{"id":159,"date":"2026-10-17T14:16:04","date_gmt":"2026-10-17T14:16:04","guid":{"rendered":"http:\/\/plugin-docs.com\/?post_type=doc&p=159"},"modified":"2026-10-18T11:54:35","modified_gmt":"2026-10-18T11:54:35","slug":"send-http-requests-workflow","status":"publish","type":"doc","link":"https:\/\/dragwyb.com\/docs\/send-http-requests-workflow\/","title":{"rendered":"Send HTTP Requests from a Workflow"},"content":{"rendered":"\n

The HTTP Request<\/strong> action sends an outbound request from your WordPress site to a configured URL. It supports seven methods and can include headers, optional authentication from a saved connection, and an optional body. By default, the action uses WordPress safe-request handling to block requests to unsafe local or private network destinations.<\/p>\n\n\n\n

Configure the request<\/h2>\n\n\n\n\n
  • Add the HTTP Request<\/strong> action to the workflow.<\/li>\n\n\n
  • Choose Method<\/strong>: GET<\/code> is the default. Other supported methods are POST<\/code>, PUT<\/code>, PATCH<\/code>, DELETE<\/code>, HEAD<\/code>, and OPTIONS<\/code>.<\/li>\n\n\n
  • Enter the required URL<\/strong>. This field supports workflow variables.<\/li>\n\n\n
  • Optionally select a saved connection under Authentication (optional)<\/strong>, and add any required entries in Headers<\/strong>.<\/li>\n\n\n
  • Leave Send Body<\/strong> disabled for requests that do not need a body. Enable it when the chosen method and endpoint require one.<\/li>\n\n\n
  • Save the workflow and test with a safe endpoint before using a production API.<\/li>\n\n\n\n\n\n

    Screenshot to add: HTTP Request action with Method, URL, Authentication, and Headers<\/p>\n\n\n\n

    Choose a body format<\/h2>\n\n\n\n

    When Send Body<\/strong> is enabled, Body Content Type<\/strong> supports JSON<\/strong>, Form URL Encoded<\/strong>, and Raw<\/strong>. The default content type is JSON. The Specify Body<\/strong> field offers Using JSON<\/strong> and Using Fields Below<\/strong>.<\/p>\n\n\n\n\n

  • Using JSON:<\/strong> Enter the request content in Body<\/strong>. This field supports workflow tokens. JSON content is sent with an application\/json content type unless you explicitly provide a Content-Type header.<\/li>\n\n\n
  • Using Fields Below:<\/strong> Add name\/value pairs under Body Parameters<\/strong>. Rows without a field name are skipped. JSON and raw modes build an object from the pairs; Form URL Encoded creates a URL-encoded body.<\/li>\n\n\n
  • GET and HEAD requests do not send a body through this action, even if body settings are enabled.<\/li>\n\n\n\n\n\n

    Screenshot to add: HTTP Request body settings with Send Body, Body Content Type, Specify Body, and Body Parameters<\/p>\n\n\n\n

    Understand optional authentication<\/h2>\n\n\n\n

    The action applies a selected connection to the Authorization<\/strong> header. Username & Password<\/strong> uses HTTP Basic authentication. Bearer Token<\/strong> and API Key<\/strong> both become Authorization: Bearer \u2026<\/code> in this action. If an API expects its key in a custom header or query parameter, configure that in Headers<\/strong> instead. Do not assume the HTTP action supports the Google OAuth flow just because OAuth 2 is available as a connection type for Google Sheets.<\/p>\n\n\n\n

    Use safe URL settings<\/h2>\n\n\n\n

    Allow local\/unsafe URLs<\/strong> defaults to disabled. When it remains disabled, the action uses wp_safe_remote_request()<\/code> to apply WordPress URL safety checks. Enabling the setting switches to the regular request function and bypasses that protection against internal network hosts. Leave it disabled in production unless you have a specific, reviewed need to reach a local or private destination.<\/p>\n\n\n\n

    Read the response<\/h2>\n\n\n\n

    The action uses a 15-second timeout. A transport-level WP_Error<\/code> returns success: false<\/strong> and an error message. Otherwise, it returns success: true<\/strong>, status_code<\/strong>, and the response body<\/strong>. The action does not treat every non-2xx HTTP status as a failure; inspect status_code<\/strong> and the response body in your workflow before assuming the remote operation succeeded.<\/p>\n\n\n\n

    Use trusted endpoints, avoid sending secrets in URLs, and do not include authentication values in messages or downstream outputs. For details on saved credential handling, see Manage Workflow Connections<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Call an external endpoint from a workflow using an HTTP request action.<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":151,"menu_order":0,"template":"","class_list":["post-159","doc","type-doc","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc"}],"about":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/types\/doc"}],"version-history":[{"count":2,"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/159\/revisions"}],"predecessor-version":[{"id":895,"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/159\/revisions\/895"}],"up":[{"embeddable":true,"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/doc\/151"}],"wp:attachment":[{"href":"https:\/\/dragwyb.com\/docs\/wp-json\/wp\/v2\/media?parent=159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}