# HTTP & Webhook Actions

The `http` family makes outbound HTTP calls to external APIs (optionally authenticated via a stored connection). The `webhook` family sends signed outgoing webhooks and writes a custom response back to an inbound webhook trigger.

## HTTP — Outbound Requests

Six operators. The generic `request` operator takes an explicit `method`; the verb operators (`get`/`post`/`put`/`patch`/`delete`) are shorthands and accept a `connection` reference for authenticated calls.

| Operator  | Key props                                                                                | Description                                            |
| --------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------ |
| `request` | `url`, `method`, `headers?`, `body?`, `contentType?`, `timeout?`, `expectedStatus?`      | Generic request with an explicit method (templatable). |
| `get`     | `url`, `headers?`, `timeout?`, `expectedStatus?`, `connection?`                          | HTTP GET.                                              |
| `post`    | `url`, `headers?`, `body?`, `contentType?`, `timeout?`, `expectedStatus?`, `connection?` | HTTP POST.                                             |
| `put`     | _(same as post)_                                                                         | HTTP PUT.                                              |
| `patch`   | _(same as post)_                                                                         | HTTP PATCH.                                            |
| `delete`  | `url`, `headers?`, `body?`, `timeout?`, `expectedStatus?`, `connection?`                 | HTTP DELETE.                                           |

| Shared prop      | Description                                                                                                       |
| ---------------- | ----------------------------------------------------------------------------------------------------------------- |
| `url`            | Request URL (templatable).                                                                                        |
| `headers`        | Map of request headers (values templatable, e.g. `Authorization: 'Bearer $env.API_KEY'`).                         |
| `body`           | String or JSON object body.                                                                                       |
| `contentType`    | `json` (default) / `form` / `text` / `xml`.                                                                       |
| `timeout`        | Per-request timeout in ms.                                                                                        |
| `expectedStatus` | Array of acceptable HTTP status codes; anything else fails the step.                                              |
| `connection`     | Name of a stored [connection](/en/docs/automation-connections) — injects OAuth2/API-key/basic/bearer credentials. |

```yaml
- name: createContact
  type: http
  operator: post
  props:
    url: 'https://api.crm.example/contacts'
    connection: crm-oauth
    contentType: json
    body: { email: '{{trigger.data.email}}', name: '{{trigger.data.name}}' }
    expectedStatus: [200, 201]
```

:::callout
**Use `connection` instead of inlining secrets.** When a `connection` is referenced, Sovrium attaches the right `Authorization` header and (for OAuth2) refreshes tokens automatically. Define connections under `app.connections`. See [Connections](/en/docs/automation-connections).
:::

## Webhook — Outgoing & Response

Two operators. `send` fires a signed outgoing webhook; `response` writes the HTTP response for an automation started by a **webhook trigger**.

| Operator   | Props                              | Description                                                                  |
| ---------- | ---------------------------------- | ---------------------------------------------------------------------------- |
| `send`     | `url`, `event`, `data?`, `secret?` | Send an outgoing webhook with an `event` name and optional HMAC `secret`.    |
| `response` | `status?`, `body?`, `headers?`     | Set the HTTP response returned to the inbound caller (webhook-trigger only). |

```yaml
# Notify a downstream service
- name: notifyDownstream
  type: webhook
  operator: send
  props:
    url: 'https://hooks.example.com/orders'
    event: order.created
    data: { id: '{{trigger.data.id}}' }
    secret: $env.OUTGOING_WEBHOOK_SECRET

# Reply to the inbound caller
- name: ack
  type: webhook
  operator: response
  props: { status: 200, body: { ok: true } }
```

:::callout
**Inbound vs outgoing vs table webhooks.** The `webhook` **trigger** receives inbound HTTP (see [Triggers](/en/docs/automation-triggers)). The `webhook/send` **action** posts outgoing HTTP from a running automation. Separately, [table webhooks](/en/docs/table-webhooks) fire automatically on record create/update/delete without an automation. The `webhook/response` action only applies to automations started by a webhook trigger.
:::

## Related Pages

- [Connections](/en/docs/automation-connections) — OAuth2, API key, basic, bearer credentials.
- [Environment Variables](/en/docs/automation-env-vars) — `$env` secrets used in headers.
- [Triggers](/en/docs/automation-triggers) — the inbound webhook trigger.
- [Table Webhooks](/en/docs/table-webhooks) — automatic outgoing webhooks on record events.
- [Data & State Actions](/en/docs/automation-data-actions) — transforming HTTP responses.