HTTP Request
output.http-request Output v0.1.0 Sends workflow data to an HTTP endpoint.
Finding it in the library
Search the builder's node library for HTTP Request (it lives under Output). A single click opens the in-editor docs panel shown here — description, ports, and every property, without leaving the canvas. Double-click (or drag) to add it to the workflow.
Wired up in the builder
HTTP Request in a real, runnable flow — captured live from the Studio editor, exactly as it looks on your canvas. This is the same workflow used for the example input & output below.
How it’s configured
The node’s Configure panel as it opens in the builder when you select the step — every setting laid out with real values. Click any field to edit it.
Ports
Ports are the node’s contract with its neighbours. In the editor a port label renders bold when wired and italic when optional; ◈ ports accept attachment carriers rather than data wires.
| Direction | Port | Label | What flows through it |
|---|---|---|---|
| Input | input | Input | |
| Output | success | Success | |
| Output | error | Error |
How data flows through it
HTTP Request consumes the content of the incoming envelope — when it is fed directly by a trigger, the trigger’s wrapper is unwrapped at the node boundary so the node sees the actual data, not the metadata shell. Its output becomes the payload for the next node, while the envelope (trace ids, correlation, binary refs) rides along untouched. In the Runs view you always see the whole envelope for both sides of this node.
Expressions in the config
String-typed properties accept {{ }} expressions evaluated against the
incoming item at run time — e.g. {{ $json.customer.email }}. On this node
that’s url, targetUrl, targetUrlConfigKey, authUser, authPassword, authToken, authName, authValue, authConsumerKey, authConsumerSecret, authTokenSecret, userAgent. JSON- and code-typed fields never interpolate — they are passed through literally.
Build it with AI
Every node in this reference is reachable through Flowdrome’s
AI Copilot and the
MCP tools — say what you want, and the graph surgery
happens server-side. Node types resolve fuzzily, so the catalog label
(HTTP Request) works as well as the exact type id (output.http-request).
In the Copilot panel (or any connected AI):
add a http request node after the trigger As a step in a create_chain_workflow call:
{"type":"HTTP Request","config":{}} Raw MCP call — add this node to a workflow with add_node
curl -s -X POST http://localhost:48170/mcp -H "content-type: application/json" -d '{ "jsonrpc": "2.0", "id": "1", "method": "tools/call", "params": { "name": "add_node", "arguments": { "workflowId": "<id>", "type": "HTTP Request" } } }' Example input & output
Captured from a real test run of the workflow above — this is what you see in the run data panel after pressing Test workflow.
On this run the node emitted on ports success, output.
Input — what the node received
body.Output — what the node produced
Property reference
Every setting, with its type and default — the same fields shown configured in the panel above.
| Property | Type | Default | Description |
|---|---|---|---|
Methodmethod | select | "POST" | HTTP method for the outbound request. DELETEGETPATCHPOSTPUT |
URLurl | string | — | Static target URL (or use the dynamic key below). |
Target URLtargetUrl | string | — | Resolved target URL. |
Target URL config keytargetUrlConfigKey | string | "targetUrl" | Config/secret key the target URL is read from at run time. |
Request body typecontentType | select | "application/json" | Content-Type for the request body you SEND (POST/PUT/PATCH). Ignored on GET. Does NOT control how the response is parsed — the response always comes back as { statusCode, ok, contentType, body }. application/cborapplication/jsonapplication/octet-streamapplication/pdfapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheetapplication/vnd.openxmlformats-officedocument.wordprocessingml.documentapplication/x-www-form-urlencodedapplication/xmlaudio/mpegimage/gifimage/jpegimage/pngimage/svg+xmlimage/webpmultipart/form-datatext/csvtext/htmltext/plainvideo/mp4 |
AuthenticationauthType | select | "none" | Attach credentials to the request: Basic, Bearer, Header (one named header), Query (one named query param), Digest (RFC 7616 challenge-response), Custom (JSON of headers/qs/body), OAuth1 (signed request), or OAuth2 (bearer access token). Your explicit headers always win over auth-injected ones. basicbearercustomdigestheadernoneoauth1oauth2query |
CredentialcredentialId | credential | "" | Use a stored credential for this connection — its fields are filled in at run start. Pick "None" to enter the connection details manually. accepts credential templates: http-basichttp-bearerhttp-headerhttp-queryhttp-digesthttp-customhttp-oauth1google-oauth2notion-oauth2hubspot-oauth2microsoft-oauth2Shown when String(authType ?? "none") !== "none" |
UserauthUser | string | — | User name for Basic/Digest auth. Shown when types.includes(String(authType ?? "none")) |
PasswordauthPassword | string | — | Password for Basic/Digest auth. Shown when types.includes(String(authType ?? "none")) |
TokenauthToken | string | — | Bearer/OAuth2 access token (sent as Authorization: Bearer <token>); for OAuth1 this is the access token. Shown when types.includes(String(authType ?? "none")) |
