HTTP Requests

Backend scripts can call external APIs with http.get(), http.post() and http.patch(). They are on for every brand. Requests to private or internal addresses are blocked. To send an API key, save it as a secret and put env.secret.NAME in a header. Never paste keys into the script itself.

`http.get(url, headers?)`

Make an HTTP GET request.

var result = http.get('https://api.example.com/user/123');

if (result.status === 200) {
  var data = JSON.parse(result.body);
  setVariable('user_name', data.name);
}

Parameter	Type	Description
`url`	string	Full URL to request
`headers`	object	Optional request headers

`http.post(url, body, headers?)`

Make an HTTP POST request.

var result = http.post(
  'https://api.example.com/verify',
  JSON.stringify({ token: request.query.token }),
  { 'Content-Type': 'application/json' }
);

if (result.status !== 200) {
  redirect('/unauthorized');
}

Parameter	Type	Description
`url`	string	Full URL to request
`body`	string	Request body (typically JSON stringified)
`headers`	object	Optional request headers

`http.patch(url, body, headers?)`

Same as http.post, with the PATCH method.

Response object

Every http.* call returns an object:

{
  status: 200,          // HTTP status code (0 if request failed entirely)
  headers: {},          // Response headers
  body: '...'           // Response body as a string
}

The body is always a string, so binary answers (a raw mp3 or image) do not come through intact. Use an endpoint that returns JSON, for example one with base64 audio inside. To work with JSON APIs, parse the body:

var result = http.get('https://api.example.com/data');
var data = JSON.parse(result.body);

Limits

Constraint	Value
Max requests per script execution	5
Request timeout	10 seconds
Max response body size	1 MB

Security

Private and internal addresses are blocked: localhost, 10.x.x.x, 172.16-31.x.x, 192.168.x.x, 169.254.x.x and cloud metadata endpoints, including hostnames that resolve to them.
Only http:// and https:// URLs are allowed. Redirects are not followed.
Secrets are sent only over https, in headers, to their allowed hosts.

Example: external auth check

<script scope="backend">
  var token = request.query.token;

  if (!token) {
    redirect('/login');
  }

  var auth = http.post('https://auth.myservice.com/validate',
    JSON.stringify({ token: token }),
    { 'Content-Type': 'application/json' }
  );

  if (auth.status === 200) {
    var user = JSON.parse(auth.body);
    session.set('verified_user', user.email);
    setVariable('user_name', user.name);
  } else {
    response.status(403);
    response.send('<h1>Invalid token</h1>');
  }
</script>

<h1>Welcome, {{ var.user_name }}</h1>

Get started

Build

Sell

Grow and track

Manage

Developers

`http.get(url, headers?)`

`http.post(url, body, headers?)`

`http.patch(url, body, headers?)`

Response object

Limits

Security

Example: external auth check

​http.get(url, headers?)

​http.post(url, body, headers?)

​http.patch(url, body, headers?)

​Response object

​Limits

​Security

​Example: external auth check

`http.get(url, headers?)`

`http.post(url, body, headers?)`

`http.patch(url, body, headers?)`

Response object

Limits

Security

Example: external auth check