chore: import upstream snapshot with attribution

apps/sim/tools/http/index.ts

@@ -0,0 +1,5 @@
+import { requestTool } from './request'
+import { webhookRequestTool } from './webhook_request'
+
+export const httpRequestTool = requestTool
+export { webhookRequestTool }

apps/sim/tools/http/request.stringified.test.ts

@@ -0,0 +1,110 @@
+import { beforeAll, describe, expect, it } from 'vitest'
+import { requestTool } from '@/tools/http/request'
+import type { RequestParams } from '@/tools/http/types'
+
+beforeAll(() => {
+  process.env.NEXT_PUBLIC_APP_URL = 'http://localhost:3000'
+})
+
+describe('HTTP Request Tool - Stringified Params Fix', () => {
+  it('should handle stringified params from UI storage', () => {
+    const stringifiedParams = JSON.stringify([
+      { id: 'test-1', cells: { Key: 'id', Value: '311861947611' } },
+      { id: 'test-2', cells: { Key: 'language', Value: 'tr' } },
+    ])
+
+    const stringifiedHeaders = JSON.stringify([
+      { id: 'test-3', cells: { Key: 'Authorization', Value: 'Bearer token' } },
+    ])
+
+    const params = {
+      url: 'https://api.example.com/tracking',
+      method: 'GET' as const,
+      params: stringifiedParams,
+      headers: stringifiedHeaders,
+    }
+
+    const url = (requestTool.request.url as (params: RequestParams) => string)(params)
+    expect(url).toBe('https://api.example.com/tracking?id=311861947611&language=tr')
+
+    const headers = (
+      requestTool.request.headers as (params: RequestParams) => Record<string, string>
+    )(params)
+    expect(headers.Authorization).toBe('Bearer token')
+  })
+
+  it('should still handle normal array params', () => {
+    const params = {
+      url: 'https://api.example.com/tracking',
+      method: 'GET' as const,
+      params: [
+        { id: 'test-1', cells: { Key: 'id', Value: '311861947611' } },
+        { id: 'test-2', cells: { Key: 'language', Value: 'tr' } },
+      ],
+      headers: [{ id: 'test-3', cells: { Key: 'Authorization', Value: 'Bearer token' } }],
+    }
+
+    const url = (requestTool.request.url as (params: RequestParams) => string)(params)
+    expect(url).toBe('https://api.example.com/tracking?id=311861947611&language=tr')
+
+    const headers = (
+      requestTool.request.headers as (params: RequestParams) => Record<string, string>
+    )(params)
+    expect(headers.Authorization).toBe('Bearer token')
+  })
+
+  it('should handle null and undefined params gracefully', () => {
+    const params = {
+      url: 'https://api.example.com/test',
+      method: 'GET' as const,
+    }
+
+    const url = (requestTool.request.url as (params: RequestParams) => string)(params)
+    expect(url).toBe('https://api.example.com/test')
+
+    const headers = (
+      requestTool.request.headers as (params: RequestParams) => Record<string, string>
+    )(params)
+    expect(headers).toBeDefined()
+  })
+
+  it('should handle stringified object params and headers', () => {
+    const params = {
+      url: 'https://api.example.com/oauth/token',
+      method: 'POST' as const,
+      body: { grant_type: 'client_credentials' },
+      params: JSON.stringify({ q: 'test' }),
+      headers: JSON.stringify({ 'Content-Type': 'application/x-www-form-urlencoded' }),
+    }
+
+    const url = (requestTool.request.url as (input: RequestParams) => string)(params)
+    expect(url).toBe('https://api.example.com/oauth/token?q=test')
+
+    const headers = (
+      requestTool.request.headers as (input: RequestParams) => Record<string, string>
+    )(params)
+    expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded')
+
+    const body = (
+      requestTool.request.body as (input: RequestParams) => Record<string, any> | string | FormData
+    )(params)
+    expect(body).toBe('grant_type=client_credentials')
+  })
+
+  it('should handle invalid JSON strings gracefully', () => {
+    const params = {
+      url: 'https://api.example.com/test',
+      method: 'GET' as const,
+      params: 'not-valid-json',
+      headers: '{broken',
+    }
+
+    const url = (requestTool.request.url as (input: RequestParams) => string)(params)
+    expect(url).toBe('https://api.example.com/test')
+
+    const headers = (
+      requestTool.request.headers as (input: RequestParams) => Record<string, string>
+    )(params)
+    expect(headers).toBeDefined()
+  })
+})

apps/sim/tools/http/request.test.ts

@@ -0,0 +1,558 @@
+/**
+ * @vitest-environment jsdom
+ *
+ * HTTP Request Tool Unit Tests
+ *
+ * This file contains unit tests for the HTTP Request tool, which is used
+ * to make HTTP requests to external APIs and services.
