Web request
Fetch a URL on each trigger under the network allowlist; secrets come from a vault slot, never the Toy.
- Web
- Since 0.2.0
- web
- http
- fetch
- api
- json
- request
- network
- data
Web request fetches a URL and sends the response into the Patch: parsed JSON, text or bytes, with the HTTP status, an error message and a done trigger.
What it does#
With trigger cabled, each trigger sends one request; without it, a new url on the input sends one. One request is in flight at a time; triggers that arrive meanwhile collapse into one more request. The URL comes from the url input or the node's url field, https: only (http: only for localhost). Header rows and a headers JSON object are added; credential headers such as Authorization or Cookie are refused.
Where the request goes is decided by policy, never by the Toy:
- Direct from the browser (no cookies, CORS mode) only when the host is in your network allowlist (Settings → Network) or belongs to an enabled
directaddon. - Proxy through Tune.Toys (
POST /v1/proxy/request) for every other host, which needs sign-in. The proxy refuses private, loopback and metadata addresses after DNS, re-checks redirects and caps responses at 5 MiB and 20 seconds. - Keys never reach the browser. The
authfield names a vault slot such assecret:openai; the proxy injects the value on the server, and only to that addon's hosts. A Toy that uses a slot requires it, and the Play surface shows a chip until you add your key (secrets).
Web request runs in the browser's data runtime; the Player and exports report the data domain unavailable. During replay it does not fetch: the recorded responses are played back.
When to use it#
Use it for any HTTP API that has no addon node yet. For the services in Settings → Addons prefer their typed nodes, such as Open-Meteo forecast, which build the URL for you. Follow it with Convert to pick fields.
Ports#
| Port | Direction | Signal | Lanes |
|---|---|---|---|
trigger | Input | Data (trigger) | 1 |
url | Input | Data (string) | 1 |
body | Input | Data (any) | 1 |
headers | Input | Data (json) | 1 |
response | Output | Data (any) | 1 |
status | Output | Data (integer) | 1 |
error | Output | Data (string) | 1 |
done | Output | Data (trigger) | 1 |
Parameters#
| Parameter | Label | Range | Default | Unit | Scale | Notes |
|---|---|---|---|---|---|---|
method | Method | 0 to 4 | 0 | linear | HTTP method. Choices: 0 GET, 1 POST, 2 PUT, 3 PATCH, 4 DELETE. | |
parse | Parse | 0 to 3 | 0 | linear | How the response body is read; Auto follows the content type. Choices: 0 JSON, 1 Text, 2 Bytes, 3 Auto. | |
auth_in | Auth in | 0 to 1 | 0 | linear | Where the vault secret named by auth is placed by the proxy. Choices: 0 Header, 1 Query. | |
timeout | Timeout | 1 to 20 | 10 | s | linear | Seconds before the request fails with an error. |
route | Route | 0 to 2 | 2 | linear | Direct needs an allowlisted host that answers CORS; Auto falls back to the proxy. Choices: 0 Direct, 1 Proxy, 2 Auto. | |
retries | Retries | 0 to 3 | 0 | linear | Extra attempts after a network failure or a 5xx response. |
url: url.headers: headers.auth: requirement.
Method (method)#
GET, POST, PUT, PATCH or DELETE. A cabled body is sent with every method except GET; objects are sent as JSON.
Parse (parse)#
JSON, Text, Bytes or Auto (by the response's content type). It sets the datatype of response. Bytes stay in memory and are never written into a take.
Auth in (auth_in)#
Where the proxy places the vault secret named by auth: as an Authorization: Bearer header, or as a key query parameter.
Timeout (timeout)#
Seconds, 1 to 20, before the request fails with an error.
Route (route)#
Direct, Proxy or Auto. Auto tries the browser first for an allowlisted host and falls back to the proxy after a CORS or network failure. A request with auth always uses the proxy.
Retries (retries)#
Extra attempts, 0 to 3, after a network failure, a 429 or a 5xx status, with growing pauses between them.
Tips#
- Cable
errorinto a Console log: refusals explain exactly what to allow or sign in for. - An HTTP error status arrives on
statusanderror;responseonly carries successful bodies. - Respect the service's terms and rate limits. Use Cron with a long interval rather than a fast loop.
See also#
Web scrape, WebSocket, Convert, Secrets and the vault, Data cables.
Help patches
Each help patch is an ordinary Toy that teaches one idea. The diagram shows the Patch; the preview shows its Frame. Open it in TuneToys to play and edit it.
1. Fetch the weather
beginner Teaches: method, parse, route
Every minute a Web request fetches Open-Meteo, Convert picks the temperature and the Console logs it.
Connections as text
- Cron tick output connected to Web request trigger input
- Web request response output connected to Convert value input
- Convert value output connected to Console log “log” value input
- Web request error output connected to Console log “oops” value input
- GET, parsed as JSON. Auto tries the browser first for an enabled direct addon, then the proxy.
- Convert reads one field with a JSON pointer.
- Errors (refusals, timeouts, HTTP errors) arrive on error as text.
2. A keyed request
advanced Teaches: auth_in, timeout, retries
A request that names a vault slot; the proxy injects your key on the server and the Toy never holds it.
Connections as text
- Value value output connected to Convert value input
- Web request response output connected to Console log “log” value input
- Web request error output connected to Console log “oops” value input
- Convert value output connected to Web request url input
- auth names the slot secret:openai; the proxy sends it as Authorization: Bearer.
- Timeout 15 s; one retry after a network failure, 429 or 5xx.
Related nodes
- Convert Convert a value to another datatype, optionally picking a field or formatting a string; failures go to error.
- Console log Write each incoming value to the Console panel with a level and label, rate-limited.
- Web scrape Fetch a page through the proxy and extract text, rows or links with a CSS selector; scripts never run.