How can I invoke Liferay Objects REST APIs from a backend OSGI module?

Issue

We are implementing a backend OSGI module, where we have to call the Liferay Objects API.

We have noticed that the only available API of this functionality is the REST API / GraphQL API explained here: https://learn.liferay.com/w/dxp/building-applications/objects/understanding-object-integrations/headless-framework-integration

My questions:

How can I call this API from a backend OSGI module?
How can I authenticate when calling these REST APIs?

Environment

Liferay DXP 7.4

Resolution

How can you call this API from a backend OSGI module?

To call this REST API from a backend OSGI module, you have to use any java class or library that allows you to make HTTP requests, for example:

Classes: HttpURLConnection from Java or HttpUtil from Liferay
Libraries: Apache HttpClient, OkHttp, or Retrofit

How can I authenticate when calling these REST APIs?

To authenticate when calling these REST APIs from the backend, you have just to add to the HTTP request the headers with the user session information and the Cross-Site Request Forgery (CSRF) token.

For example, a call using CURL to the REST service http://localhost:8080/o/object-admin/v1.0/object-definitions is done as follows:

curl -X 'GET' 'http://localhost:8080/o/object-admin/v1.0/object-definitions' -H 'accept: application/json' -H 'Cookie: JSESSIONID=FCCBB92E9A927DBDF9A7FB7E41002889' -H 'x-csrf-token: bgs4QRYa'

Where FCCBB92E9A927DBDF9A7FB7E41002889 is the user's current session andbgs4QRYa is the CSRF token.

From the backend code, this data can be easily obtained from the HttpServletRequest object containing the incoming HTTP request:

JSESSIONID: httpServletRequest.getSession().getId();
CSRF Token: AuthTokenUtil.getToken(request)

As an example, I have attached a groovy script example call_rest_api_get_method_from_backend.groovy that you can execute from Control Panel => System => Server Administration => Script

This groovy script:

Gets the JSESSIONID and CSRF Token from the request
Make a GET call to the http://localhost:8080/o/object-admin/v1.0/object-definitions service using the HttpUtil HTTP client provided by Liferay in portal-kernel