+ */
+
+import { ToolTester } from '@sim/testing/builders'
+import { mockHttpResponses } from '@sim/testing/factories'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { requestTool } from '@/tools/http/request'
+
+process.env.VITEST = 'true'
+
+describe('HTTP Request Tool', () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let tester: ToolTester<any, any>
+
+  beforeEach(() => {
+    tester = new ToolTester(requestTool as any)
+    process.env.NEXT_PUBLIC_APP_URL = 'https://sim.ai'
+  })
+
+  afterEach(() => {
+    tester.cleanup()
+    vi.resetAllMocks()
+    process.env.NEXT_PUBLIC_APP_URL = undefined
+  })
+
+  describe('URL Construction', () => {
+    it.concurrent('should construct URLs correctly', () => {
+      expect(tester.getRequestUrl({ url: 'https://api.example.com/data' })).toBe(
+        'https://api.example.com/data'
+      )
+
+      expect(
+        tester.getRequestUrl({
+          url: 'https://api.example.com/users/:userId/posts/:postId',
+          pathParams: { userId: '123', postId: '456' },
+        })
+      ).toBe('https://api.example.com/users/123/posts/456')
+
+      expect(
+        tester.getRequestUrl({
+          url: 'https://api.example.com/search',
+          params: [
+            { Key: 'q', Value: 'test query' },
+            { Key: 'limit', Value: '10' },
+          ],
+        })
+      ).toBe('https://api.example.com/search?q=test+query&limit=10')
+
+      expect(
+        tester.getRequestUrl({
+          url: 'https://api.example.com/search?sort=desc',
+          params: [{ Key: 'q', Value: 'test' }],
+        })
+      ).toBe('https://api.example.com/search?sort=desc&q=test')
+
+      const url = tester.getRequestUrl({
+        url: 'https://api.example.com/users/:userId',
+        pathParams: { userId: 'user name+special&chars' },
+      })
+      expect(url.startsWith('https://api.example.com/users/user')).toBe(true)
+      expect(url.includes('name')).toBe(true)
+      expect(url.includes('special')).toBe(true)
+      expect(url.includes('chars')).toBe(true)
+    })
+  })
+
+  describe('Headers Construction', () => {
+    it.concurrent('should set headers correctly', () => {
+      expect(tester.getRequestHeaders({ url: 'https://api.example.com', method: 'GET' })).toEqual(
+        {}
+      )
+
+      expect(
+        tester.getRequestHeaders({
+          url: 'https://api.example.com',
+          method: 'GET',
+          headers: [
+            { Key: 'Authorization', Value: 'Bearer token123' },
+            { Key: 'Accept', Value: 'application/json' },
+          ],
+        })
+      ).toEqual({
+        Authorization: 'Bearer token123',
+        Accept: 'application/json',
+      })
+
+      expect(
+        tester.getRequestHeaders({
+          url: 'https://api.example.com',
+          method: 'POST',
+          body: { key: 'value' },
+        })
+      ).toEqual({
+        'Content-Type': 'application/json',
+      })
+    })
+
+    it.concurrent('should respect custom Content-Type headers', () => {
+      const headers = tester.getRequestHeaders({
+        url: 'https://api.example.com',
+        method: 'POST',
+        body: { key: 'value' },
+        headers: [{ Key: 'Content-Type', Value: 'application/x-www-form-urlencoded' }],
+      })
+      expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded')
+
+      const headers2 = tester.getRequestHeaders({
+        url: 'https://api.example.com',
+        method: 'POST',
+        body: { key: 'value' },
+        headers: [{ Key: 'content-type', Value: 'text/plain' }],
+      })
+      expect(headers2['content-type']).toBe('text/plain')
+    })
+
+    it('should not set a default Referer header', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      await tester.execute({
+        url: 'https://api.example.com',
+        method: 'GET',
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      expect(fetchCall[1].headers.Referer).toBeUndefined()
+    })
+
+    it('should respect a user-provided Referer header', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      await tester.execute({
+        url: 'https://api.example.com',
+        method: 'GET',
+        headers: [{ cells: { Key: 'Referer', Value: 'https://custom.example.com' } }],
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      expect(fetchCall[1].headers.Referer).toBe('https://custom.example.com')
+    })
+
+    it('should set dynamic Host header correctly', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      await tester.execute({
+        url: 'https://api.example.com/endpoint',
+        method: 'GET',
