>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3633764. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !735 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>A workflow cannot call an external HTTP endpoint without code. Today that takes a custom Action run by the <code class="language-php">action</code> task, or an ECA model. Most BPMN engines ship this step: Flowable has an HTTP task, Camunda an HTTP connector (a REST connector in Camunda 8), jBPM a REST work item handler. Authors coming from them expect to call a web service from the model and route on its answer.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add an <code class="language-php">http_request</code> task type, in a new <code class="language-php">orchestra_http</code> submodule:</p> <ul> <li><strong>Request</strong>: method, URL, headers and body, each able to read process variables through tokens. A JSON body can be built from variables.</li> <li><strong>Credentials</strong>: none, basic, or a bearer token, the secret held by the Key module as <code class="language-php">orchestra_client</code> holds its own.</li> <li><strong>Response</strong>: the status code to one variable and the body to another, decoded when it is JSON, with a size cap.</li> <li><strong>Answers and failures</strong>: a response is an answer, not a failure. The step writes its status code to its outcome variable, so its flows route a 404 or a 409 as they route any outcome. A timeout, a refused connection, a 429 or a 5xx is a failure instead: retryable, so the node's retry policy applies, and once the attempts are used up the step's own choice from #3633763 decides what happens, a <code class="language-php">failed</code> outcome among the answers.</li> <li><strong>Safety</strong>: the step calls the servers its author named, whatever a variable holds, because a URL built from variables may come from a form somebody filled in. A token's value is URL-encoded where it goes, so a variable fills a path segment or a query value but cannot add one or change the host. A host a token supplies must be one of the step's allowed hosts. Redirects are not followed. Both http and https are allowed, an intranet service often being served over http; credentials sent over plain http give the author a warning when the workflow is saved. No private-address rule: on an intranet every service is on one, and the allowed hosts already keep a variable from reaching a server nobody named.</li> <li><strong>Timeout</strong>: a short default, settable per node. A workflow running synchronously makes the call inside the request that advanced it, which the documentation says plainly, pointing at the queued execution mode for slow endpoints.</li> </ul> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Done in <a href="https://git.drupalcode.org/project/orchestra/-/merge_requests/735">merge request 735</a>: the task type and its settings form (both modelers build their panels from it), the documentation page, an <code class="language-php">example_http_lookup</code> workflow in <code class="language-php">orchestra_examples</code>, and tests against a mocked HTTP client. #3633763 has landed.</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>A new task type in both modelers. Both also show a warning when a step sends credentials over plain http: the Complete Modeler after a save, and either modeler when the workflow is opened.</p> <h3 id="summary-api-changes">API changes</h3> <p>A new task type is a new plugin. The engine gains <code class="language-php">TaskTypeWarningsInterface</code>: a task type implementing it is asked, through <code class="language-php">TaskTypeManager::getWarnings()</code>, what to tell the author about a node, and the modelers show it beside the node feature warnings.</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None beyond the node's configuration.</p> <p>AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it.)</p>