Skip to main content

FromHttpRequest@2

The FromHttpRequest@2 node triggers a pipeline from an HTTP request and carries the caller's identity into the pipeline. It is the identity-aware successor to FromHttpRequest@1: use it whenever the pipeline should run as, or on behalf of, the person or service that called it — most notably for delegated user-facing flows such as an application's AI chat.

Adapter Prerequisites​

What is different from @1​

  • @1 triggers the pipeline from the request body only; it does not require or propagate a caller identity.
  • @2 requires a valid access token on the request (unless made anonymous), gates the call by role, and makes the caller's verified identity available to the rest of the pipeline — which is what enables running on behalf of the caller.

Node Configuration​

For fields path, targetPath, targetValueWriteMode, and targetValueKind, see Overview.

triggers:
  - type: FromHttpRequest@2
    path: /aiPrompt          # The path that should trigger the pipeline
    method: POST             # The HTTP method that should trigger the pipeline
    requiredRoles:           # Any one of these roles admits the caller
      - AccountingManagement
      - AccountingEmployee
    allowAnonymous: false    # When true, no token is required (default: false)

Configuration Parameters​

ParameterTypeRequiredDefaultDescription
pathstringYes-The request path that triggers the pipeline
methodstringYes-The HTTP method that triggers the pipeline
requiredRolesstring[]No(empty)Roles that grant access — any one is sufficient. An empty list accepts any caller with a valid access token
allowAnonymousboolNofalseWhen true, the endpoint accepts requests without an access token

Caller identity and delegation​

When a request carries a valid token, FromHttpRequest@2 verifies it and makes the caller's identity available to downstream nodes. A node that supports delegation — for example AnthropicAiQuery@1 with mcpDelegateToCaller: true — then performs its data access as the caller, so the caller only sees the data they are allowed to see.

note

The caller's raw token is used only to obtain the delegated identity. It is not written into the pipeline payload, so it never leaks into logs or downstream data.

info

Requests that fail the token or role check are rejected with 401/403 before the pipeline runs. If you set allowAnonymous: true, do not combine it with delegation — there is no caller identity to delegate to.