Make any HTTP/HTTPS request to external APIs from within a Zafeguard workflow — custom headers, methods, body, and authentication.

API Call

API_CALL HTTP & APIs Workflow Component

The API_CALL component lets you make any HTTP/HTTPS request from within a workflow. Connect it to upstream components to pass dynamic values as headers, query params, or request bodies.

Inputs

Field	Type	Required	Description
`headers`	`object`	Yes	Key-value headers to include in the request. Use this to pass `Authorization`, `Content-Type`, or any other header.

Config

Field	Type	Required	Description
`apiUrl`	`string`	Yes	Target HTTP endpoint URL (e.g. `https://api.example.com/data`)
`method`	`'GET' \| 'POST' \| 'PUT' \| 'PATCH' \| 'DELETE'`	Yes	HTTP method for the request

Outputs

Field	Type	Description
`status`	`number`	HTTP response status code (e.g. `200`, `404`)

The full response body is available as a dynamic output variable. Configure the output mapping in the component detail panel to capture specific fields.

SDK example

import { WorkspaceClient, ComponentModule } from '@zafeguard/caller-sdk';

const workspace = new WorkspaceClient({ apiKey: process.env.ZAFEGUARD_API_KEY! });

const result = await workspace.call(ComponentModule.API_CALL, {
  headers: {
    Authorization: 'Bearer my-token',
    'Content-Type': 'application/json',
  },
}).promise();

console.log(result.status); // e.g. 200

REST (with waitForMs for inline result):

curl -X POST https://api.zafeguard.com/v1/sdk/components \
  -H "X-Api-Key: ws_..." \
  -H "X-Sdk-Timestamp: <timestamp>" \
  -H "X-Sdk-Signature: <signature>" \
  -H "Content-Type: application/json" \
  -d '{
    "module": "API_CALL",
    "input": {
      "headers": {
        "Authorization": "Bearer my-token"
      }
    },
    "config": {
      "apiUrl": "https://api.example.com/data",
      "method": "GET"
    },
    "waitForMs": 5000
  }'

See Authentication → for the required signing headers. Without waitForMs, the response returns status: "CREATED" immediately.

Common patterns

REST API integration

API_CALL → DECODE_EVM_FUNCTION_RESULT   (parse JSON response field)
API_CALL → FOR_EACH                     (iterate over response array)
STRING_CONSTANT → API_CALL              (static endpoint URL)

Authenticated requests

Pass bearer tokens or API keys from workspace environment variables. Reference them in the headers input using {{ENV.MY_SECRET}} syntax in the canvas.

Chaining API calls

Connect the output of one API_CALL to the headers input of another to chain authenticated requests. Use ARRAY_BUILDER to aggregate multiple API responses.

API Call

On this page