# HTTP request

Call any external HTTP API. The workhorse integration node.

## Overview

The HTTP Request node performs a single outbound request, optionally with a credential picked from your workspace's credentials. The response body is written to `last_output` and the HTTP status code to `ctx.http_status` so downstream nodes can branch on it.

Bodies, headers, query strings, and URLs all support `{placeholders}` against the run context. JSON bodies are parsed automatically; non-JSON responses are returned as raw text.

URLs are validated against the workspace's outbound policy before the request fires — internal addresses, loopback, and link-local ranges are rejected.

## Configuration

| Field | Description |
| --- | --- |
| `url` | Target URL. Supports `{placeholders}`. |
| `method` | `GET`, `POST`, `PUT`, `PATCH`, `DELETE`. Default `GET`. |
| `headers` | Object or JSON string of header name → value. Values support `{placeholders}`. |
| `body` | Request body string. Parsed as JSON if it parses; otherwise sent as raw text. Ignored on `GET`/`HEAD`. |
| `authType` | `none`, `bearerSecret`, `apiKeySecret`. |
| `credential_id` | Public id of a saved credential. Takes precedence over the node-local secret. |
| `apiKeyHeader` | Header name for `apiKeySecret` mode. Default `X-API-Key`. |
| Timeouts / retries | Default 30s per request. Add a **While** loop with a status-code check for custom retry policies. |

Returned context keys:

| Key | Value |
| --- | --- |
| `last_output` | Response body (JSON-stringified if JSON, raw text otherwise). |
| `http_status` | Numeric HTTP status code. |

## Example

POST a JSON payload with a bearer token from the credential store:

```
HTTP Request
  method: POST
  url: https://api.example.com/orders
  headers: {"Content-Type": "application/json"}
  body: {"customer_id": "{customer_id}", "total": {total}}
  authType: bearerSecret
  credential_id: cred_abc123
```

Branch on the status code:

```
HTTP Request → If/else (input.http_status >= 400) → Notify ops
                                                 → (else) Continue
```

## Gotchas

- The node does **not** follow redirects. Add a follow-up node if your endpoint 30x's.
- JSON responses are re-serialized to a string in `last_output`. Use `{outputs.<node_id>.parsed.<field>}` to drill into the structured form downstream.
- Prefer the credential picker (`credential_id`) for API auth. If a previous **Secret Lookup** node loaded an authorized secret, headers/bodies can use `{secret.alias}` without making that secret the lookup node's output.
- The URL is validated against the workspace's network policy. Loopback, private ranges, and metadata services are rejected.
- Credentials are scoped to the workflow owner. Picking a credential from another user's credential store is impossible from the editor.

---

*Source: https://agentbuilder.systalink.sn/docs/node-http-request — human documentation.*
*Other language: [/docs-md/fr/node-http-request.md](/docs-md/fr/node-http-request.md).*
*Machine-readable index: [/llms.txt](/llms.txt).*