/c/your-slug · isolated V8 · the same wallet

Custom endpoints

The catalogue is 706 operations. The 662nd is yours: upload a script, get a URL, call it with the same key, pay for it from the same wallet.

How it works

Write `main(req)`

An async function. req carries the method, the query, the headers and the parsed body of the call that reached your slug. Return anything JSON-serialisable.

Upload it

POST /custom/endpoints with a slug and the script. Slugs are globally unique; a taken one answers 409. The script is stored, not executed, at upload.

Call it

GET, POST, PUT or DELETE /c/your-slug with x-api-key. Each call runs in a fresh isolate scoped to the key's owner — a slug that is not yours answers 404, identically to one that does not exist.

POST/custom/endpoints

{
  "slug": "order-check",
  "script": "async function main(req) {
    const { iban, vat } = req.body;
    const [i, v] = await Promise.all([
      $safeFetch('https://app.castomapi.com/v1/verify/iban', { method: 'POST', body: JSON.stringify({ iban }) }),
      $safeFetch('https://app.castomapi.com/v1/verify/vat',  { method: 'POST', body: JSON.stringify({ vat }) })
    ]);
    return { ibanValid: (await i.json()).valid, vatValid: (await v.json()).valid };
  }"
}

{ "status": "success", "url": "https://app.castomapi.com/c/order-check" }

What the sandbox allows, and refuses

CPU	2 seconds per request. Longer answers 408 and is not billed.
Memory	128 MB per isolate.
Network	None — except `$safeFetch`, a bridged fetch that forwards method, headers and body, refuses every private, loopback and link-local range in v4 and v6, resolves the hostname before connecting, and re-validates every redirect hop.
State	None between calls. Persist through DB or your own API.
Tenancy	Execution is scoped to the calling key's owner. Another tenant's slug is a 404 with zero cost.
Billing	Metered like every other call: debited after the response, only on success. Calls your script makes to the catalogue through `$safeFetch` are billed to the key you pass them.

Why it exists

A workflow tool needs a step that does three things at once. A dashboard needs a number nobody exposes. A partner needs an endpoint shaped for their client. All three used to mean a server, a deploy and a bill. Now they mean a function.

The seven Custom operations → · As a platform service → · Security →