("Access token:\n" + accessToken)

except Exception as e:
    event.source.parent.getComponent('Text Area').text = "Error retrieving token: " + str(e)

```

And getting the PKIX error, then I found the other call and tried this way:

```python
url = "https://localhost/identitymanager/connect/token"
contentType = "application/x-www-form-urlencoded"
postParams = "grant_type=client_credentials,client_id=Ignition,client_secret=DefaultPassword"

try:
    response = system.net.httpPost(url, contentType, postParams, 50000, 50000, bypassCertValidation=True)
    json = system.util.jsonDecode(response)
    event.source.parent.getComponent('Text Area').text = "Access Token: " + json["access_token"]
except Exception as e:
    event.source.parent.getComponent('Text Area').text = "Error: " + str(e)

```

And I am getting a 400 error from the server so I assume I am not using it in the right way because Postman is able to connect (with SSL certification validation disabled)

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [July 28, 2025, 11:13am UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/4 "2025-07-28T11:13:13Z")

</div>

> [@dpena1](#):
>
> `except Exception as e:`

That will only catch jython errors, not java errors.

Add another except clause with `except Throwable, t:` with `from java.lang import Throwable` outside your library function.

Consider also using `system.net.httpClient`, as it has numerous foundational improvements over the other `system.net.http*` functions.

---

<div class="post-metadata">

**Author:** ![clifford.ayer](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/clifford.ayer/32/78030_2.png) [@clifford.ayer](https://forum.inductiveautomation.com/u/clifford.ayer)\
**Post date:** [July 28, 2025, 1:45pm UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/5 "2025-07-28T13:45:09Z")

</div>

@dpena1 -- in the past, I needed to include 'headers' as part of the token retrieval process; usually provided by the API provider.

@pturmel --I read somewhere on this forum, maybe in the user manual, that creating an httpClient() is very heavyweight. Is there a best practice when implementing these? In the past I have used these when running longer SFCs but have always wondered if that was the best use of them.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [July 28, 2025, 2:29pm UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/6 "2025-07-28T14:29:08Z")

</div>

They **are** heavyweight if you create a new one for every request. Don't do that. Create a client in a project library script, **outside** any function, and you can use it and re-use.

(This kind of code should always be in the project library, not directly in events or transforms.)

---

<div class="post-metadata">

**Author:** ![clifford.ayer](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/clifford.ayer/32/78030_2.png) [@clifford.ayer](https://forum.inductiveautomation.com/u/clifford.ayer)\
**Post date:** [July 28, 2025, 2:34pm UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/7 "2025-07-28T14:34:19Z")

</div>

I feel better. I called once per SFC call and reused throughout until the block chain completed. Now, sometimes there were several different SFC running simultaneously, each with their own httpClient but, based on what you're saying that should be okay.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [July 28, 2025, 2:35pm UTC](https://forum.inductiveautomation.com/t/connect-rest-api/108992/8 "2025-07-28T14:35:21Z")

</div>

> [@clifford.ayer](#):
>
> should be okay.

Likely, but still heavier than necessary. They could all share just one `httpClient` instance.