All nodes/Integrations/HTTP & Web

HTTP Request

Performs an HTTP request (GET/POST/PUT/PATCH/DELETE/HEAD) and returns the response status, headers and body. Supports JSON/text/form body, bearer/basic/custom-header auth, and templating of URL/headers/body via Jinja. SSRF protection — requests to private networks are blocked.

Try it

When to use it

The general-purpose step to any HTTP API that has no node of its own. When a dedicated node exists — Telegram, amoCRM, Bitrix24, calendar, email — use it: authentication, pagination and error shapes are already handled there. To read a web page as text for a model there is Fetch Webpage; for an MCP server there is MCP Tool.

This node is a graph step, not an agent tool: it has no tool_out port, so a model cannot call it. To hand an agent an HTTP call of your own, wrap it in a WF tool.

How it works

The URL, headers, query parameters, body and the auth fields are all rendered through Jinja, so {{ inputs.input.id }}, {{ variables.token }} and {{ secret.API_KEY }} work in any of them.

Headers, Query Parameters and a form body are a JSON object written as text. Invalid JSON fails the node with a direct message. For GET and HEAD no body is sent, whatever the field contains.

The node has two outputs: Success carries execution onward, and Response returns the response object — status_code, ok, headers, body, text, url, elapsed_ms. text is always the raw string; body is parsed as JSON only when Parse JSON Response is on and the server sent a Content-Type containing json, otherwise it holds the same string.

Requests to private networks and loopback are blocked, and every redirect hop is validated again. The response is truncated at Max Response Bytes (1,000,000 by default, 10,000,000 ceiling). The timeout defaults to 30 seconds with a maximum of 120; a plan may lower both.

Common mistakes

• Expecting the response on Success. The value comes out of the Response port — wire a data edge from it, or read {{ nodes.<id>.output.body }}.
• Forgetting how 4xx/5xx is handled. Fail on 4xx/5xx is on by default, so anything outside 2xx goes to the Error output. To inspect the status yourself, turn it off: then Success fires and you decide from ok and status_code.
• Reading body when the response was not JSON. A server sending JSON as text/plain leaves you a string to parse.
• Mistaking a truncated response for the server’s answer. A large JSON stops parsing once it is cut — raise the byte limit.

Inputs

Outputs

Configuration