Pipefy Integrations empowers you to connect your processes with hundreds of external apps and automate your workflows. While we offer a wide variety of native connectors, you may sometimes need to connect to a specialized or custom system that doesn't have a pre-built app. That is where the HTTP and HTTP (OAuth2) connectors come in.
The HTTP connectors allow you to interact directly with external REST APIs, giving you the flexibility to send and receive data from virtually any web-based software.
When to Use the HTTP Connector
You should use the HTTP connector when:
No Native App Exists: The tool you want to integrate with is not available in our standard integrations library.
Custom Endpoints: You need to interact with internal or proprietary APIs specific to your company.
Advanced API Operations: You need to execute specific methods (like
PUT,PATCH, or customPOSTrequests) that are not covered by a standard connector’s predefined actions.
Types of HTTP Connectors and Authentication
Depending on the security requirements of the external API you are connecting to, you can choose between different types of HTTP setups:
1. Standard HTTP Connector
Use this coonector for endpoints that require standard authentication methods or no authentication at all.
No Auth / Public APIs: Simple GET requests to fetch public data.
Basic Auth: Allows you to input a Username and Password.
Bearer Token / Custom Headers: You can pass API keys or Secret Texts directly within the HTTP headers or query parameters of the request.
2. HTTP (OAuth2) Connector
If the external application requires OAuth 2.0 authorization, use the HTTP (OAuth2) connector. This connector securely collects and stores user credentials (handling the Authorization URL, Token URL, Client ID, Client Secret, and scopes) so you can seamlessly send authenticated requests without exposing raw tokens in your flow builder. Note: For troubleshooting OAuth2 token retrieval errors, refer to the "Troubleshooting Common Issues" section below for detailed solutions and best practices.
Technical Limits You Should Know
To ensure your automated processes run smoothly and maintain high performance, the integration engine enforces a few technical limits. When designing your HTTP flows, keep the following in mind:
Flow Execution Time: The maximum execution time for a single flow run is 300 seconds (5 minutes). If an external API is very slow to respond and causes the flow to exceed this limit, the run will be marked as timed out.
Memory Usage: The maximum RAM allocated per flow process is 512 MB.
Best Practices for HTTP Automations
Working with APIs requires a strategic approach to ensure your data is processed correctly and efficiently. Here are the top recommendations:
1. Implement Data Validation
APIs can sometimes return unexpected errors or empty values. Always use conditional rules (Branches) after an HTTP request to check the Status Code (e.g., ensuring it returns 200 OK or 201 Created) before proceeding to the next steps. This prevents your flow from failing abruptly or injecting bad data into your Pipefy database. Additionally, ensure that all field placeholders in the HTTP Request body are valid. Invalid placeholders can cause silent failures where the external API does not receive the request. Refer to the "Troubleshooting Common Issues" section for detailed guidance on resolving this issue.
2. Secure Your Credentials
Never type passwords or secret tokens directly into plain text fields if they can be avoided. Utilize the native Authentication dropdowns (like the OAuth2 setup or Bearer Token field) so credentials remain encrypted and secure within the platform's secret manager.
3. Test Before Publishing
APIs can be tricky with formatting (JSON vs. Form-Data). Always use the "Test Step" feature inside the HTTP piece to send a sample payload. Review the output response carefully to ensure the external system understood the request.
Troubleshooting Common Issues
Invalid Field References in HTTP Requests
Problem
An HTTP Request automation may show success in the log, but the external API does not receive the request. This often occurs when the request body contains an invalid field reference, such as %{assigneesattribute:name}.
Cause
Pipefy automations require valid field placeholders in the JSON body of the HTTP Request. Invalid placeholders prevent the system from resolving the field value, causing the request to fail silently.
Solution
Edit the HTTP Request Body:
Open the automation in Pipefy.
Locate the HTTP Request body where the invalid placeholder is used.
Insert a Valid Field Placeholder:
Use the "Insert Field" option to select the correct field (e.g., "Assignee/Responsible").
Pipefy will automatically insert a valid token, such as
%{field_123456789}.
Save and Test:
Save the changes and test the automation to ensure the request is sent correctly.
OAuth2 Token Retrieval Errors
Problem
An HTTP Request automation may fail with an error code "Unknown :: error code: 1015" during OAuth2 token retrieval.
Cause
This error occurs when multiple HTTP Request automations are triggered simultaneously using the same OAuth2 client. If the access token is not cached, each automation requests a new token from the /oauth/token endpoint. These concurrent requests can be rate-limited by the destination server, such as Cloudflare.
Solution
To prevent this issue, consider the following options:
Combine HTTP Calls:
Merge multiple HTTP automations into a single request. For example, clean fields and generate the phase form link in one GraphQL body.
This reduces the number of token requests by consolidating actions.
Use Native Actions:
Replace non-HTTP steps (e.g., clearing fields) with native Pipefy actions like "Update Field."
This minimizes the need for OAuth2 tokens.
Chain Automations:
Trigger the first HTTP Request (e.g., phase form link generation) on phase entry.
Trigger subsequent actions (e.g., field clearing) after the first HTTP Request’s response.
This approach staggers requests, allowing the token to be cached for subsequent calls.
Reference Behavior
Pipefy caches OAuth2 access tokens per client under a unique cache key. While the token is valid, subsequent automations skip the /oauth/token endpoint and call the API directly. Collisions occur when multiple automations fire simultaneously and the cache is empty.