Skip to main content

Use the http_call action

Learn how to send HTTP requests to third-party services using the http_call action​

The http_call action enables you to call a trusted third-party API passing sensitive data without that data being exposed within Vault.

Overview​

The steps you take to invoke the http_call action are:

Step-by-step​

You want to email the customer, Jane Doe, using the send_email operation at api.example.com. The customer's object has this structure:

{
  "id": "bb5e17ce-38b1-4b3f-9b4b-40801f9672d1",
  "first_name": "Jane",
  "last_name": "Doe",
  "email": "jane.d@example.com"
}

The email API expects a request with this structure:

POST https://api.example.com/send_email?to=jane.d@example.com
Content-Type: application/json

{"message":"Hello Jane Doe!"}

You defined the request body for the call like this:

{
  "template_variables": {
    // Map the `customer` variable to a Vault global identifier referencing the customer's object in the `customers` collection by its ID.
    "customer": "pvlt:read_object:customers::bb5e17ce-38b1-4b3f-9b4b-40801f9672d1:"
  },
  "request": {
    "method": "POST",
    // Use the `customer.email` property as the `to` query parameter.
    "url": "https://api.example.com/send_email?to={{ .customer.email | unescape_quotes | urlquery }}",
    "headers": {
      "Content-Type": "application/json"
    },
    // Use the `customer.first_name` and `customer.last_name` properties in the `message` property of the request body.
    "body": "{\"message\":\"Hello {{ .customer.first_name }} {{ .customer.last_name }}!\"}"
  }
}

You now call the invoke http call action like this:

curl -s -X POST \
  --url 'http://localhost:8123/api/pvlt/1.0/data/actions/http_call?reason=AppFunctionality' \
  -H 'Authorization: Bearer pvaultauth' \
  -H 'Content-Type: application/json' \
  -d '{
  "template_variables": {
    "customer": "pvlt:read_object:customers::bb5e17ce-38b1-4b3f-9b4b-40801f9672d1:"
  },
  "request": {
    "method": "POST",
    "url": "https://api.example.com/send_email?to={{ .customer.email | unescape_quotes | urlquery }}",
    "headers": {
      "Content-Type": "application/json"
    },
    "body": "{\"message\":\"Hello {{ .customer.first_name }} {{ .customer.last_name }}!\"}"
  }
}'

You get a response that returns the response from the HTTP call, similar to this:

{ "status_code": 200 }

On this page