HTTP Request

output.http-request Output v0.1.0

Sends workflow data to an HTTP endpoint.

The HTTP Request step on the Studio canvas
The HTTP Request step as it appears on the Studio canvas — input pins on the left, output ports on the right.

Finding it in the library

Search the builder's node library for HTTP Request (it lives under Output). A single click opens the in-editor docs panel shown here — description, ports, and every property, without leaving the canvas. Double-click (or drag) to add it to the workflow.

HTTP Request in the node library, with the in-editor docs panel open
The library entry and the in-editor docs panel for HTTP Request — the same reference this page is generated from.

Wired up in the builder

HTTP Request in a real, runnable flow — captured live from the Studio editor, exactly as it looks on your canvas. This is the same workflow used for the example input & output below.

HTTP Request wired into a runnable workflow in the Studio builder
HTTP Request wired into a runnable flow — input on the left, output on the right.

How it’s configured

The node’s settings as the builder shows them — every field laid out with real values. In the Studio these are edited on the node: click the chevron on the divider under its ports to open them.

The HTTP Request node's settings in the Studio builder
The settings for HTTP Request, showing the values from the flow above.

Ports

Ports are the node’s contract with its neighbours. In the editor a port label renders bold when wired and italic when optional; ports accept attachment carriers rather than data wires.

DirectionPortLabelWhat flows through it
InputinputInput
OutputsuccessSuccess
OutputerrorError

How data flows through it

HTTP Request consumes the content of the incoming envelope — when it is fed directly by a trigger, the trigger’s wrapper is unwrapped at the node boundary so the node sees the actual data, not the metadata shell. Its output becomes the payload for the next node, while the envelope (trace ids, correlation, binary refs) rides along untouched. In the Runs view you always see the whole envelope for both sides of this node.

Expressions in the config

String-typed properties accept {{ }} expressions evaluated against the incoming item at run time — e.g. {{ $json.customer.email }}. On this node that’s url, authUser, authPassword, authToken, authName, authValue, authConsumerKey, authConsumerSecret, authTokenSecret, userAgent. JSON- and code-typed fields never interpolate — they are passed through literally.

Build it with AI

Every node in this reference is reachable through Flowdrome’s AI Copilot and the MCP tools — say what you want, and the graph surgery happens server-side. Node types resolve fuzzily, so the catalog label (HTTP Request) works as well as the exact type id (output.http-request).

In the Copilot panel (or any connected AI):

add a http request node after the trigger

As a step in a create_chain_workflow call:

{"type":"HTTP Request","config":{}}
Raw MCP call — add this node to a workflow with add_node
curl -s -X POST http://localhost:4800/mcp -H "content-type: application/json" -d '{ "jsonrpc": "2.0", "id": "1", "method": "tools/call", "params": { "name": "add_node", "arguments": { "workflowId": "<id>", "type": "HTTP Request" } } }'

Example input & output

Captured from a real test run of the workflow above — this is what the Runs view shows after pressing Test workflow.

On this run the node emitted on ports success, output.

Input — what the node received

The HTTP Request node's input envelope in the run data viewer
The input envelope in the Runs view — Flowdrome always shows the whole envelope, with the payload inside body.

Output — what the node produced

The HTTP Request node's output envelope in the run data viewer
The output envelope after the step ran.

Property reference

Every setting, with its type and default — the same fields shown configured above.

