Sobmit Docs

HTTP Request node

HTTP Request node card

The HTTP Request node makes a real HTTP request to a URL and forwards the response downstream. It runs server-side (never in the browser), so there is no CORS limitation.

Configuration

  • Method — GET, POST, PUT, PATCH or DELETE.
  • URL — the full request URL. Not template-resolved; it is called literally.
  • Headers — key: value pairs, one per line.
  • Body — a JSON object sent as the request body (POST/PUT/PATCH).
  • Timeout — request timeout in milliseconds.

Example — POST JSON to an API

Method: POST
URL: https://api.example.com/v1/search
Headers:
  Authorization: Bearer sk-…
  Content-Type: application/json
Body: { "query": "hello" }

The response body (parsed as JSON when possible, otherwise raw text) becomes the payload for downstream nodes.

Test before you run

The inspector has a Test request button that executes the exact same request through the shared boundary, showing status, latency and response headers — so a test behaves identically to a live run.

Security

  • The request runs server-side through an SSRF guard: non-http(s) protocols are always rejected, and loopback/private/link-local hosts are rejected in production.
  • Secrets (like the bearer token above) belong in the node’s headers — they never leave the graph as plain environment values unless you put them there.

Notes

  • Use a Web Search or MCP node for search instead of hand-rolling an HTTP search call — those understand pagination and result shapes.

Related

  • Web Search — for search specifically.
  • MCP — for structured external tools.