Expand description
The http workflow node: make an outbound REST call from a workflow —
GET/POST/PUT/PATCH/DELETE with headers, query, and a
json/body payload — and observe {status, ok, headers, body, json}. This
is also how a workflow emits a webhook (a POST to a URL). It runs on an
executor thread over the one SSRF-guarded HTTP client, so every outbound dial
in the daemon passes the same guard; the URL and body are already
template-rendered (render_spec) against the run’s data.
Security: the SSRF classifier guards the resolved host — private/loopback/
link-local targets are refused unless the node sets allow_private: true
(for a declared internal API). The guard resolves once and the dial takes the
addresses it vetted, so a name that answers the check public and the connect
private cannot rebind its way in. https:// verifies the server certificate.