`dolfinApi.http` — Outbound HTTP Client #

The dolfin.http client allows custom functions to interact with external third-party systems, REST APIs, and webhook destinations (e.g. Slack, Discord, Zapier, Twilio, external ERPs).

Security & SSRF Protection #

All outbound requests pass through an automated Server-Side Request Forgery (SSRF) validation filter before any network connection is initiated.

Enforced Protections #

Forbidden IP Ranges: Requests resolving to private network blocks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, ::1, fc00::/7) are blocked immediately.
DNS Resolution Verification: Domain names are resolved to verify destination IP safety before connection dispatch.
Protocol Enforcement: Only standard http: and https: URLs are permitted.

Runtime Constraints #

Rule	Limit	Exception Thrown
Max Calls Per Execution	5 requests	`Error: Exceeded maximum HTTP calls per execution (5)`
Request Timeout	8,000 ms max (8s)	`DOMException: The operation was aborted`
Max Response Payload	1 MB (1,048,576 bytes)	`Error: Response size exceeds the maximum limit`

Interface Definition #

typescript

interface HttpOptions {
  headers?: Record<string, string>;
  /** Timeout in milliseconds (capped at 8000ms max) */
  timeoutMs?: number;
}

interface HttpResponse<T = unknown> {
  status: number;
  body: T;
}

Sub-APIs #

Method	Signature	Description
`dolfin.http.get(url, options?)`	`Promise<HttpResponse<T>>`	Performs an outbound HTTP GET request.
`dolfin.http.post(url, body, options?)`	`Promise<HttpResponse<T>>`	Sends an outbound HTTP POST request with JSON payload.
`dolfin.http.put(url, body, options?)`	`Promise<HttpResponse<T>>`	Sends an outbound HTTP PUT request with JSON payload.
`dolfin.http.delete(url, options?)`	`Promise<HttpResponse<T>>`	Performs an outbound HTTP DELETE request.