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      expect(fetchCall[1].headers.Host).toBe('api.example.com')
+
+      await tester.execute({
+        url: 'https://api.example.com/endpoint',
+        method: 'GET',
+        headers: [{ cells: { Key: 'Host', Value: 'custom-host.com' } }],
+      })
+
+      const userHeaderCall = (global.fetch as any).mock.calls[1]
+      expect(userHeaderCall[1].headers.Host).toBe('custom-host.com')
+    })
+  })
+
+  describe('Body Construction', () => {
+    it.concurrent('should handle JSON bodies correctly', () => {
+      const body = { username: 'test', password: 'secret' }
+
+      expect(
+        tester.getRequestBody({
+          url: 'https://api.example.com',
+          body,
+        })
+      ).toEqual(body)
+    })
+
+    it.concurrent('should handle FormData correctly', () => {
+      const formData = { file: 'test.txt', content: 'file content' }
+
+      const result = tester.getRequestBody({
+        url: 'https://api.example.com',
+        formData,
+      })
+
+      expect(result).toBeInstanceOf(FormData)
+    })
+  })
+
+  describe('Request Execution', () => {
+    it('should apply default and dynamic headers to requests', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      await tester.execute({
+        url: 'https://api.example.com/data',
+        method: 'GET',
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      const headers = fetchCall[1].headers
+
+      expect(headers.Host).toBe('api.example.com')
+      expect(headers.Referer).toBeUndefined()
+      expect(headers['User-Agent']).toBe('Sim/1.0 (+https://sim.ai)')
+      expect(headers.Accept).toBe('*/*')
+      expect(headers['Accept-Encoding']).toContain('gzip')
+      expect(headers['Cache-Control']).toBe('no-cache')
+      expect(headers.Connection).toBe('keep-alive')
+      expect(headers['Sec-Ch-Ua']).toBeUndefined()
+    })
+
+    it('should handle successful GET requests', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/data',
+        method: 'GET',
+      })
+
+      expect(result.success).toBe(true)
+      expect(result.output.data).toEqual(mockHttpResponses.simple)
+      expect(result.output.status).toBe(200)
+      expect(result.output.headers).toHaveProperty('content-type')
+    })
+
+    it('should reject responses that exceed the workflow data cap', async () => {
+      const response = new Response('too large', {
+        status: 200,
+        headers: {
+          'content-type': 'text/plain',
+          'content-length': '10485761',
+        },
+      })
+
+      await expect(requestTool.transformResponse?.(response, {} as any)).rejects.toMatchObject({
+        name: 'PayloadSizeLimitError',
+      })
+    })
+
+    it('should handle POST requests with body', async () => {
+      tester.setup({ result: 'success' })
+
+      const body = { name: 'Test User', email: 'test@example.com' }
+
+      await tester.execute({
+        url: 'https://api.example.com/users',
+        method: 'POST',
+        body,
+      })
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'https://api.example.com/users',
+        expect.objectContaining({
+          method: 'POST',
+          headers: expect.objectContaining({
+            'Content-Type': 'application/json',
+          }),
+          body: expect.any(String),
+        })
+      )
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      const bodyArg = JSON.parse(fetchCall[1].body)
+      expect(bodyArg).toEqual(body)
+    })
+
+    it('should handle POST requests with URL-encoded form data', async () => {
+      tester.setup({ result: 'success' })
+
+      const body = { username: 'testuser123', password: 'testpass456', email: 'test@example.com' }
+
+      await tester.execute({
+        url: 'https://api.example.com/oauth/token',
+        method: 'POST',
+        body,
+        headers: [{ cells: { Key: 'Content-Type', Value: 'application/x-www-form-urlencoded' } }],
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      expect(fetchCall[0]).toBe('https://api.example.com/oauth/token')
+      expect(fetchCall[1].method).toBe('POST')
+      expect(fetchCall[1].headers['Content-Type']).toBe('application/x-www-form-urlencoded')
+
+      expect(fetchCall[1].body).toBe(
+        'username=testuser123&password=testpass456&email=test%40example.com'
+      )
+    })
+
+    it('should handle nested objects and arrays in URL-encoded form data', async () => {
+      tester.setup({ result: 'success' })
+
+      const body = {
+        name: 'test',
+        data: { nested: 'value' },
+        items: [1, 2, 3],
+      }
+
+      await tester.execute({
+        url: 'https://api.example.com/submit',
