Flows
HTTP requests
How to call an API from a LoCrew flow: method, URL, query, headers, body, saved keys, test requests, keeping values from the response, retries, limits, and the safety rules that block private addresses and unsafe redirects.
An HTTP request step sends one request from this computer. Values from earlier steps can go into the address, query, headers or body. The host is always the one you wrote, so no step's output can redirect the request elsewhere.
#Configure the request
| Field | Notes |
|---|---|
| Method | GET (default), POST, PUT, PATCH, DELETE or HEAD. GET and HEAD cannot have a body. |
| URL | Must start with https:// and a written-out host name. Values may only go in the path or query. Up to 4,000 characters. |
| Query parameters | Name and value rows, up to 32. Values accept placeholders. |
| Headers | Name and value rows, up to 32. |
| Authentication | None, Bearer token (Authorization header), or API key in a header (default header X-API-Key). |
| Body | None, JSON, Text (with a content type) or Form. Up to 100,000 characters. |
| Values to keep | Named values picked out of the response for later steps. |
| Fail this step on an error status (not 2xx) | On by default. Off: the status is passed on, so a condition can decide what to do. |
Insert values with the { } button. How they are encoded is described in Passing data.
#Saved keys
Keys are stored encrypted on this computer and are never shown again or saved in the flow.
- Choose an Authentication type.
- Under Saved key, choose New key, give it a Name (for example GitHub token) and paste the key.
- Press Save key.
A saved key can be reused by other HTTP steps. This version has no screen to rename or delete saved keys.
#Test the request and keep values
- Under Test request, fill in sample values for any placeholders.
- Press Send test request. The request is sent for real, so use a safe endpoint.
- The response appears as a tree. Click Keep on any value to add it to Values to keep.
Each kept value has a name and is taken from the body (by path, such as data.items.0.id), a header, or the status. Later steps use it as {{step.json.values.name}}, and a condition can read values.name. If a 2xx response lacks a kept value, the step fails: The response has no value for … Check the path in "Values to keep".
#Limits, retries and network
| Setting | Default | Range |
|---|---|---|
| Time limit (seconds) | 30 | 1 to 120 |
| Largest response (KB) | 1024 | 1 to 10,240 |
| Attempts | 1 | 1 to 5 |
| Allow local and private network addresses | Off | localhost, 192.168.x.x, 10.x.x.x and similar |
| Allow unencrypted http:// | Off | Anything sent, keys included, can be read on the network |
Retries. GET and HEAD are retried after a network error, a timeout, a 429 or a 5xx. Any other method is retried only if the request never reached the server, so it can never be applied twice. Retries wait 2 seconds, doubling, up to a minute.
#Safety rules
| Rule | Message |
|---|---|
| The host must be written out | The host must be written out: values from earlier steps may only go in the path or query. |
| No credentials in the URL | Put credentials in a saved credential, not in the URL. |
| HTTPS only | The URL uses unencrypted http://. Use https://, or allow insecure HTTP in this step. |
| No private addresses | … is a private address. Allow private network addresses in this step to call it. or … resolves to a private address (…). The address is checked when the connection is made, so a second DNS answer cannot slip past. |
| At most 5 redirects | More than 5 redirects. Credentials and cookies are dropped when a redirect changes site. |
| Size limit | The response is larger than … KB. A truncated body is never returned. |
| Time limit | No response within … s. |
| Error status | HTTP 404 Not Found (when Fail this step on an error status is on) |
Every request sends user-agent: LoCrew-Flows. Response headers that carry credentials are stored as [redacted], and the run trace shows saved keys as [credential].
#Output
| Value | Contents |
|---|---|
json.values.name | Each kept value |
json.status | Status code |
json.ok | Whether it was 2xx |
json.body | The body, parsed as JSON when it is JSON |
text | The body as text, up to 200,000 characters |
When an Agent step receives an HTTP step's output, it sees the kept values first, then the full response.
Note
The code labels an error status that is not retried (for example a 404, or any 4xx on a POST) and a response missing a kept value as Outcome unknown rather than a plain failure. Check the step's error message in the inspector for the real cause.