Generic HTTP action

The generic HTTP action is how systems without a native connector participate in workflows. It is registered like any other action: with an input schema, a credential reference, a read-or-write classification and a blast-radius descriptor.

Registering an endpoint

You register a specific operation, not a general-purpose HTTP client. The method, URL template, headers and body shape are part of the action definition; the workflow supplies only the declared inputs.

action: ipam.allocate_address
method: POST
url: https://{{ env.IPAM_HOST }}/api/v2/addresses
credential: ipam_api_token
mutates: true
retry_safe: false
blast_radius: 1
inputs:
  subnet_id: { type: string, required: true }
  hostname:  { type: string, pattern: "^[a-z0-9-]{1,63}$" }
response:
  address: $.data.address
  id:      $.data.id

Response mapping

Mapped response fields become typed outputs available to later steps. Unmapped response content is retained in run history for troubleshooting but is not available as workflow data, so a change in an upstream API cannot silently alter a workflow's behaviour.

Why inputs are constrained

Input patterns and types are validated before the request is made. This matters most when the value originated in untrusted text — a ticket body, an alert annotation — because validation is what stops that text from reaching an API as something it was not meant to be.