+        method: 'POST',
+        body,
+        headers: [{ cells: { Key: 'Content-Type', Value: 'application/x-www-form-urlencoded' } }],
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      const bodyStr = fetchCall[1].body
+
+      expect(bodyStr).toContain('name=test')
+      expect(bodyStr).toContain('data=%7B%22nested%22%3A%22value%22%7D')
+      expect(bodyStr).toContain('items=%5B1%2C2%2C3%5D')
+    })
+
+    it('should handle OAuth client credentials requests', async () => {
+      tester.setup({ access_token: 'token123', token_type: 'Bearer' })
+
+      await tester.execute({
+        url: 'https://oauth.example.com/token',
+        method: 'POST',
+        body: { grant_type: 'client_credentials', scope: 'read write' },
+        headers: [
+          { cells: { Key: 'Content-Type', Value: 'application/x-www-form-urlencoded' } },
+          { cells: { Key: 'Authorization', Value: 'Basic Y2xpZW50OnNlY3JldA==' } },
+        ],
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      expect(fetchCall[0]).toBe('https://oauth.example.com/token')
+      expect(fetchCall[1].method).toBe('POST')
+      expect(fetchCall[1].headers['Content-Type']).toBe('application/x-www-form-urlencoded')
+      expect(fetchCall[1].headers.Authorization).toBe('Basic Y2xpZW50OnNlY3JldA==')
+
+      expect(fetchCall[1].body).toBe('grant_type=client_credentials&scope=read+write')
+    })
+
+    it('should handle errors correctly', async () => {
+      tester.setup(mockHttpResponses.error, { ok: false, status: 400 })
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/data',
+        method: 'GET',
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.error).toBeDefined()
+    })
+
+    it('should handle timeout parameter', async () => {
+      tester.setup({ result: 'success' })
+
+      await tester.execute({
+        url: 'https://api.example.com/data',
+        timeout: 5000,
+      })
+
+      expect(global.fetch).toHaveBeenCalled()
+    })
+  })
+
+  describe('Response Transformation', () => {
+    it('should transform JSON responses correctly', async () => {
+      tester.setup({ data: { key: 'value' } }, { headers: { 'content-type': 'application/json' } })
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/data',
+      })
+
+      expect(result.success).toBe(true)
+      expect(result.output.data).toEqual({ data: { key: 'value' } })
+    })
+
+    it('should transform text responses correctly', async () => {
+      const textContent = 'Plain text response'
+      tester.setup(textContent, { headers: { 'content-type': 'text/plain' } })
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/text',
+      })
+
+      expect(result.success).toBe(true)
+      expect(result.output.data).toBe(textContent)
+    })
+  })
+
+  describe('Error Handling', () => {
+    it('should handle network errors', async () => {
+      tester.setupError('Network error')
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/data',
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.error).toContain('Network error')
+    })
+
+    it('should handle 404 errors', async () => {
+      tester.setup(mockHttpResponses.notFound, { ok: false, status: 404 })
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/not-found',
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.output).toEqual({})
+    })
+
+    it('should handle 401 unauthorized errors', async () => {
+      tester.setup(mockHttpResponses.unauthorized, { ok: false, status: 401 })
+
+      const result = await tester.execute({
+        url: 'https://api.example.com/restricted',
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.output).toEqual({})
+    })
+  })
+
+  describe('Default Headers', () => {
+    it('should apply all default headers correctly', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      await tester.execute({
+        url: 'https://api.example.com/data',
+        method: 'GET',
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      const headers = fetchCall[1].headers
+
+      expect(headers['User-Agent']).toBe('Sim/1.0 (+https://sim.ai)')
+      expect(headers.Accept).toBe('*/*')
+      expect(headers['Accept-Encoding']).toBe('gzip, deflate, br')
+      expect(headers['Cache-Control']).toBe('no-cache')
+      expect(headers.Connection).toBe('keep-alive')
+      expect(headers['Sec-Ch-Ua']).toBeUndefined()
+      expect(headers['Sec-Ch-Ua-Mobile']).toBeUndefined()
+      expect(headers['Sec-Ch-Ua-Platform']).toBeUndefined()
+      expect(headers.Referer).toBeUndefined()
+      expect(headers.Host).toBe('api.example.com')
+    })
+
