---
nav: wcp_docs
parent_url: /wcp_docs/
title: Call External REST APIs in Extend Apps
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
-   Access to the external OAuth provider, which performs user authentication when an Extend app calls the external REST API. You must have an account on the external OAuth provider website where you will register an API client for your Extend app.
-   Your account firewall policy must include the allowed IP addresses for your account’s region. See the Allowlist IP Addresses for Third-Party API connectivity per region: [Reference: Workday Extend Basic Setup](/wcp_docs/oas1626117162588.html).
-   Understanding of the external REST API’s functional and data requirements that determine the request sent from and response received by an Extend app.


### Context

<a id="context_N1003D_N1001E_N10001"></a>
From an Extend page, you can call third-party REST APIs to enable app users to interact with external data.

If your app must restrict users only to external data they have access to, you must call the external REST service’s OAuth provider to perform the necessary user authentication. To enable external OAuth authentication in your app, configure the appropriate OAuth authentication scheme on your page. Extend pages support these OAuth authentication types:

-   [OAuth2 Authorization Code](/wcp_docs/jzx1537909761291.html) - Requires either the [oauthButton](/wcp_docs/ahr1529942847324.html) or [oAuthLoginButton](/wcp_docs/qxm1530914141081.html) widget to enable users to sign in the external OAuth provider for authentication.
-   [OAuth2 Client Credentials](/wcp_docs/axp1537909839739.html) - Only requires the page endpoint to specify the configured authentication scheme in the SMD.


A page can also launch an orchestration that calls external REST APIs. Example: A page can launch an orchestration that transforms data from a third-party system. To authenticate an external REST API from an orchestration, see [Create Orchestration Credentials](/wcp_docs/uwh1613475703138.html).

### Steps

1.  <a id="step_N10060_N1005D_N1001E_N10001"></a>Register an API client on the third-party OAuth provider website.

    Select the scopes that define which external resources Extend app users can access.

    When you register your APi client on the third-party OAuth website, save the generated Client ID and secret.

    Enter the redirect URL for OAuth, which is one of the tenant URLs listed in [Reference: Tenant Redirect URLs for External OAuth Providers](/wcp_docs/cpx1566499453357.html).

    <b>Note:</b> To test the connectivity with the external OAuth provider, you can first use a redirect URL for a testing tool such as Postman. Example: `https://oauth.postmn.io/v1/callback`. After you’ve established a successful connection to the third-party OAuth provider, you can update the redirect URL to one of the Workday tenant redirect URLs.

2.  <a id="step_N10069_N1005D_N1001E_N10001"></a>Access the [Create External Client CredStore](/wcp_docs/gqs1527493104452.html) task in Workday to store the generated Client ID and secret from the external OAuth provider.

    If you’ve already created an external client credstore for your app, access the <b>Edit External Client CredStore</b> task to update as needed.

3.  In App Builder, configure these Extend app components for authentication:
    1.  App Metadata (AMD): In the `dataProvider` array, add an item for the third-party REST API, specifying its base URL as the value.

        Example:

        ```
        "dataProviders": [
            {
              "key": "acme_api",
              "value": "https://api.acme.come/v1"
            }
        ]
         
        ```

    2.  Site Metadata (SMD): In the `authTypes` array, add an item for the `OAUTH2` or `OAUTH_CLIENT_CREDENTIAL` authentication scheme.

        The `referenceId` must match the External Reference ID you specified in the External CredStore. This sample `authType` entry specifies acmeExternalAuth as the referenceId, which matches the external reference ID in the External CredStore.

        ```
        "siteAuth": {
            "authTypes": [
              {
                "scheme": "OAUTH2",
                "id": "acmeAuth",
                "source": "CREDSTORE",
                "referenceId": "acmeExternalAuth",
                "providerType": "STANDARD_POST",
                "useProxyServer": true
              }
            ]
          }
         
        ```

    3.  Page (PMD): On a page where you want to call the external OAuth provider using the OAuth Authorization Code grant, add either the `oauthButton` or `oAuthLoginButton` tag.

        The `oauthButton` and `oAuthLoginButton` tags display a button that calls the external OAuth provider for user authentication. The `oAuthLoginButton` only displays if the user hasn’t signed in yet.

        The `authId` attribute must match the OAuth authentication scheme ID you defined in the SMD. This sample `oauthButton` specifies acmeAuth as the `authId`, which matches the sample <i>acmeAuth</i> authType `id` in the SMD.

        ```
        {
          "label": "Authenticate with ACME Provider",
          "type": "oauthButton",
          "authId": "acmeAuth",
          "buttonType": "PRIMARY",
          "redirectTaskReference": {
            "type": "taskReference",
            "parameters": "<% var authResult = {'authResult':'REDIRECT'}; return authResult; %>",
            "taskId": "home"
          },
          "errorTaskReference": {
            "type": "taskReference",
            "parameters": "<% var authResult = {'authResult':'ERROR'}; return authResult; %>",
            "taskId": "connectionError"
          }
        }
         
        ```

        <b>Note:</b> The `oauthButton` and `oAuthLoginButton` tags only apply to OAuth Authorization Code (OAUTH2) authentication scheme.


4.  <a id="step_N1014E_N1005D_N1001E_N10001"></a>Define the page endpoint that calls the external REST API.

    For GET or POST REST APIs that read and load external data into a page, define them as inbound endpoints in the [endPoints](/wcp_docs/ujr1530565661647.html) array.

    Specify the data provider you defined in the AMD as the base URL of the endpoint. Also specify the `authType` you defined in the SMD.

    This sample inbound endpoint specifies acme_api as the `baseUrlType`, which matches the data provider in the AMD. The `authType` matches the sample <i>acmeAuth</i> authType `id` in the SMD.

    ```
    "endPoints": [
        {
          "baseUrlType": "acme_api",
          "bestEffort": true,
          "name": "acmeData",
          "authType": "acmeAuth",
          "url": "<% '/users/me/meetings' %>"
        }
      ]
     
    ```

5.  Bind the outbound request or expected response fields with the tags on the page.

    Specify the name of the endpoint you defined in the page. This sample text tag displays the object response field from the endpoint named <i>acmeData</i>.

    ```
    {
      "type": "text",
      "value": "Acme response object",
      "render": "<%empty acmeData.objectField %>"
    }
     
    ```



### Example

For a complete example, see [Developer Forum: How to use OAuth to call external web services](https://forum.developer.workday.com/t/the-extend-experience-s3-ep-7-how-to-use-oauth-to-call-external-web-services).