NameauthName | string | — | Header name (Header auth) or query parameter name (Query auth). Shown when types.includes(String(authType ?? "none")) |
ValueauthValue | string | — | Value of the auth header / query parameter. Shown when types.includes(String(authType ?? "none")) |
Custom auth JSONauthJson | json | — | Object with any of `headers`, `qs`, `body` maps merged into the request, e.g. { "headers": { "x-api-key": "…" } }. Shown when types.includes(String(authType ?? "none")) |
Consumer keyauthConsumerKey | string | — | OAuth1 consumer key. Shown when types.includes(String(authType ?? "none")) |
Consumer secretauthConsumerSecret | string | — | OAuth1 consumer secret. Shown when types.includes(String(authType ?? "none")) |
Token secretauthTokenSecret | string | — | OAuth1 token secret (pairs with the access token above). Shown when types.includes(String(authType ?? "none")) |
Signature methodauthSignatureMethod | select | "HMAC-SHA1" | OAuth1 signature algorithm. HMAC-SHA1HMAC-SHA256HMAC-SHA512 Shown when types.includes(String(authType ?? "none")) |
Specify headersheadersMode | select | "json" | Author headers as a JSON object or as name/value rows. jsonrows |
Headersheaders | json | — | Additional request headers as a JSON object. Shown when String(headersMode ?? "json") === "json" |
HeadersheaderRows | rows | — | Request headers as name/value rows; values evaluate {{ }} expressions per row. Shown when String(headersMode ?? "json") === "rows" |
Send query parametersqueryMode | select | "none" | Attach query parameters to the URL — as a JSON object or name/value rows. jsonnonerows |
Query parametersquery | json | — | Query parameters as a JSON object (arrays expand per the array format below). Shown when String(queryMode ?? "none") === "json" |
Query parametersqueryRows | rows | — | Query parameters as name/value rows; values evaluate {{ }} expressions per row. Repeated names become arrays. Shown when String(queryMode ?? "none") === "rows" |
Array formatqueryArrays | select | "brackets" | How array values serialize: brackets (foo[]=a&foo[]=b), repeat (foo=a&foo=b), or indices (foo[0]=a&foo[1]=b). bracketsindicesrepeat Shown when String(queryMode ?? "none") !== "none" |
Body pathbodyPath | field | — | Dotted path to the value used as the request body. |
Expect 2xxexpectOk | boolean | true | Fail the node on non-2xx responses. |
Return response bodyincludeResponseBody | boolean | true | Output the response body (the fetched data) as this node's result. Turn off to emit only the status code. |
Parse JSON responsesparseResponse | boolean | true | When the response Content-Type is JSON, output `body` as the PARSED value (and `bodyText` as the raw string) — no script needed to use the data. Malformed JSON keeps the string body and sets `parseFailed` instead of failing. On by default for new nodes; workflows saved without this option keep the original string `body`. |
Client (User-Agent)userAgentPreset | select | "default" | Send a User-Agent header identifying the client — appear as a browser, phone, or crawler; 'Custom' for your own string; 'Default' sends none. Some APIs (e.g. weather.gov) reject requests that arrive without a User-Agent. An explicit User-Agent in Headers always wins. bingbotchrome-androidchrome-macchrome-wincurlcustomdefaultduckduckbotedge-winfirefox-macfirefox-winflowdromegooglebotsafari-iossafari-mac |
Custom User-AgentuserAgent | string | "" | Full UA string — used when Client is 'Custom'. Shown when userAgentPreset === "custom" |
Using it
Fetch and use a JSON API — no glue code
Set Method and URL — the URL field takes {{ }} expressions, so
https://api.example.com/orders/{{ $json.orderId }} builds the path from the incoming data.
With Parse JSON responses on (the default for new nodes), the response body arrives as a
parsed value: the next node reads {{ $json.body.status }} or
{{ $json.body.items.length }} directly — no script node, no JSON.parse.
The example capture above shows the result shape: status code, headers, and the parsed body
side by side on the output envelope.
Scrape, then shape (the shipped Scrape Headlines demo)
A plain GET against a page feeds HTML Extract (CSS selectors) → Split Out → Sort →
Limit. The whole pipeline is list nodes; the request node just delivers body.
Tips
- Parse JSON responses keeps the raw string in
bodyTextalongside the parsedbody; malformed JSON setsparseFailedinstead of failing the node. Workflows saved before this option keep their original string-body behavior. - The URL, headers and body fields all take
{{ }}expressions. - Client (User-Agent): pick a browser, phone, or crawler to appear as — or Custom for your
own string. Some APIs (e.g. weather.gov) reject requests that arrive without a
User-Agent; an explicitUser-Agentin Headers always wins over the preset. - Outbound requests pass an SSRF guard — private-range targets are refused unless the engine is configured to allow them.
- Binary responses (images, PDFs) become first-class binary items that S3 / Write File / Telegram media operations consume directly.
Related nodes
The rest of the Output group — the same folder you’d scan in the editor’s library.
This page is generated from the node registry by gen-node-docs.mjs on every
site build — ports, properties, defaults and visibility rules cannot drift from the code.
The screenshots and example data are captured from a live Flowdrome by
npm run shots:nodes and npm run gen:examples.
The hand-authored notes above are merged in.