+    it('should allow overriding default headers', async () => {
+      tester.setup(mockHttpResponses.simple)
+
+      await tester.execute({
+        url: 'https://api.example.com/data',
+        method: 'GET',
+        headers: [
+          { cells: { Key: 'User-Agent', Value: 'Custom Agent' } },
+          { cells: { Key: 'Accept', Value: 'application/json' } },
+        ],
+      })
+
+      const fetchCall = (global.fetch as any).mock.calls[0]
+      const headers = fetchCall[1].headers
+
+      expect(headers['User-Agent']).toBe('Custom Agent')
+      expect(headers.Accept).toBe('application/json')
+
+      expect(headers['Accept-Encoding']).toBe('gzip, deflate, br')
+      expect(headers['Cache-Control']).toBe('no-cache')
+    })
+  })
+
+  describe('Proxy Functionality', () => {
+    it.concurrent('should not use proxy in test environment', () => {
+      const originalWindow = global.window
+      Object.defineProperty(global, 'window', {
+        value: {
+          location: {
+            origin: 'https://sim.ai',
+          },
+        },
+        writable: true,
+      })
+
+      const url = tester.getRequestUrl({ url: 'https://api.example.com/data' })
+      expect(url).toBe('https://api.example.com/data')
+      expect(url).not.toContain('/api/proxy')
+
+      global.window = originalWindow
+    })
+
+    it.concurrent('should include method parameter in proxy URL', () => {
+      const originalWindow = global.window
+      Object.defineProperty(global, 'window', {
+        value: {
+          location: {
+            origin: 'https://sim.ai',
+          },
+        },
+        writable: true,
+      })
+
+      const originalVitest = process.env.VITEST as string
+
+      try {
+        process.env.VITEST = undefined
+
+        const buildProxyUrl = (params: any) => {
+          const baseUrl = 'https://external-api.com/endpoint'
+          let proxyUrl = `/api/proxy?url=${encodeURIComponent(baseUrl)}`
+
+          if (params.method) {
+            proxyUrl += `&method=${encodeURIComponent(params.method)}`
+          }
+
+          if (
+            params.body &&
+            ['POST', 'PUT', 'PATCH'].includes(params.method?.toUpperCase() || '')
+          ) {
+            const bodyStr =
+              typeof params.body === 'string' ? params.body : JSON.stringify(params.body)
+            proxyUrl += `&body=${encodeURIComponent(bodyStr)}`
+          }
+
+          return proxyUrl
+        }
+
+        const getParams = {
+          url: 'https://external-api.com/endpoint',
+          method: 'GET',
+        }
+        const getProxyUrl = buildProxyUrl(getParams)
+        expect(getProxyUrl).toContain('/api/proxy?url=')
+        expect(getProxyUrl).toContain('&method=GET')
+
+        const postParams = {
+          url: 'https://external-api.com/endpoint',
+          method: 'POST',
+          body: { key: 'value' },
+        }
+        const postProxyUrl = buildProxyUrl(postParams)
+        expect(postProxyUrl).toContain('/api/proxy?url=')
+        expect(postProxyUrl).toContain('&method=POST')
+        expect(postProxyUrl).toContain('&body=')
+        expect(postProxyUrl).toContain(encodeURIComponent('{"key":"value"}'))
+
+        const putParams = {
+          url: 'https://external-api.com/endpoint',
+          method: 'PUT',
+          body: 'string body',
+        }
+        const putProxyUrl = buildProxyUrl(putParams)
+        expect(putProxyUrl).toContain('/api/proxy?url=')
+        expect(putProxyUrl).toContain('&method=PUT')
+        expect(putProxyUrl).toContain(`&body=${encodeURIComponent('string body')}`)
+      } finally {
+        global.window = originalWindow
+        process.env.VITEST = originalVitest
+      }
+    })
+  })
+})

apps/sim/tools/http/request.ts

@@ -0,0 +1,224 @@
+import { readResponseTextWithLimit } from '@/lib/core/utils/stream-limits'
+import type { RequestParams, RequestResponse } from '@/tools/http/types'
+import { getDefaultHeaders, processUrl } from '@/tools/http/utils'
+import { transformTable } from '@/tools/shared/table'
+import type { ToolConfig } from '@/tools/types'
+
+const MAX_HTTP_RESPONSE_BODY_BYTES = 10 * 1024 * 1024
+
+export const requestTool: ToolConfig<RequestParams, RequestResponse> = {
+  id: 'http_request',
+  name: 'HTTP Request',
+  description:
+    'Make HTTP requests with comprehensive support for methods, headers, query parameters, path parameters, and form data. Features configurable timeout and status validation for robust API interactions.',
+  version: '1.0.0',
+
+  params: {
+    url: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'The URL to send the request to',
+    },