PropertyTypeDefaultDescription
Method
method
select "POST" HTTP method for the outbound request.
DELETEGETPATCHPOSTPUT
URL
url
string Target URL. Resolves ${variable.NAME} and ${credential.NAME} at run start (never baked into the doc), and {{ }} expressions against the incoming data — e.g. ${variable.apiBase}/items/{{ $json.id }}.
Request body type
contentType
select "application/json" Content-Type for the request body you SEND (POST/PUT/PATCH). Ignored on GET. Does NOT control how the response is parsed — the response always comes back as { statusCode, ok, contentType, body }.
application/cborapplication/jsonapplication/octet-streamapplication/pdfapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheetapplication/vnd.openxmlformats-officedocument.wordprocessingml.documentapplication/x-www-form-urlencodedapplication/xmlaudio/mpegimage/gifimage/jpegimage/pngimage/svg+xmlimage/webpmultipart/form-datatext/csvtext/htmltext/plainvideo/mp4
Authentication
authType
select "none" Attach credentials to the request: Basic, Bearer, Header (one named header), Query (one named query param), Digest (RFC 7616 challenge-response), Custom (JSON of headers/qs/body), OAuth1 (signed request), or OAuth2 (bearer access token). Your explicit headers always win over auth-injected ones.
basicbearercustomdigestheadernoneoauth1oauth2query
Credential
credentialId
credential "" Use a stored credential for this connection — its fields are filled in at run start. Pick "None" to enter the connection details manually.
accepts credential templates: http-basichttp-bearerhttp-headerhttp-queryhttp-digesthttp-customhttp-oauth1google-oauth2notion-oauth2hubspot-oauth2microsoft-oauth2
Shown when String(authType ?? "none") !== "none"
User
authUser
string User name for Basic/Digest auth.
Shown when types.includes(String(authType ?? "none"))
Password
authPassword
string Password for Basic/Digest auth.
Shown when types.includes(String(authType ?? "none"))
Token
authToken
string Bearer/OAuth2 access token (sent as Authorization: Bearer <token>); for OAuth1 this is the access token.
Shown when types.includes(String(authType ?? "none"))
Name
authName
string Header name (Header auth) or query parameter name (Query auth).
Shown when types.includes(String(authType ?? "none"))
Value
authValue
string Value of the auth header / query parameter.
Shown when types.includes(String(authType ?? "none"))
Custom auth JSON
authJson
json Object with any of `headers`, `qs`, `body` maps merged into the request, e.g. { "headers": { "x-api-key": "…" } }.
Shown when types.includes(String(authType ?? "none"))
Consumer key
authConsumerKey
string OAuth1 consumer key.
Shown when types.includes(String(authType ?? "none"))
Consumer secret
authConsumerSecret
string OAuth1 consumer secret.
Shown when types.includes(String(authType ?? "none"))
Token secret
authTokenSecret
string OAuth1 token secret (pairs with the access token above).
Shown when types.includes(String(authType ?? "none"))
Signature method
authSignatureMethod
select "HMAC-SHA1" OAuth1 signature algorithm.
HMAC-SHA1HMAC-SHA256HMAC-SHA512
Shown when types.includes(String(authType ?? "none"))
Specify headers
headersMode
select "json" Author headers as a JSON object or as name/value rows.
jsonrows
Headers
headers
keyvalue Additional request headers — one row per header; values may hold {{ }} expressions, resolved per item when the request fires.
Shown when String(headersMode ?? "json") === "json"
Headers
headerRows
rows Request headers as name/value rows; values evaluate {{ }} expressions per row.
Shown when String(headersMode ?? "json") === "rows"
Send query parameters
queryMode
select "none" Attach query parameters to the URL — as a JSON object or name/value rows.
jsonnonerows
Query parameters
query
keyvalue Query parameters — one row per parameter (arrays expand per the array format below); values may hold {{ }} expressions, resolved per item when the request fires.
Shown when String(queryMode ?? "none") === "json"
Query parameters
queryRows
rows Query parameters as name/value rows; values evaluate {{ }} expressions per row. Repeated names become arrays.
Shown when String(queryMode ?? "none") === "rows"
Array format
queryArrays
select "brackets" How array values serialize: brackets (foo[]=a&foo[]=b), repeat (foo=a&foo=b), or indices (foo[0]=a&foo[1]=b).
bracketsindicesrepeat
Shown when String(queryMode ?? "none") !== "none"
Body path
bodyPath
field Dotted path to the value used as the request body.
Expect 2xx
expectOk
boolean true Fail the node on non-2xx responses.
Return response body
includeResponseBody
boolean true Output the response body (the fetched data) as this node's result. Turn off to emit only the status code.
Parse JSON responses
parseResponse
boolean true When the response Content-Type is JSON, output `body` as the PARSED value (and `bodyText` as the raw string) — no script needed to use the data. Malformed JSON keeps the string body and sets `parseFailed` instead of failing. On by default for new nodes; workflows saved without this option keep the original string `body`.
Client (User-Agent)
userAgentPreset
select "default" Send a User-Agent header identifying the client — appear as a browser, phone, or crawler; 'Custom' for your own string; 'Default' sends none. Some APIs (e.g. weather.gov) reject requests that arrive without a User-Agent. An explicit User-Agent in Headers always wins.
bingbotchrome-androidchrome-macchrome-wincurlcustomdefaultduckduckbotedge-winfirefox-macfirefox-winflowdromegooglebotsafari-iossafari-mac
Custom User-Agent
userAgent
string "" Full UA string — used when Client is 'Custom'.
Shown when userAgentPreset === "custom"

