HTTP Request

An HTTP Request node (http_request) calls any HTTP or REST API as an ordinary step. It is deterministic: the same configuration sends the same request every run, with no agent deciding what to send and no tokens spent. (The palette has two entries with this name — the one under Triggers is the inbound webhook; this one is under Utilities.)

Configuration

The request

• Method — GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS.
• URL — expressions allowed. It must be an absolute http:// or https:// URL.
• Query parameters — either name/value rows, or one expression that resolves to an object of name/value pairs. Parameters already in the URL are kept.
• Headers — name/value rows, both halves with expressions.
• Body — one of:
  • JSON, written either as name/value rows or in a raw editor. In the raw editor the expressions are filled in first and the result is then parsed as JSON, so {"id": {{ trigger.body.id }}} works.
  • Form (url-encoded) — name/value rows.
  • Form data (multipart) — text parts and file parts together. A file part points at a file: a Convert to File output such as {{ upstream.<nodeId>.output.file }}, or a Form Trigger upload.
  • Raw — the body verbatim, under a Content-Type you set.
  • Binary — one file as the whole body, under its own stored content type.

A Content-Type header you set yourself always wins over the one the body type would use.

Authentication

None, a Connection, Basic, Bearer token, a custom header (such as X-API-Key), or an API key in the query string.

A Connection is a connected app account — see Connections. Pick the account and the node authenticates as it: the node holds only the account's id, and the credential is applied inside Elizon. This is the one authentication type that can recover from a 401: Elizon renews the account's access once and retries once, and that retry does not come out of the Retries setting below.

For the other four, credentials are never typed into the node. Add the value under Settings → Secrets and point the field at it, so it holds a reference such as {{secret.API_TOKEN}}. A value typed in instead is refused — the workflow will not even save, because a credential stored in a workflow is kept with every saved version of it, cannot be rotated, and cannot be audited. Only the password half of Basic is a credential; the username is an ordinary field and may be an expression.

Output

With Output the full response off, the output is the body alone.

The response

• Format — Auto reads the Content-Type: JSON becomes a parsed object, text becomes text, and anything else is stored as a file. JSON, Text and File force one of those. A File response is stored exactly like a Convert to File output, so {{ upstream.<nodeId>.output.file }} can be attached, read or sent on.
• Output the full response — on, the output is { status, statusText, headers, body, file, request, attempts, redirects, errorSuppressed }. Off, the output is the response body alone, so a field of a JSON body is {{ upstream.<nodeId>.output.<field> }} rather than output.body.<field>.
• Never error — on, a 4xx or 5xx becomes ordinary output with errorSuppressed: true instead of failing the node. Off (the default), the node fails with the status and what the API said.

request is a record of what was sent — method, URL and headers — with every credential replaced by ***. It is what makes a 401 debuggable without the key being written into the run's history.

Options

• Timeout — 30 seconds by default, up to 300.
• Retries — none by default, up to 5. Retries apply to network errors, 5xx and 429 only; a 4xx is the request's own fault and retrying cannot fix it. The wait doubles from 1 second up to 30, and a Retry-After header from the API is honoured instead, up to the same 30-second ceiling.
• Follow redirects — on by default, up to 5 hops. Off, a 3xx is returned as the result, with its Location in headers.
• Responses are capped at 25 MB.

Where a request may go

The URL is checked before anything is sent, and again at every redirect: the name is resolved and the connection is then made to that exact address, so a name that changes its answer mid-request cannot be used to reach somewhere else. Cloud metadata addresses, link-local and reserved addresses, and the platform's own internal service names are always refused. Private-network and loopback addresses are refused too, unless a self-hosted installation allows them with EGRESS_ALLOW_PRIVATE_HOSTS=true. A refused request fails the node with the reason, rather than quietly timing out.

Your credential is sent to the address you configured, and only to that one. If the API redirects the request to a different host, scheme or port, the authentication is left behind on that hop — the same rule a browser or curl follows, and for the same reason: the first server chooses where the second request goes, so carrying the credential there would let any API you integrate hand your key to somebody else. If a redirected request comes back with a 401, point the node at the final URL directly.

Example

name: Create ticket
description: Opens a ticket in the helpdesk for every form submission.
graph:
  nodes:
    - id: form
      type: trigger_form
      position: { x: 0, y: 0 }
      data:
        authMode: none
        fields:
          - { name: summary, label: What is wrong?, type: textarea, required: true }
    - id: open-ticket
      type: http_request
      position: { x: 280, y: 0 }
      data:
        method: POST
        url: https://helpdesk.example.com/api/tickets
        bodyType: json
        jsonMode: raw
        jsonBody: '{"title": "{{ trigger.body.summary }}", "source": "web"}'
        responseFormat: json
        fullResponse: true
        timeoutSeconds: 30
        retries: 2
  edges:
    - { id: form-to-ticket, source: form, target: open-ticket }

In a Package

When a Package containing an HTTP Request node is installed, the whole request comes with it — method, URL, headers, body and options — but the authentication does not: it belongs to the author's company, and a secret or a connected account of the same name in your organization would be a different thing entirely. Open the node after installing and point it at your own secret or your own Connection; until then the request goes out unauthenticated and the API's own 401 says so.

• Travels: method, url, queryMode, queryRows, queryJson, headerRows, bodyType, jsonMode, jsonBody, jsonRows, formRows, multipartFields, rawBody, rawContentType, binaryFileExpression, responseFormat, responseFilename, fullResponse, neverError, timeoutSeconds, retries, followRedirects, maxRedirects
• Converted: none
• Never carried: auth