http_call

Outbound HTTP with templated url/body and optional HMAC signing.

- id: notify-backend
  http_call:
    url: ${BACKEND_URL}/hooks/trade
    method: POST
    headers:
      x-api-key: "${{ secrets.API_KEY }}"
    hmac: "${{ secrets.HOOK_KEY }}"
    body:
      trader: "${{ trigger.args.sender }}"
      amount: "${{ trigger.args.amount0 }}"
      src: "${{ trigger.tx_hash }}"

Fields

Field	Required	Description
`url`	✅	Templated request url
`method`		Defaults to `POST` when a `body` is set, `GET` otherwise
`headers`		Map of headers — values are templates
`body`		A YAML mapping rendered recursively — every string leaf is a template — then sent as JSON
`hmac`		Secret used to sign the request — see below

HMAC signing

When hmac: is set, rflow computes HMAC-SHA256 over the raw request body bytes (the empty byte string for body-less requests) and sends the lowercase hex digest as the x-rflow-signature header. Your backend verifies with the shared secret — typically one from secrets: so it never appears in logs.

# receiver side (python)
expected = hmac.new(key, request_body_bytes, hashlib.sha256).hexdigest()
assert hmac.compare_digest(expected, request.headers["x-rflow-signature"])

Output and failure mapping

A 2xx response succeeds with output:

{ "status": 200, "body": { ... } }

body is parsed as JSON when possible, kept as a string otherwise — so ${{ steps.notify-backend.output.body.some_field }} works against JSON APIs.

Non-2xx responses map into the failure taxonomy: 5xx and 429 are retryable (rate_limited / retryable kinds) under a retry: block; 4xx are terminal. Timeouts are rpc_timeout-class and retryable.

  retry:
    max_attempts: 3
    backoff: 10s