HTTP requests

An API request destination (type http) calls any HTTP API with a request you design — create a lead in your CRM, open a ticket, post to Slack — in the background, with retries. Tokens stay in workspace secrets, never in the decision.

Configure itCopy Anchor Link

{
  "key": "create_lead",
  "type": "http",
  "when": { "conditions": [{ "field": "route", "on": "output", "operator": "eq", "value": "sales" }] },
  "params": {
    "email": { "from": "state.email", "required": true },
    "score": { "from": "composites.lead_score" }
  },
  "http": {
    "method": "POST",
    "url": "https://api.crm.example.com/v2/leads?source={{decision.slug}}",
    "headers": [{ "name": "Authorization", "value": "Bearer {{secrets.CRM_TOKEN}}" }],
    "body": "{\"email\": {{params.email}}, \"score\": {{params.score}}, \"note\": \"Routed to {{result.route}} by Dcision\"}"
  }
}

The bodyCopy Anchor Link

The body is a JSON template: outside quotes a variable becomes a JSON value, inside quotes it becomes text — see JSON bodies. With the destination above, the CRM receives:

{ "email": "ana@acme.com", "score": 0.8414, "note": "Routed to sales by Dcision" }

• No body template on POST, PUT or PATCH: the params are sent as a JSON object.
• Content-Type: application/json is set unless you add your own Content-Type header.
• GET and DELETE have no body — a body on them is a schema error. Their params are added to the query string (?email=ana%40acme.com&score=0.8414), unless the URL already uses {{params.…}}.

HeadersCopy Anchor Link

Your headers are sent with Dcision's:

Some names are set by Dcision or the HTTP layer and can't be used: Host, Content-Length, Connection, Transfer-Encoding, Upgrade, Keep-Alive, TE, Trailer, Expect, and any name that starts with Proxy- or Dcision-.

AuthenticationCopy Anchor Link

Put credentials in a header with a secret — Authorization: Bearer {{secrets.CRM_TOKEN}} — or in the URL as a secret when the API expects a secret URL ({{secrets.SLACK_WEBHOOK}}). Credentials in the URL itself (https://user:password@…) are refused.

The signatureCopy Anchor Link

API requests are signed like webhooks, over the exact body sent — an empty body for GET and DELETE. If the receiving API is yours, verify Dcision-Signature with verifySignature (TypeScript) or verify_signature (Python): the body is your template, not a webhook event. See Verify the signature.

Example: a Slack messageCopy Anchor Link

Slack's incoming webhooks expect their own JSON, so use an API request with the webhook URL stored as a secret:

{
  "key": "escalation_alert",
  "type": "http",
  "when": { "actions": ["escalate"] },
  "params": { "message": { "from": "state.message" } },
  "http": {
    "method": "POST",
    "url": "{{secrets.SLACK_WEBHOOK}}",
    "body": "{\"text\": \"{{decision.slug}} asks for a person ({{action}}): {{params.message}}\"}"
  }
}

The message is written inside quotes, so the param is inserted as escaped text — quotes and line breaks in the lead's message can't break the JSON.