Web request

Call any HTTP API. The workhorse Act step: templated URL, headers, and body; the decoded response becomes the next step's payload.

Config

Method, URL, headers, body, timeout.

• Method + URL: the URL is template-rendered, https://api.example.com/users/{{ payload.id }}.
• Auth: a credential never goes in a header literally. Store it in the workspace's Secrets and reference it: Authorization: Bearer {{ secrets.API_TOKEN }} or X-Api-Key: {{ secrets.API_KEY }}. For HTTP Basic, store the base64 of user:password and send Authorization: Basic {{ secrets.BASIC }}. The value is filled in only while the step runs and scrubbed from the output; public endpoints need nothing.
• Headers / body: both template-rendered. The body is only sent for POST / PUT / PATCH; JSON or plain text.
• On failure: 2xx routes ok; non-2xx or a transport failure fails the run by default. Set continue to route a {ok: false, error} payload out the error port instead.

Output

The next step's payload is the decoded response body, with no wrapper. A GET returning {"fact": "..."} → {{ payload.fact }}.

Two special cases:

• A bare JSON array (or scalar) response is wrapped as {"value": [...]}, because payloads are always maps. Loop over payload["value"].
• Status and headers aren't on the payload; when you need them, they're on the raw output by step id: steps.<id>.output.status.

Patterns

• Fetch → understand → act: the canonical chain, web request → AI step → send.
• Scrape: GET a page → extract HTML.
• Fan out: fetch a list → loop over payload["value"] → fetch each detail.

Gotchas

• Never leave a templated URL segment that can render empty. …/users/{{ payload.id }} with a missing id produces a malformed path, and many APIs answer those with misleading 403s, not 404s.
• Reference the field that holds the API's answer, not the value you sent (an FX response's rates.USD, not your amount).