Struct HttpRequest 

pub struct HttpRequest {
    pub url: String,
    pub headers: Vec<(String, String)>,
    pub abort_signal: Option<AbortSignal>,
    pub call_id: Option<String>,
    pub recording_context: Option<RecordingContext>,
    pub response_timeout: Option<Duration>,
    pub max_json_response_bytes: Option<usize>,
    pub validate_url: bool,
    pub trusted_origin: Option<String>,
    pub credentialed_origin: Option<String>,
}

Metadata shared by post_json_to_api, post_form_data_to_api, post_to_api, and get_from_api. Method and body are fixed by the helper signature rather than supplied as runtime fields.

Fields

url: String

headers: Vec<(String, String)>

abort_signal: Option<AbortSignal>

call_id: Option<String>

recording_context: Option<RecordingContext>

response_timeout: Option<Duration>

Per-exchange whole-response hang guard. None uses the 30s default; a provider whose endpoint legitimately holds the connection longer (e.g. Replicate prefer: wait) declares its own bound here. Streaming exchanges are exempt regardless.

max_json_response_bytes: Option<usize>

Per-request override of the successful-JSON-body size cap (default crate::read_response_with_size_limit::DEFAULT_MAX_JSON_RESPONSE_SIZE). Only consulted by crate::response_handler::create_json_response_handler; binary downloads keep the separate, larger DEFAULT_MAX_DOWNLOAD_SIZE bound regardless of this field.

validate_url: bool

AI SDK validateUrl: set for URLs taken from provider responses (generated assets, polling and result URLs). The exchange then goes through the SSRF download guard — target and every DNS answer validated and pinned, redirects followed manually with each hop re-validated.

trusted_origin: Option<String>

AI SDK trustedOrigin: a developer-configured origin (normally the provider’s base_url) whose same-origin URLs are exempt from the address blocklist, so self-hosted deployments serving assets from their own (possibly private) origin keep working. Reachability only — never about headers, and never derived from response data.

credentialed_origin: Option<String>

AI SDK credentialedOrigin: caller headers (which may carry the provider API key) are sent only while the target is same-origin with this value — from the first request and on every redirect hop. None means the caller gates its own headers (e.g. BFL’s host allowlist).

Implementations

impl HttpRequest

pub fn new( url: impl Into<String>, headers: Vec<(String, String)>, options: &impl ExchangeContext, ) -> Self

A plain exchange that inherits the operation’s cancellation and recording context. Downloads of provider-supplied URLs set the guard fields explicitly instead.

Trait Implementations

impl Clone for HttpRequest

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HttpRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HttpRequest

fn default() -> Self

Returns the “default value” for a type.