On this page

REST call

Kind: RestCall
Configuration object: rest

Use REST call to interact with a public HTTPS API and pass its completed response to other steps. Review permissions and side effects before using a modifying method.

Inputs

Endpoint, header values, and body templates can read current and named inputs. Endpoint placeholders are URL-escaped automatically. They must stay under a fixed, approved public HTTPS origin.

For JSON content types, placeholders in JSON string values preserve their type when they occupy the whole value. An entire body can be {{input}} or a named placeholder to forward a JSON value. Embedded replacements are JSON-escaped. Other content types use text rendering.

Configuration

Property	Default	Usage
`method`	`"GET"`	Uppercase `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, or `OPTIONS`.
`endpoint`	`""`	Required public HTTPS URL.
`endpointName`	`""`	Optional Vault or packaged-host reference, resolved before invocation.
`allowEndpointSecrets`	`false`	Explicit approval for credential-bearing URL configuration.
`credentialName`	`""`	Optional runtime credential reference. Empty permits anonymous requests.
`authenticationHeader`	`"Authorization"`	Supported provider authentication header when a credential is used.
`authenticationPrefix`	`"Bearer "`	Empty or bearer prefix.
`tokenScope`	Unset	Optional Entra scope for credential resolution. Requires a credential reference.
`bearerToken`	Unset	Whole input placeholder for a runtime auth object's token, such as `{{auth.accessToken}}`. Literal token values are rejected.
`headers`	`{}`	At most 32 unique safe headers. Values support templates.
`contentType`	`"application/json"`	Valid media type used when a body exists.
`body`	`""`	Optional body text, at most 256 KiB. JSON content types require valid JSON or a whole placeholder.

When bearerToken is configured, leave credentialName empty and tokenScope unset, use Authorization, and keep authenticationPrefix exactly "Bearer ". This selects the token arriving through workflow data.

Outputs

Returns the completed response body. Valid JSON is exposed as a typed downstream value; ordinary text remains text. HEAD, HTTP 204, and HTTP 205 return an empty string. Status codes and headers are not added to an output envelope.

Non-success responses fail explicitly. Event streams and NDJSON are rejected by this step; use a Model step for supported streaming model protocols. Returned pagination URLs such as nextLink remain in the body and require another explicitly configured call.

Example

{
  "id": "fetch-order",
  "name": "Fetch an order",
  "kind": "RestCall",
  "outputName": "order",
  "rest": {
    "method": "GET",
    "endpoint": "https://api.example.com/orders/{{input.orderId}}",
    "credentialName": "",
    "headers": { "X-Request-Source": "workflow-preview" }
  }
}

With input {"orderId":"A 17"}, the request path ends in /orders/A%2017. For an authenticated API, configure the credential fields or connect an Entra ID Auth output as auth.

Operational notes

The HTTP transport must disable automatic redirects and cookies, avoid default credentials, and enforce the public-endpoint policy. The runtime performs no pagination traversal or response-shaped success fallback. Design modifying operations for the API's actual retry and idempotency contract.