HTTP Node

Call external REST APIs and map responses back to records

Last updated 8 Oct 2026

The HTTP node makes an outbound HTTP request — once per run or once per record — and merges the response back into the automation data.

When to Use

Use HTTP to call any REST API that doesn't have a dedicated integration — enrichment APIs, internal services, and so on.

Configuration

Field	Type	Description
`url`	string	Request URL. Supports `{{variable}}` syntax
`urlTemplate`	string	Alternative templated URL (used when `url` is not set)
`method`	`GET` \| `POST` \| `PUT` \| `PATCH` \| `DELETE`	HTTP method (default: `GET`)
`headers`	object	Request headers. Values support `{{variable}}` syntax
`body`	string	Request body. Supports `{{variable}}` syntax
`bodyType`	`json` \| `form` \| `text` \| `none`	How the body is encoded (default: `none`)
`auth`	object	Authentication: `{ type: "none" \| "credential_ref", credentialId? }`
`iterationMode`	`single` \| `per_row`	Call once for the whole batch, or once per record (default: `single`)
`timeout`	number	Request timeout in milliseconds (default: `30000`)
`responseMapping`	object	`{ dataPath?, outputMode? }` — where to read the response from and how to merge it

Response Mapping

responseMapping.dataPath is a dot-notation path into the JSON response body (the part to keep). responseMapping.outputMode controls how the result is merged into the data: replace, merge, or append.

responseMapping:
  dataPath: data.company
  outputMode: merge

Authentication

For authenticated requests, set auth.type to credential_ref and reference a stored credential by auth.credentialId. The credential's type determines how it is applied (bearer/OAuth2 → Authorization: Bearer, basic → Authorization: Basic, API key → a configured header such as X-API-Key).

Example

Enrich records with company data, calling once per row:

url: "https://api.example.com/v2/companies/find?domain={{domain}}"
method: GET
iterationMode: per_row
auth:
  type: credential_ref
  credentialId: cred_company_api
responseMapping:
  dataPath: data.company
  outputMode: merge

Notes

The node enforces SSRF protection: private/internal IP ranges, cloud metadata endpoints, and internal hostnames are blocked, and resolved IPs are validated before connecting.
Don't embed API keys directly in url or body — use auth.credentialId and the credential store. Inline secrets in the URL or body are rejected.
Dangerous and sensitive headers are stripped, and response size is capped (10 MB) to prevent out-of-memory failures.
HTTP requests run on the governed external rail; non-read methods are classified as action:external scope and evaluated by guardrails before the request is sent.

Node Reference Complete reference for all automation node types, organized by category MCP Node Call a tool on a connected MCP server and map the response back to records Template Syntax Variable interpolation syntax for LLM, Agent, HTTP, and MCP node configurations

Still stuck? Browse the FAQ or contact us.