Workflow actions

Send HTTP request

This Workflow Companion action allows you to send HTTP requests to a specified URL and handle the response.

Configuration

Action Parameters

  • URL (required): The endpoint to which the HTTP request will be sent. You can use variables to dynamically set the URL.
  • Body: The request payload, if applicable. For JSON payloads, you may find it convenient to prepare the data using the Run code action.

Request configuration

  • Method: The HTTP method for the request (GET, POST, and so on...)

  • Content type: The media type of the request body.

  • Authentication: The type of authentication for the request. Available options:

    • None: No authentication.
    • Shared credential: Use a saved credential from the app settings (Settings → Send HTTP Request Auth). A shared credential can be reused across multiple actions.
    • Custom: Configure authentication inline for this specific action. Credentials are stored per-action.

    When using Shared credential or Custom mode, the following authentication types are available:

    • Basic: Username and password
    • Bearer token: A bearer token sent in the Authorization header
    • Custom header: A custom header name and value

  • Additional headers: Custom key-value headers appended to the request.

Response configuration

  • Retry on: Conditions under which the request should be retried. Available options:

    • Too many requests (429 HTTP status code): Retry if the server indicates too many requests.

  • Fail workflow on: Conditions under which the workflow should fail. Available options:

    • 3XX HTTP status codes: Fail on redirection status codes.
    • 4XX HTTP status codes: Fail on client error status codes.
    • 5XX HTTP status codes: Fail on server error status codes.

  • Data transformation: You can enable this option to customize the response using JavaScript. This is useful in cases where:

    • The HTTP response body is too large and exceeds Shopify Flow's allowed limits (you may see a "Response too large" error) — you can extract only the necessary data to reduce its size.
    • You want to enrich or modify the response by including information from the response headers.

    When enabled, you can write a JavaScript function like this:

    export default function ({ body, status, headers }) {
  // transformation code
  return {
    /* your transformed data */
  };
}

    The function may return either a string or any JSON-serialisable value. The input parameter is an object with the following properties:

    • body: The raw response body (string)
    • status: The HTTP status code (number)
    • headers: An object containing all response headers

Security

Authentication credentials — passwords, tokens and custom header values — are stored encrypted and never shown in the UI after saving. Additional headers aren't credentials: put tokens and keys under Authentication.

A redirect keeps the headers you set, authentication included, when it leads to the same host or one of its subdomains without moving from HTTPS to HTTP; any other redirect drops them. A redirect that sends the body on keeps the Content type.

Output

The action returns the following fields:

  • body: The response body. Can be parsed in a Run code action for structured data processing.
  • ok: Indicates if the request was successful (status in the range 200-299). Can be used in conditions for further response handling.
  • status: The HTTP status code of the response. Can be used in conditions to handle different response scenarios.