Calling a Web Service

What the Step Does

The Call a Web Service step lets a workflow talk to any outside service that has a web address and a key, such as your hosting company or another business system. You pick one of your own connections, say what to ask for, and the step makes the call (action core.web_call).

A step has these parts:

• Connection: one of the connections you added in Settings, Connections. The step uses its address and its key. You never type a key into a step, and a workflow that has one in it is not saved.
• How: Get, Post, Put, Patch, or Delete. Get is the start.
• Path: where on the connection's address to go, like /v1/sites. It always starts with a slash and stays on the connection's own address, so a step can never send your key to a different place.
• Query: extra names and values added to the address, up to 20.
• Headers: extra names and values sent with the call, up to 10. Headers that carry a key or sign-in (Authorization, Cookie, and any name that sounds like a key) are not allowed here, because the key comes from the connection.
• Body: what to send with a Post, Put, Patch, or Delete, as text or a list of fields, up to 100,000 characters.
• Stop when the service refuses: on by default. Turn it off to keep going with the answer's status, so a later check can choose what to do (for example, when a 404 means "not there yet").

Values from earlier steps can be used in the path, query, headers, and body like in any other step.

In the Builder

In a workflow's Build tab, Add a Step, then choose Call a Web Service. The pop up has the connection (you see its address under it), What to Do (Get, Send, Change, Change Part of It, or Remove information), the path, Add to the Address, Information to Send (name and value pairs, each value typed or taken from an earlier step), Extra Headers, Keep Going if the Service Refuses, and how many times to try again. Only your own connections are listed. The step's row in the builder shows the connection, what it does, and the path. Test Run checks the step and says it would call; it sends nothing.

Where the Key Goes

The connection says where its key goes: in a header you named (such as X-API-Key), as a bearer token, as a user name and password, or in the address. The key stays sealed in your account and is opened only for the moment of the call. It is never shown, never kept in a run, and never put in an error message, even if the service repeats it back.

Only connections you added yourself can be used here. Connections for a known service, such as Stripe, are used by their own apps only, so a workflow can never charge a card or reach an AI agent connection.

What Happens When It Does Not Work

• The step waits 15 seconds for an answer.
• If the service is busy or does not answer (a 408, a 429, a 5xx, or no answer), the step is tried again after 1 minute, 5 minutes, 30 minutes, then 2 hours, as many times as its retries allow (3 by default). Every try of a step that changes something carries the same Idempotency-Key, so a service that honors it does the work once.
• Any other refusal, such as a 401 or a 404, fails the step at once with the status, for example "The service answered 401: the sign-in was not accepted." Nothing else from the service is kept.
• An address that is on a private network, or that does not start with https://, is never called.

What Is Kept

The run keeps the status, whether the call worked, the size of the answer, and the answer's top level numbers, yes or no values, and ids, so later steps can use them. It never keeps the answer's text. Each try counts 1 in Background work, like any step that does something. Test Run checks the connection and the step and says it would call, and sends nothing.

Who Can Use It

Owners, admins, and anyone whose role allows managing workflows. AI agents and API keys never save or turn on a workflow.