The step that calls another system over HTTP: setting it up with a connection or a full URL, headers, body, response mappings, branches by response, timeout and retry settings, the Try it panel and the security limits.
Last updated: September 30, 2026
The answer to "my order number is 4821, where is it?" is not in the panel — it is in your shipping or order system. The External request step calls that system from inside the flow, takes information out of the answer, and, if you want, branches the flow on what came back. This guide covers every field of the step, the two ways to set it up, the security limits and the Try it panel.
In this article you will find:
⚠️ Note: This step needs the other system to have an API (an address that can be called from outside). If you do not know whether yours has one, ask your developer or your provider; you cannot produce that address yourself from the panel.
The step sends an HTTP request to the address you give it and waits for the answer. It writes the values you pick out of that answer onto the contact card; if you want, it splits the flow into different branches depending on what the answer contains.
Typical uses: looking up an order status, checking stock, booking a slot in an appointment calendar, writing a contact into your own CRM, generating a coupon code.
The step sends nothing to the person and works on both channels.
The Target setting offers two roads, and the one you take changes the rest of the fields.
You pick a ready-made connection defined once under Portfolio settings › Connections. The address, the credentials (key, token) and the default headers come from there; in the step you only write the Path.
This road has two big advantages: the secret never enters the flow (copy the flow and the key is not copied with it), and when the key changes you update it in one place.
If the account has no connection defined, the panel says "No connection is defined for this account" and points you to Portfolio settings.
The old way: you write the whole address into the URL field. It is enough for public endpoints that need no connection and no credentials.
GET or POST.
Visible only while "write a full URL" is selected. It must start with https://. Placeholders are allowed.
If it is empty or does not start with http(s), the pre-publish check raises an error.
Visible only while a connection is selected, at most 400 characters. It is appended to the connection's base address: /order/{{field.order_no}}, for example. Placeholders are allowed.
The leading slash makes no difference; order/5 and /order/5 produce the same address. Two ways of writing it get a warning: pasting a full URL (it is appended after the connection's address and does not go where you expect) and using .. in the path (it climbs out of the connection's address).
The HTTP headers added to the request, at most 5. You add them with Add header; every row has a Name and a Value.
Some header names are not sent: host, content-length, connection, transfer-encoding, cookie, authorization and authorization-proxy. These change the identity of the request itself or the limit on its body.
⚠️ Note: The
Authorizationheader used for credentials cannot be written by hand; if you write it, it is not sent and the check warns you. Credentials now come through Portfolio settings › Connections. The reason is security: your key is never written into the flow's JSON.
Sent on POST only, at most 4,000 characters. You can write JSON or plain text. Placeholders are allowed.
If the body is JSON (it starts with { or [), placeholders are filled in with JSON escaping: a quotation mark the person typed does not break the body.
How many seconds to wait for the answer: between 1 and 30, 10 by default. The whole request (redirects included) fits inside that budget. If the time runs out, the flow continues from the Timed out output.
How many times to retry on a network error or a server error (5xx): between 0 and 3, 0 by default. Applied to GET only.
If the answer is JSON, you can take values out of it and write them onto the contact card. You add rows with Add mapping; every row has two fields:
data.id, items.0.name. Left empty, the whole answer (trimmed) is written.There can be at most 10 mappings. A row with a path written but no field selected is ignored; the check shows this as a warning. Writing two mappings into the same field also gets you a warning.
If the path is not in a valid format (a typo), the check raises an error and blocks publishing.
The step can split the flow on the answer that came back. With Add branch you add at most 5 branches; every branch has four fields:
The first matching branch wins. If none of them hold, the flow continues from the Then output.
If you leave the expected value empty on an operator that needs one (all of them except is empty and is filled), the check raises an error: that branch would never match.
The step's settings panel has a Try it section. Here you run the request without going live.
⚠️ Note: A POST trial can create a real record in the other system. The panel asks you about this and waits for your confirmation. On an endpoint that creates an order, a payment or a registration, use a test-environment address.
The step's outputs are:
If you decide not to connect the branches and the error outputs, the run ends without a reason recorded; the check lists unconnected branches as a warning.
Because this step calls out from your server to the outside world, it is protected on top of everything else:
localhost, .local, .internal, private IP ranges) are refused. This stops the server from being forced to call its own internal services.An e-commerce business wants to automate the "where is my order" question.
shipping to the Start step.order_no./order/{{field.order_no}}, Timeout 10, Retries 1.data.status → shipping_status, data.tracking_no → tracking_no.data.status equals delivered) and On its way (data.status equals on_the_way).Writing the key into the Authorization header by hand. It is not sent. Move the credentials to Portfolio settings › Connections.
Leaving the error branches unconnected. The other system is not always up; the person is left without an answer.
Guessing the response path. If you do not know whether it is data.status or result.status, look at the answer in the Try it panel and click the path.
Trying a POST against the real system. A trial can create a real record. Use a test-environment address.
Pushing the timeout to 30 seconds. It keeps the person waiting a long time and slows the queue down. Most endpoints answer in under 10 seconds.
Setting retries on a POST. They are applied to GET only; the value you wrote on a POST does nothing.
Writing the address of your own local server. Internal network addresses are refused.
Writing the whole answer into one field. Leave the path empty and a trimmed version of the body goes into the field; it comes out as unreadable text. Pick the value you need with a path.
authorization included).For the simple version of splitting the road on an answer, see The Condition step; to use what you received inside a message, see Variables and placeholders. If the step does not work, The external request step is not working walks through the reasons, starting from the run log.
The External request step turns your automation from a tool that gives ready-made answers into one that knows your data.
Was this article helpful?