Send HTTP Requests from a Workflow

The HTTP Request action sends an outbound request from your WordPress site to a configured URL. It supports seven methods and can include headers, optional authentication from a saved connection, and an optional body. By default, the action uses WordPress safe-request handling to block requests to unsafe local or private network destinations.

Configure the request

Add the HTTP Request action to the workflow.

Choose Method: GET is the default. Other supported methods are POST, PUT, PATCH, DELETE, HEAD, and OPTIONS.

Enter the required URL. This field supports workflow variables.

Optionally select a saved connection under Authentication (optional), and add any required entries in Headers.

Leave Send Body disabled for requests that do not need a body. Enable it when the chosen method and endpoint require one.

Save the workflow and test with a safe endpoint before using a production API.

Screenshot to add: HTTP Request action with Method, URL, Authentication, and Headers

Choose a body format

When Send Body is enabled, Body Content Type supports JSON, Form URL Encoded, and Raw. The default content type is JSON. The Specify Body field offers Using JSON and Using Fields Below.

Using JSON: Enter the request content in Body. This field supports workflow tokens. JSON content is sent with an application/json content type unless you explicitly provide a Content-Type header.

Using Fields Below: Add name/value pairs under Body Parameters. Rows without a field name are skipped. JSON and raw modes build an object from the pairs; Form URL Encoded creates a URL-encoded body.

GET and HEAD requests do not send a body through this action, even if body settings are enabled.

Screenshot to add: HTTP Request body settings with Send Body, Body Content Type, Specify Body, and Body Parameters

Understand optional authentication

The action applies a selected connection to the Authorization header. Username & Password uses HTTP Basic authentication. Bearer Token and API Key both become Authorization: Bearer … in this action. If an API expects its key in a custom header or query parameter, configure that in Headers instead. Do not assume the HTTP action supports the Google OAuth flow just because OAuth 2 is available as a connection type for Google Sheets.

Use safe URL settings

Allow local/unsafe URLs defaults to disabled. When it remains disabled, the action uses wp_safe_remote_request() to apply WordPress URL safety checks. Enabling the setting switches to the regular request function and bypasses that protection against internal network hosts. Leave it disabled in production unless you have a specific, reviewed need to reach a local or private destination.

Read the response

The action uses a 15-second timeout. A transport-level WP_Error returns success: false and an error message. Otherwise, it returns success: true, status_code, and the response body. The action does not treat every non-2xx HTTP status as a failure; inspect status_code and the response body in your workflow before assuming the remote operation succeeded.

Use trusted endpoints, avoid sending secrets in URLs, and do not include authentication values in messages or downstream outputs. For details on saved credential handling, see Manage Workflow Connections.