HTTPS Endpoints
Parent: MongoDB Atlas Triggers and Functions · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-f6ac572aba6f
↓ Facts as markdownall context files
Source-anchored research for HTTPS Endpoints. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Migration compatibility needs explicit verification: Modelence documents an API-key login and bearer-token flow, while a firsthand migration report describes authentication, result-code, and findOne response-format differences in a different advertised replacement. These examples do not establish universal compatibility or universal incompatibility. (medium confidence) [source]
- For GitHub webhook receivers, GitHub documents a 2XX acknowledgement within 10 seconds, suggests queuing work, and identifies X-GitHub-Delivery as a delivery identifier that remains the same on requested redelivery. Apply these sender-specific constraints when rebuilding a custom endpoint. (low confidence) (verified as of 2026-10-23) [source]
Problems, failure modes and limitations
- MongoDB lists HTTPS Endpoints as having reached end of life on September 30, 2025. Retained endpoint creation documentation is explicitly deprecated and should be read as historical configuration reference. (high confidence) (verified as of 2026-10-23) [source]
- A February 2022 report described an empty payload in a scripted authentication function and the error "TypeError: Value is not object coercible" when reading payload.query. In March 2022, a MongoDB responder acknowledged bugs and said tickets had been filed; the thread does not confirm a fix. (low confidence) [source]
Facts and statements
- Historically, an HTTPS Endpoint associated a route and HTTP method with a Function; the documented example configured POST /person and GET /people, enabled Respond with Result, and selected JSON output. (low confidence) [source]
- The historical endpoint handler received request query, headers, and body plus a response argument. The example parsed body.text() as JSON and returned a MongoDB operation result. (low confidence) [source]
- The 2022 tutorial explicitly omitted input validation and used System authentication for its sample endpoints. It described network access restrictions and stronger authentication as additional controls; the sample settings should be read as demonstration choices. (low confidence) [source]
- Modelence’s migration guide configures a MongoDB URI and API key, then demonstrates a login endpoint yielding a bearer token and a catalogue of CRUD endpoints. This is evidence of its documented Data API migration workflow, not proof that existing custom HTTPS Endpoint function code runs unchanged. (low confidence) (verified as of 2026-08-13) [source]
- Supabase’s published migration path moves MongoDB documents into PostgreSQL JSONB, normalizes them using SQL and changes client calls to PostgREST. Its description of a near drop-in Data API replacement therefore does not establish a transparent replacement for arbitrary Atlas custom endpoint handlers. (low confidence) [source]
- For a replacement endpoint receiving GitHub webhooks, GitHub recommends HTTPS with certificate verification and a webhook secret; it warns against putting credentials in payload URLs. These are GitHub receiver requirements, not evidence that Atlas’s historical query-secret mode is appropriate for every sender. (low confidence) [source]
- Historically, a custom endpoint configuration associated a route and http_method with a function_id. The documented method values are GET, POST, PUT, PATCH, DELETE and the wildcard *. (high confidence) [source]
- The historical endpoint schema offered validation_method values NO_VALIDATION, SECRET_AS_QUERY_PARAM and VERIFY_PAYLOAD. For the latter two modes, secret_id identified the Secret authorizing requests. (high confidence) [source]
- The historical custom endpoint schema supported JSON or EJSON as return_type and included a required respond_result boolean; migration inventories should retain these response settings. (high confidence) [source]
- The App Services Admin API configures and deploys applications; its administrative HTTPS routes are distinct from the application-specific HTTPS APIs clients called. An administrative create-endpoint example does not demonstrate that retired client endpoints remain usable. (medium confidence) [source]
Children
- Custom endpoint HTTP contract migration (frontier)
- Webhook request validation (frontier)
- JSON and EJSON response compatibility (frontier)
Frontier under this node: Custom endpoint HTTP contract migration, JSON and EJSON response compatibility, Webhook request validation