# Calling on-premises APIs via Relay

> Call an on-premises API from a Serverless Automation Cloud Robot coded process using the Relay Mapped URL and the injected access token.

Serverless Automation Cloud Robots run [coded processes](https://docs.uipath.com/studio/standalone/latest/user-guide/coded-automations-introduction) entirely within UiPath cloud infrastructure — no local agent or virtual machine (VM) required. From a coded process, you can call an on-premises API through Relay by sending the request to the endpoint's Mapped URL, authenticated with an access token that the robot runtime injects automatically.

:::note
Only HTTP-based connections are supported through Relay. Database Hub connections over Relay are not yet supported.
:::

## Prerequisites

- A Relay Group is configured and the on-premises endpoint you want to call is registered in it. See [Configuring a Relay group](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/configuring-relay-group).

## Available access tokens

| Variable | Available when | Notes |
| --- | --- | --- |
| `UIPATH_ACCESS_TOKEN` | All serverless executions | Primary token. Use for most scenarios. |
| `UNATTENDED_USER_ACCESS_TOKEN` | Unattended runs with a robot account | Scoped to the unattended robot user identity. Fallback if the primary token is absent. |

## Steps

1. In [UiPath Administration](https://cloud.uipath.com), select your Relay Group.
2. Copy the **Mapped URL** for the endpoint from the **Endpoint URL mapping** table.

   :::important
   Treat the Mapped URL as an opaque identifier. Do not construct it by hand or depend on its internal structure.
   :::

3. Read the access token from the execution environment. UiPath injects it automatically when the process starts — read it from `UIPATH_ACCESS_TOKEN` or `UNATTENDED_USER_ACCESS_TOKEN` for unattended runs. Do not hardcode credentials.
4. Set the `x-uipath-internal-authorization` header to the token as a Bearer value. This header is distinct from the standard `Authorization` header — Relay reads it to validate the consuming tenant. You can still pass an `Authorization` header to authenticate separately with the on-premises endpoint.
5. Construct the full request URL by appending your API path to the Mapped URL.
6. Send the request. Relay forwards the complete request to your on-premises endpoint unchanged.

## Result

Relay routes the request through the tunnel to your on-premises endpoint and returns its response to the coded process.

## Example: Python coded process

The following example reads the access token from the environment, constructs the request URL by appending a path to the Mapped URL, and sends a GET request. Replace `relay_url` with the Mapped URL from your Relay Group and `request_path` with your actual API path.

```python

RELAY_AUTH_HEADER_NAME = "x-uipath-internal-authorization"

def main():
    # Copy from the Endpoint URL mapping table in your Relay Group
    relay_url = "https://cloud.uipath.com/<accountName>/<tenantName>/relay_/connect/<UUID>"
    request_path = "/anything/testme"

    # Injected automatically — no manual credential setup needed
    access_token = os.getenv("UIPATH_ACCESS_TOKEN") or os.getenv("UNATTENDED_USER_ACCESS_TOKEN")

    if access_token:
        url = f"{relay_url}{request_path}"
        # Pass additional header required by on-prem endpoint
        headers = {
            RELAY_AUTH_HEADER_NAME: f"Bearer {access_token}",
            "Content-Type": "application/json",
        }
        try:
            response = requests.get(url, headers=headers)
            print(f"Response Code: {response.status_code}")
            print(f"Response Body:  {response.text}")
        except Exception as e:
            print(f"Error making HTTP request: {e}")
    else:
        print("Missing required environment variables: UIPATH_ACCESS_TOKEN | UNATTENDED_USER_ACCESS_TOKEN")

if __name__ == "__main__":
    main()
```