+    method: {
+      type: 'string',
+      default: 'GET',
+      visibility: 'user-or-llm',
+      description: 'HTTP method (GET, POST, PUT, PATCH, DELETE)',
+    },
+    headers: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'HTTP headers to include',
+    },
+    body: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'Request body (for POST, PUT, PATCH)',
+    },
+    params: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'URL query parameters to append',
+    },
+    pathParams: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'URL path parameters to replace (e.g., :id in /users/:id)',
+    },
+    formData: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'Form data to send (will set appropriate Content-Type)',
+    },
+    timeout: {
+      type: 'number',
+      visibility: 'user-only',
+      description: 'Request timeout in milliseconds (default: 300000 = 5 minutes)',
+    },
+    retries: {
+      type: 'number',
+      visibility: 'hidden',
+      description:
+        'Number of retry attempts for retryable failures (timeouts, 429, 5xx). Default: 0 (no retries).',
+    },
+    retryDelayMs: {
+      type: 'number',
+      visibility: 'hidden',
+      description: 'Initial retry delay in milliseconds (default: 500)',
+    },
+    retryMaxDelayMs: {
+      type: 'number',
+      visibility: 'hidden',
+      description: 'Maximum delay between retries in milliseconds (default: 30000)',
+    },
+    retryNonIdempotent: {
+      type: 'boolean',
+      visibility: 'hidden',
+      description:
+        'Allow retries for non-idempotent methods like POST/PATCH (may create duplicate requests).',
+    },
+  },
+
+  request: {
+    url: (params: RequestParams) => {
+      return processUrl(params.url, params.pathParams, params.params)
+    },
+
+    method: (params: RequestParams) => {
+      // Always return the user's intended method - executeTool handles proxy routing
+      return params.method || 'GET'
+    },
+
+    headers: (params: RequestParams) => {
+      const headers = transformTable(params.headers || null)
+      const processedUrl = processUrl(params.url, params.pathParams, params.params)
+      const allHeaders = getDefaultHeaders(headers, processedUrl)
+
+      // Set appropriate Content-Type only if not already specified by user
+      if (params.formData) {
+        // Don't set Content-Type for FormData, browser will set it with boundary
+        return allHeaders
+      }
+      if (params.body && !allHeaders['Content-Type'] && !allHeaders['content-type']) {
+        allHeaders['Content-Type'] = 'application/json'
+      }
+
+      return allHeaders
+    },
+
+    body: ((params: RequestParams) => {
+      if (params.formData) {
+        const formData = new FormData()
+        Object.entries(params.formData).forEach(([key, value]) => {
+          formData.append(key, value)
+        })
+        return formData
+      }
+
+      if (params.body) {
+        const headers = transformTable(params.headers || null)
+        const contentType = headers['Content-Type'] || headers['content-type']
+
+        if (
+          contentType === 'application/x-www-form-urlencoded' &&
+          typeof params.body === 'object'
+        ) {
+          // Convert JSON object to URL-encoded string
+          const urlencoded = new URLSearchParams()
+          Object.entries(params.body as Record<string, unknown>).forEach(([key, value]) => {
+            if (value !== undefined && value !== null) {
+              urlencoded.append(
+                key,
+                typeof value === 'object' ? JSON.stringify(value) : String(value)
+              )
+            }
+          })
+          return urlencoded.toString()
+        }
+
+        return params.body as Record<string, any>
+      }
+
+      return undefined
+    }) as (params: RequestParams) => Record<string, any> | string | FormData | undefined,
+
+    retry: {
+      enabled: true,
+      maxRetries: 0,
+      initialDelayMs: 500,
+      maxDelayMs: 30000,
+      retryIdempotentOnly: true,
+    },
+  },
+
+  transformResponse: async (response: Response) => {
+    const contentType = response.headers.get('content-type') || ''
+
+    // Standard response handling
+    const headers: Record<string, string> = {}
+    response.headers.forEach((value, key) => {
+      headers[key] = value
+    })
+
+    const responseText = await readResponseTextWithLimit(response, {
+      maxBytes: MAX_HTTP_RESPONSE_BODY_BYTES,
+      label: 'HTTP Request response body',
+      allowNoBodyFallback: true,
+    })
+    const data = contentType.includes('application/json') ? JSON.parse(responseText) : responseText
