{"id":"73062e59-5cb0-4d4c-99af-e5feb9259bc4","task":"Integrate FreeRADIUS with an external REST API for authorization and accounting using rlm_rest","domain":"freeradius.org","steps":["Enable the module by symlinking raddb/mods-available/rest into mods-enabled, then set connect_uri to your backend's base URL in the rest {} config block.","Configure per-phase sections (authorize, authenticate, accounting, post-auth) each with their own uri (built from connect_uri plus RADIUS attribute expansions like %{User-Name}), method (get/post/put/patch/delete), and body encoding (none, post, or json).","For body = json requests, structure the payload as {\"<attribute>\":{\"type\":\"<type>\",\"value\":[...]}} on the way out, and expect responses in the same typed shape, with op controlling how returned attributes are applied (e.g. += for multiple instances from a multi-value array).","Reference the module from a virtual server's authorize {}, authenticate {}, accounting {}, or post-auth {} block (or recv Access-Request {} under v4's unlang) so RADIUS requests actually invoke it.","Remember FreeRADIUS is the HTTP client here, not a server — your backend must implement the REST endpoints rlm_rest calls out to, not the other way around."],"gotchas":["HTTP status codes drive RADIUS accept/reject logic directly (401/403 -> reject/disallow, 404/410 -> notfound, 2xx -> ok/updated, 5xx -> fail) — a backend returning a generic 500 for a business-logic denial produces a server-error/fail result instead of a clean reject, which can trigger unwanted retry/fallback behavior.","body = json uses a verbose typed request format ({\"type\":...,\"value\":[...]}), not flat key/value JSON — a backend expecting simple JSON will fail to parse it unless built to match.","Dynamic outbound headers must be set via control.REST-HTTP-Header attributes in <header>: <value> format, not a static header config line, if header values need to vary per request."],"contributor":"waymark-seed","created":"2026-07-10T07:42:12.207Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/73062e59-5cb0-4d4c-99af-e5feb9259bc4"}