Using it

Fetch and use a JSON API — no glue code

Set Method and URL — the URL field takes {{ }} expressions, so https://api.example.com/orders/{{ $json.orderId }} builds the path from the incoming data. With Parse JSON responses on (the default for new nodes), the response body arrives as a parsed value: the next node reads {{ $json.body.status }} or {{ $json.body.items.length }} directly — no script node, no JSON.parse.

The example capture above shows the result shape: status code, headers, and the parsed body side by side on the output envelope.

Scrape, then shape (the shipped Scrape Headlines demo)

A plain GET against a page feeds HTML Extract (CSS selectors) → Split OutSortLimit. The whole pipeline is list nodes; the request node just delivers body.

Body path — send one value, and fail fast when it isn’t there

By default a POST/PUT/PATCH sends the node’s whole incoming payload as the body (GET and DELETE send none). Set Body path to a dotted path and two things change: the body becomes just that value, and a path that is not present throws HTTP_REQUEST_BODY_MISSINGbody path is missing: customerbefore the request is built or sent. No network call, no half-finished write downstream, and the run’s error names the field.

That makes it the cheapest way to reject a webhook that arrived without the field you were about to forward, since nothing validates a request body by default:

# the workflow's HTTP Request node has Body path = customer
curl -i -X POST http://your-host:4801/signup-api/signup \
  -H 'content-type: application/json' -H 'Prefer: wait=5' \
  -d '{"source":"web"}'
HTTP/1.1 500 Internal Server Error

{ "runId": "run_9f3c1a", "status": "failed", "error": "body path is missing: customer" }

Two limits worth knowing. Present-but-null counts as present — the check is whether the path exists, so {"customer": null} passes it. And it only guards the value you are sending; to check a shape you are not forwarding, use Validate JSON Schema after the trigger instead. See making a bad request fail properly.

Tips

  • Parse JSON responses keeps the raw string in bodyText alongside the parsed body; malformed JSON sets parseFailed instead of failing the node. Workflows saved before this option keep their original string-body behavior.
  • The URL, headers and body fields all take {{ }} expressions.
  • Client (User-Agent): pick a browser, phone, or crawler to appear as — or Custom for your own string. Some APIs (e.g. weather.gov) reject requests that arrive without a User-Agent; an explicit User-Agent in Headers always wins over the preset.
  • Outbound requests pass an SSRF guard — private-range targets are refused unless the engine is configured to allow them.
  • Binary responses (images, PDFs) become first-class binary items that S3 / Write File / Telegram media operations consume directly.
  • A rejected request keeps the rejection. With Expect 2xx on (the default), a non-2xx fails the node with HTTP_REQUEST_FAILED / HTTP request returned 400 — and the upstream’s own response body travels with it as structured detail on the failed node, so the run record says “name is required” and not just the status line. The run’s top-level error (the string a webhook caller collects) is the message; open the run to read the detail.

Related nodes

The rest of the Output group — the same folder you’d scan in the editor’s library.

This page is generated from the node registry by gen-node-docs.mjs on every site build — ports, properties, defaults and visibility rules cannot drift from the code. The screenshots and example data are captured from a live Flowdrome by npm run shots:nodes and npm run gen:examples. The hand-authored notes above are merged in.