+
+    // Check if this is a proxy response (structured response from /api/proxy)
+    if (
+      contentType.includes('application/json') &&
+      typeof data === 'object' &&
+      data !== null &&
+      data.data !== undefined &&
+      data.status !== undefined
+    ) {
+      return {
+        success: data.success,
+        output: {
+          data: data.data,
+          status: data.status,
+          headers: data.headers || {},
+        },
+        error: data.success ? undefined : data.error,
+      }
+    }
+
+    // Direct response handling
+    return {
+      success: response.ok,
+      output: {
+        data,
+        status: response.status,
+        headers,
+      },
+      error: undefined, // Errors are handled upstream in executeTool
+    }
+  },
+
+  outputs: {
+    data: {
+      type: 'json',
+      description: 'Response data from the HTTP request (JSON object, text, or other format)',
+    },
+    status: {
+      type: 'number',
+      description: 'HTTP status code of the response (e.g., 200, 404, 500)',
+    },
+    headers: {
+      type: 'object',
+      description: 'Response headers as key-value pairs',
+      properties: {
+        'content-type': {
+          type: 'string',
+          description: 'Content type of the response',
+          optional: true,
+        },
+        'content-length': { type: 'string', description: 'Content length', optional: true },
+      },
+    },
+  },
+}

apps/sim/tools/http/types.ts

@@ -0,0 +1,31 @@
+import type { HttpMethod, TableRow, ToolResponse } from '@/tools/types'
+
+export interface RequestParams {
+  url: string
+  method?: HttpMethod
+  headers?: TableRow[] | string
+  body?: unknown
+  params?: TableRow[] | string
+  pathParams?: Record<string, string>
+  formData?: Record<string, string | Blob>
+  timeout?: number
+  retries?: number
+  retryDelayMs?: number
+  retryMaxDelayMs?: number
+  retryNonIdempotent?: boolean
+}
+
+export interface RequestResponse extends ToolResponse {
+  output: {
+    data: unknown
+    status: number
+    headers: Record<string, string>
+  }
+}
+
+export interface WebhookRequestParams {
+  url: string
+  body?: unknown
+  secret?: string
+  headers?: Record<string, string>
+}

apps/sim/tools/http/utils.ts

@@ -0,0 +1,84 @@
+import { transformTable } from '@/tools/shared/table'
+import type { TableRow } from '@/tools/types'
+
+/**
+ * Creates a set of default headers used in HTTP requests.
+ *
+ * Identifies as Sim rather than impersonating a browser. Browser-fingerprint
+ * headers (Referer, Sec-Ch-Ua*) trip anti-CSRF/bot-defense heuristics on
+ * providers like Atlassian, which reject REST calls carrying a browser
+ * User-Agent regardless of X-Atlassian-Token. See
+ * https://support.atlassian.com/jira/kb/rest-api-calls-with-a-browser-user-agent-header-may-fail-csrf-checks/
+ * @param customHeaders Additional user-provided headers to include
+ * @param url Target URL for the request (used for setting Host header)
+ * @returns Record of HTTP headers
+ */
+export const getDefaultHeaders = (
+  customHeaders: Record<string, string> = {},
+  url?: string
+): Record<string, string> => {
+  const headers: Record<string, string> = {
+    'User-Agent': 'Sim/1.0 (+https://sim.ai)',
+    Accept: '*/*',
+    'Accept-Encoding': 'gzip, deflate, br',
+    'Cache-Control': 'no-cache',
+    Connection: 'keep-alive',
+    ...customHeaders,
+  }
+
+  if (url) {
+    try {
+      const hostname = new URL(url).host
+      if (hostname && !customHeaders.Host && !customHeaders.host) {
+        headers.Host = hostname
+      }
+    } catch (_e) {
+      // Invalid URL, will be caught later
+    }
+  }
+
+  return headers
+}
+
+/**
+ * Processes a URL with path parameters and query parameters
+ * @param url Base URL to process
+ * @param pathParams Path parameters to replace in the URL
+ * @param queryParams Query parameters to add to the URL
+ * @returns Processed URL with path params replaced and query params added
+ */
+export const processUrl = (
+  url: string,
+  pathParams?: Record<string, string>,
+  queryParams?: TableRow[] | Record<string, any> | string | null
+): string => {
+  if ((url.startsWith('"') && url.endsWith('"')) || (url.startsWith("'") && url.endsWith("'"))) {
+    url = url.slice(1, -1)
+  }
+
+  if (pathParams) {
+    Object.entries(pathParams).forEach(([key, value]) => {
+      url = url.replace(`:${key}`, encodeURIComponent(value))
+    })
+  }
+
+  if (queryParams) {
+    const queryParamsObj = transformTable(queryParams)
+
+    const separator = url.includes('?') ? '&' : '?'
