Workflow HTTP request

The module implements http_request for public HTTPS APIs. Production registration is proposed separately in docs/ops/workflow-http-request-node-20261023/REGISTRATION-PROPOSAL.md; this branch does not activate it in the application.

Configure GET, HEAD, POST, PUT, PATCH or DELETE; an HTTPS URL on port 443; up to 30 query parameters and 20 headers; optional JSON body or text body with contentType. GET/HEAD bodies are refused. Serialized request bodies are capped at 256 KiB. Framing, cookie, host, authorization and proxy headers cannot be supplied directly. Timeout is 1–30 seconds (default 10). Responses default to JSON, fall back to text with parseError for invalid JSON, and cap at 256 KiB by default (maximum 1 MiB), marking truncated. Only content-type, content-length, etag, location, retry-after and x-request-id response headers survive. HTTP status 400+ fails by default; set failOnStatus false to inspect such responses in later steps.

Credentials reference an org-scope vault secret readable by the workflow author. Bearer and basic use Authorization; basic secret content is username:password. Header/query placements require a name. The module rechecks current membership and vault view access at claim and logs the plaintext read. Personal, project and foreign-org secrets are refused. Plaintext, URL-encoded and base64 credential reflections are removed from returned body/headers, including keys. Errors contain only stable codes, never network/ORM messages. Configure structured data mapping before staging; this module accepts resolved configuration and does not evaluate expressions.

A live node stages a waiting step and wait row in the CRM transaction. Dry run records a planned method and URL only. The reconciler commits sending plus attemptId before any network request. Each connection resolves every DNS answer, rejects any private/special address, and pins the approved address while retaining hostname TLS verification. At most three redirects are followed; each hop is checked again and a host change permanently removes vault credentials. 303 changes the method to GET (except HEAD); other redirects preserve it. There are no automatic HTTP-level retries.

The request deadline includes DNS, redirects and response streaming. A lease lasts that deadline plus five seconds so an overlapping sweep cannot resend an active request. After a crash, an expired sending step without output is unknown. POST/PUT/PATCH/DELETE fail with http_unknown and are never resent. GET/HEAD may be recovered once; a second unknown attempt fails. Transport errors and timeouts end the step without replay. Safe failure codes include http_timeout, http_blocked_target, http_error and http_status_N. Stop/edit committed before claim prevents sending. Stop after claim cannot recall an external effect; the eventual output remains visible but continuation is cancelled.

Completion records output and resumes in a new transaction. Continuation still requires existing author, version, enablement and conditions checks. A lost completion commit leaves sending state, subject to the conservative unknown policy. No migration is needed: state lives in existing text statuses and JSON step results; waits retain their existing status constraint.

Reference behavior: n8n HTTP Request. Transport API: Node HTTPS request. This capability deliberately restricts destinations and automatic recovery beyond n8n's general HTTP configuration.