HTTP

Calls outside HTTP APIs with your own credentials, kept as connections. webhooks is the way requests come in; this module is the way out. Agents call it through its tools, workflows through a tool block.

The page in the app: API.

Connections

Each connection is an outside service: a name, a base_url, authentication (bearer, basic, a header like X-Api-Key, or a query parameter), common headers, an optional idempotency header, a timeout and a test path. Secrets are write-only. A request over a connection never carries its credentials to another host - redirects to other hosts go without them.

First presets ship built in: GitHub, Slack, Stripe (reads) and generic REST; your organization saves its own as reusable API blocks for the workflow editor.

What a request may reach

• Without a connection: only hosts allow names; empty by default, so an agent reaches only what a person set up.
• Private, loopback and link-local addresses are refused unless private_networks is set (the cloud never sets it).
• daily_limit requests a day (default 5,000); at most 16 in flight.
• Bodies up to 1 MiB out, 2 MiB in.

Tools

Tool	What	Effect
http_get	a GET or HEAD	read
http_request	any method, JSON/text/raw body, ok statuses, an optional expect schema the body must fit	external
http_connections / http_test	list connections (never a secret); test one	read
http_presets_*	list, get, save, delete presets	read / write
http_log	the log, newest first	read

A non-GET is an external action: the team’s trust decides whether an agent’s call waits for a person. Every call is logged (who, when, host, path, status) - never a header, query, body or secret; the log keeps 30 days.