HTTP Request
Call a public REST API and pass its response to later nodes.
Supported settings
| Field | Current UI behavior |
|---|---|
| Variable Name | Required output name, for example myApiCall. |
| HTTP Method | GET, POST, PUT, PATCH, or DELETE. |
| Endpoint URL | Required public HTTP/HTTPS URL. Put query parameters directly in the URL. Templates are supported. |
| Headers | Repeatable key/value rows. Use them for content negotiation or authorization when appropriate. |
| Body | Shown for every method except GET. Must be valid JSON and may contain templates. |
Note
Although older/internal data shapes recognize fields such as query parameters, timeout, or retry, the current settings panel does not expose controls for them. This guide documents only the current UI.
REST API example
text
Variable Name: customerLookup
Method: POST
Endpoint URL: https://api.example.com/customers
Header: Content-Type = application/jsonjson
{
"email": "{{googleForm.data.response.answers.Email}}"
}A later node can read JSON with {{customerLookup.data.id}}, response status with {{customerLookup.statusCode}}, or plain text with {{customerLookup.body}}.
Response output
json
{
"status": 200,
"statusCode": 200,
"statusText": "OK",
"headers": { "content-type": "application/json" },
"contentType": "application/json",
"body": null,
"data": { "id": 42 }
}Valid JSON is returned in data and sets body to null. A non-JSON response is returned as plain-text body with data null. A response claiming JSON but containing malformed JSON fails the node.
Safety and limitations
- URLs must use HTTP or HTTPS and cannot contain embedded usernames or passwords.
- Localhost, loopback, link-local, private-network, multicast, and other unsafe resolved addresses are blocked.
- NexFlow adds an idempotency key for durable workflow executions.
- Non-success HTTP responses fail the node. Execution errors omit response bodies from user-visible history and redact common token/secret patterns.
- GET has no body. Non-GET bodies are sent as JSON.
Common errors
| Problem | Fix |
|---|---|
| Needs a URL / invalid URL | Enter a complete public HTTP or HTTPS URL. |
| Hostname could not be resolved | Check the domain name and public DNS. |
| Cannot target private network | Use a publicly reachable endpoint; internal services are intentionally blocked. |
| Malformed JSON | Correct the request Body or the upstream API's JSON response. |
| Failed with status 4xx/5xx | Check the API contract, authentication header, URL, and request body. |
| Timed out | The current UI has no timeout control; improve the target endpoint or retry with a new execution. |