httpRequest

Source: src/workflows/shared/actions/http.ts. Calls external or internal HTTP APIs from a workflow step and records sanitized request/response details in the run timeline.

Connection profiles

Create profiles under /p/<project-slug>/connections. Profiles define base URL, auth mode, default headers, timeout, and retry defaults. Secret auth values are referenced by project environment variable key, not stored directly in the profile.

• Supported methods: GET, POST, PUT, PATCH, DELETE.
• Supported bodies: JSON via json or form-urlencoded via form.
• Auth modes: none, bearer token, basic auth, API key header, and custom env-backed headers. Login bearer profiles can also call a login endpoint to obtain a JWT before protected requests.

Login bearer auth

Use login bearer auth when an API requires a JSON login request before protected API calls. The profile stores the login path and token extraction path, while credentials stay in project environment variables. Tokens are cached for the workflow run. If a protected request returns HTTP 401, Flowman clears the cached token, logs in once more, and retries the original request one time. Login bearer profiles can be tested from the edit connection page to verify the login request and token extraction path before using them in workflows.

{
  "type": "loginBearer",
  "loginMethod": "POST",
  "loginPath": "/auth/login",
  "loginHeaders": [{ "name": "Content-Type", "value": "application/json" }],
  "loginJson": {
    "email": "{{env.API_EMAIL}}",
    "password": "{{env.API_PASSWORD}}"
  },
  "tokenPath": "response.token",
  "authorizationScheme": "Bearer"
}

Templates and output

Strings in path, headers, query params, JSON bodies, and form bodies can reference {{input.*}}, {{steps.*}}, {{source.*}}, and {{env.*}}. When a JSON value is exactly one template, the original value type is preserved.

import {
  createWorkflowActionContext,
  httpRequest,
  setWorkflowStepOutput,
} from "@/workflows/shared/actions";

const context = createWorkflowActionContext(record);
setWorkflowStepOutput(context, "extractArtistId", {
  artistId: record.input.artistId,
});

const result = await httpRequest({
  record,
  context,
  stepKey: "fetchArtist",
  name: "Fetch artist from FYVE",
  connection: "fyve-production",
  method: "GET",
  path: "/artists/{{steps.extractArtistId.output.artistId}}",
  query: { include: "releases" },
  outputMap: {
    artist: "response.data.artist",
    release: "response.data.release",
  },
});

Retries and failures

The action retries network errors, timeouts, and HTTP 408, 425, 429, 500, 502, 503, and 504. GET, PUT, and DELETE are retryable by default; POST and PATCH retry only when explicitly listed. Non-2xx HTTP responses are returned to workflow code after retry handling instead of being thrown automatically.

await httpRequest({
  record,
  context,
  stepKey: "updateRelease",
  connection: "fyve-staging",
  method: "PATCH",
  path: "/releases/{{input.releaseId}}",
  headers: { "Idempotency-Key": "{{input.requestId}}" },
  json: {
    status: "ready",
    note: "{{steps.aiSummary.output.note}}",
  },
  retries: {
    count: 1,
    retryableMethods: ["PATCH"],
  },
});