+
+    const queryParts: string[] = []
+
+    for (const [key, value] of Object.entries(queryParamsObj)) {
+      if (value !== undefined && value !== null) {
+        queryParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`)
+      }
+    }
+
+    if (queryParts.length > 0) {
+      url += separator + queryParts.join('&')
+    }
+  }
+
+  return url
+}

apps/sim/tools/http/webhook_request.ts

@@ -0,0 +1,130 @@
+import { hmacSha256Hex } from '@sim/security/hmac'
+import { generateId } from '@sim/utils/id'
+import type { RequestResponse, WebhookRequestParams } from '@/tools/http/types'
+import type { ToolConfig } from '@/tools/types'
+
+/**
+ * Generates HMAC-SHA256 signature for webhook payload
+ */
+function generateSignature(secret: string, timestamp: number, body: string): string {
+  const signatureBase = `${timestamp}.${body}`
+  return hmacSha256Hex(signatureBase, secret)
+}
+
+export const webhookRequestTool: ToolConfig<WebhookRequestParams, RequestResponse> = {
+  id: 'webhook_request',
+  name: 'Webhook Request',
+  description: 'Send a webhook request with automatic headers and optional HMAC signing',
+  version: '1.0.0',
+
+  params: {
+    url: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'The webhook URL to send the request to',
+    },
+    body: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'JSON payload to send',
+    },
+    secret: {
+      type: 'string',
+      visibility: 'user-or-llm',
+      description: 'Optional secret for HMAC-SHA256 signature',
+    },
+    headers: {
+      type: 'object',
+      visibility: 'user-or-llm',
+      description: 'Additional headers to include',
+    },
+  },
+
+  request: {
+    url: (params: WebhookRequestParams) => params.url,
+
+    method: () => 'POST',
+
+    headers: (params: WebhookRequestParams) => {
+      const timestamp = Date.now()
+      const deliveryId = generateId()
+
+      const webhookHeaders: Record<string, string> = {
+        'Content-Type': 'application/json',
+        'X-Webhook-Timestamp': timestamp.toString(),
+        'X-Delivery-ID': deliveryId,
+        'Idempotency-Key': deliveryId,
+      }
+
+      if (params.secret) {
+        const bodyString =
+          typeof params.body === 'string' ? params.body : JSON.stringify(params.body || {})
+        const signature = generateSignature(params.secret, timestamp, bodyString)
+        webhookHeaders['X-Webhook-Signature'] = `t=${timestamp},v1=${signature}`
+      }
+
+      const userHeaders = params.headers || {}
+
+      return { ...webhookHeaders, ...userHeaders }
+    },
+
+    body: (params: WebhookRequestParams) => params.body as Record<string, any>,
+  },
+
+  transformResponse: async (response: Response) => {
+    const contentType = response.headers.get('content-type') || ''
+
+    const headers: Record<string, string> = {}
+    response.headers.forEach((value, key) => {
+      headers[key] = value
+    })
+
+    const data = await (contentType.includes('application/json')
+      ? response.json()
+      : response.text())
+
+    if (
+      contentType.includes('application/json') &&
+      typeof data === 'object' &&
+      data !== null &&
+      data.data !== undefined &&
+      data.status !== undefined
+    ) {
+      return {
+        success: data.success,
+        output: {
+          data: data.data,
+          status: data.status,
+          headers: data.headers || {},
+        },
+        error: data.success ? undefined : data.error,
+      }
+    }
+
+    return {
+      success: response.ok,
+      output: {
+        data,
+        status: response.status,
+        headers,
+      },
+      error: undefined,
+    }
+  },
+
+  outputs: {
+    data: {
+      type: 'json',
+      description: 'Response data from the webhook endpoint',
+    },
+    status: {
+      type: 'number',
+      description: 'HTTP status code',
+    },
+    headers: {
+      type: 'object',
+      description: 'Response headers',
+    },
+  },
+}