Skip to main content
HTTP Client makes a single HTTP request and returns the response. It is the escape hatch for anything without a purpose-built capability.

​
The tool

http_request: The response carries the status, response headers, and the body as a string.

​
Credentials

HTTP Client has no stored credentials and no per-binding configuration. Any authentication has to arrive in the headers argument on each call — which means the model has to have been given the secret.
Do not put long-lived secrets in an agent’s instructions so it can pass them to http_request. Use a connector instead: connectors hold credentials encrypted at rest and inject them at the host boundary, so the secret never reaches the model.
HTTP Client is the right tool for public endpoints, for internal endpoints that need no auth, and for one-off exploration. A recurring authenticated integration is a connector.

​
Limits

A body over the limit is rejected before the request is sent; an oversized response is rejected on read.

​
Cost

Metered per request. See noorle.com/pricing.

​
Autonomy

Act tier — including GET. The verb lives in the arguments, so the whole tool sits at the higher tier rather than trying to infer intent per call. At Read-only autonomy http_request is denied outright.

​
Next

  • Connectors — the credentialed path
  • Browser — when the response is a web page, not JSON