Member Junction
    Preparing search index...

    Class HTTPRequestAction

    Action that makes HTTP requests with full control over headers, authentication, and request options.

    The target URL is caller-controlled, so it is routed through SafeFetch, which blocks private/loopback/link-local/reserved addresses (including the cloud metadata endpoint) and re-validates every redirect hop to defeat DNS-rebinding / redirect SSRF bypasses.

    // Simple GET request
    await runAction({
      ActionName: 'HTTP Request',
      Params: [{
        Name: 'URL',
        Value: 'https://api.example.com/data'
      }]
    });

    // POST request with JSON body
    await runAction({
      ActionName: 'HTTP Request',
      Params: [{
        Name: 'URL',
        Value: 'https://api.example.com/users'
      }, {
        Name: 'Method',
        Value: 'POST'
      }, {
        Name: 'Body',
        Value: { name: 'John Doe', email: 'john@example.com' }
      }, {
        Name: 'Headers',
        Value: { 'Content-Type': 'application/json' }
      }]
    });

    Hierarchy (View Summary)

    Index

    Constructors

    constructor

    Properties

    AuthorizesCaller

    Accessors

    SupportsAudience

    Methods

    InternalRunAction Run

    Constructors

    Properties

    AuthorizesCaller: boolean

    True when the action authorizes its caller itself, so a public entry point such as the RunAction mutation may run it for an authenticated user without an MJ: Action Authorizations link. Set it only on an action that either checks an authorization the caller must hold, or reads and writes only with the caller's own permissions. Leave it false for an action that acts with more authority than its caller, or that reaches data or sends messages the caller chooses but could not otherwise reach.

    The engine reads the marker only from the class that runs, never from its parent classes. A subclass that overrides a marked action must declare the marker again.

    Accessors

    • get SupportsAudience(): boolean

      Whether this action can bound what it returns to an audience (RunActionParams.Audience): everyone besides the caller who will see its output, such as the other participants of a shared conversation.

      false by default, and the engine enforces it: when a run's audience adds a reader beyond the caller, ActionEngineServer.RunAction refuses the action with result code AUDIENCE_UNSUPPORTED, without running it. Override to return true only when the action honours the audience in full — every record, snippet and count it returns is something every reader may see (pass the audience to the search engine, check each reader's entitlement to anything it scopes by, and leave out aggregates computed before that filtering).

      Returns boolean

    Methods

    • Makes an HTTP request with configurable options

      Parameters

      • params: RunActionParams

        The action parameters containing:

        • URL: Target URL (required)
        • Method: HTTP method (GET, POST, PUT, DELETE, etc.) - default: GET
        • Headers: Object with request headers
        • Body: Request body (string or object)
        • BodyType: "json" | "form" | "text" | "binary" - default: "json"
        • Authentication: Auth config object { type: 'basic'|'bearer', username?, password?, token? }
        • Timeout: Request timeout in milliseconds - default: 30000
        • FollowRedirects: Boolean - default: true
        • MaxRedirects: Number - default: 5
        • ResponseType: "json" | "text" | "arraybuffer" - default: "json"

      Returns Promise<ActionResultSimple>

      Response object with status, headers, and body

    Settings

    Member Visibility

    On This Page

    Constructors
    Properties
    Accessors
    Methods