HTTP requests

1. 1Add an HTTP Request node and choose GET, POST, PUT, PATCH, or DELETE.
2. 2Enter the destination URL. Use a public endpoint you control; the node accepts HTTP and HTTPS URLs, then checks the destination before it connects.
3. 3Add each request header as a key and value. For a stored flow secret, reference it as {{secret.NAME}} rather than pasting the value into the flow.
4. 4For every method except GET, enter the request body that the API expects. Wire both the Success and Error outputs before publishing so the flow has an intentional path for either result.

1. 1In Response assignments, pair a flow variable with a response path. For a JSON response, use dot or bracket paths such as order.id or items[0].sku.
2. 2Use $ when the next step needs the full response body. On a successful response, the selected values and http_status are available to the Success branch. Non-success responses and request failures follow the Error branch, where http_error is available.
3. 3Use the simulator-only mock response to test mappings without calling the API. A mock can be a JSON body or an object with status and body.

The request guard is part of the feature, not a setting to bypass. It keeps a flow integration limited to a public, bounded request.

1. 1Private and loopback IP ranges are blocked, including destinations reached after DNS resolution.
2. 2A redirect from HTTPS to HTTP is blocked rather than allowing a secure request to be downgraded.
3. 3When a redirect changes origin, credential headers are stripped before the next request.
4. 4The response body is capped at 256 KB.
5. 5The complete request times out after 10 seconds.

The request fails before it reaches a service on a private or loopback address.

The guard rejects private and loopback IP ranges. Expose only the required operation through a public API endpoint, then point the node at that endpoint.

An HTTPS request fails when the destination redirects to an HTTP URL.

Keep the final destination on HTTPS, or change the configured URL to the secure final endpoint. Fluenta blocks HTTPS-to-HTTP redirect downgrades.

An authenticated request works at the first URL but fails after a cross-origin redirect.

Point the node directly at the trusted final API or keep the redirect on the same origin. Authorization, proxy authorization, and API-key headers are stripped when a redirect crosses origins.

The Error path runs after an API returns a large payload.

Make the endpoint return only the fields the flow needs, paginate the result, or add a server-side filter. HTTP responses larger than 256 KB are rejected.

The request fails after about 10 seconds.

Move long-running work behind an API that responds within the request window, or return a small status result that the flow can use. The guarded request timeout is 10 seconds.