HTTP action plugin

One http.request action for any REST API — auth schemes, a secret store, retries, pagination, and an SSRF guard.

The http-action plugin exposes a single, full-featured http.request action so an agent or workflow can call Shopify, Stripe, a ticketing system, or any REST API — without a bespoke plugin per service.

Features

Every method (GET/POST/PUT/PATCH/DELETE/…)
Auth — bearer, basic, api-key, OAuth2 client-credentials, with secret refs so keys never live in the graph
Bodies — json, form, multipart, text, raw
Reliability — retries with backoff, timeouts, redirect control
Pagination — auto-aggregate (link-header / cursor / page)
Response — auto/json/text parsing + dotted-path field extraction
Connector presets — name a preset (shopify, stripe) and just pass path
SSRF guard — blocks localhost / private / metadata hosts

lookup an order

{
  "connector": "shopify",
  "method": "GET",
  "path": "/orders/${trigger.order_id}.json",
  "extract": "order.fulfillment_status"
}

Reference a secret inline: "X-Api-Key": "${secret.my_key}". The raw value never appears in the workflow graph.

The AI builder Writing a plugin