Auto-created REST channels
REST channels created automatically for deployed services - patterns, URL derivation and security posture.
The server can create REST channels automatically for deployed services, so exposing a service requires no channel work at all. The feature is driven entirely by environment variables - never by the service code:
| Variable | Default | Description |
|---|---|---|
Zato_Auto_REST_Channel_Enabled | true | Set to false to turn auto-creation off entirely |
Zato_Auto_REST_Channel_Prefix | /api/ | The URL prefix of auto-created channels |
Zato_Auto_REST_Channel_Include | Patterns of service names that receive a channel | |
Zato_Auto_REST_Channel_Exclude | Patterns of service names that never receive one | |
Zato_Auto_REST_Channel_Active | Patterns of service names whose channels start active |
Without any include patterns nothing is created, so a default environment has no auto-created channels. Defining at least one include pattern turns the feature on.
Pattern families
The pattern families are open-ended - any number of variables named Zato_Auto_REST_Channel_Include, Zato_Auto_REST_Channel_Include_01, Zato_Auto_REST_Channel_Include_ABC and so on, and the same scheme for Exclude and Active. Zato collects all matching variables, sorts them lexicographically by name, and each value holds one or more patterns separated by a comma or a semicolon.
Patterns are dotted service names with placeholders, where each {placeholder} matches exactly one dotted segment:
export Zato_Auto_REST_Channel_Enabled=true
export Zato_Auto_REST_Channel_Include="{department}.customer.{operation}"
export Zato_Auto_REST_Channel_Active="crm.customer.get"
How the URL is derived
A service matching an include pattern gets a channel at the prefix plus the service name with dots turned into slashes - crm.customer.get becomes /api/crm/customer/get with the default prefix. A service matching no include pattern gets no channel.
How the channels are secured
An auto-created channel begins its life with two properties:
- It is inactive unless it matches an
Activepattern - an inactive channel does not respond at its URL at all, so nothing is discoverable by scanning - It has no security definition - Zato does not guess what credentials a channel should require, so it attaches none
Together they mean the protection of a freshly created channel is that it is switched off, not that it authenticates anyone. The moment you activate a channel is the moment to assign a security definition or a security group, in the Dashboard or through enmasse - a channel activated without one accepts requests from anyone who can reach the port.
Active pattern, or activating a channel by hand, exposes the service to everyone who can reach the port until a definition or group is assigned.A hand-made channel named after the same service takes precedence - the auto-creation batch never overwrites it. Auto-created channels are normal REST channels: they appear in the Dashboard's channel list under Connections > Channels > REST, and security groups and rate limiting work on them unchanged.
Auto-created channels appear in the OpenAPI console like any other channel, so a service exposed this way is documented for its callers automatically.
See also
| Page | What it covers |
|---|---|
| REST channels | The channels that auto-creation produces, created by hand |
| Security groups | Assigning many credentials to a channel before it goes active |
| OpenAPI console | Where callers see the auto-created endpoints documented |