> ## Documentation Index
> Fetch the complete documentation index at: https://learn.workflow.dog/llms.txt
> Use this file to discover all available pages before exploring further.

# Build an HTTP Endpoint

> Receive an HTTP request, process its data, and return a controlled response.

Use an HTTP-triggered workflow when another application needs to call your
automation through a URL.

```text theme={null}
URL, Webhook, or Form trigger
  → validate and transform request data
  → perform work
  → Respond Text, JSON, HTML, File, Status, or Redirect
```

## Choose the trigger

| Trigger                                     | Use it for                                                                  | Request data                       |
| ------------------------------------------- | --------------------------------------------------------------------------- | ---------------------------------- |
| [URL](/reference/triggers/http/url)         | General endpoints that accept common HTTP methods and text or binary bodies | Path, method, query, headers, body |
| [Webhook](/reference/triggers/http/webhook) | Services that send a JSON `POST` webhook                                    | Path, headers, parsed JSON body    |
| [Form](/reference/triggers/http/form)       | Browser form submissions and optional hosted form HTML                      | Path, method, query, fields, files |

The trigger is selected when you create the workflow. If the upstream service
has a documented webhook format, use **Webhook**. Use **URL** for a custom API
surface and **Form** for browser-submitted fields or uploads.

## Validate the incoming data

Trigger Data exposes the request values. Treat all of them as untrusted.

* Check required properties before using them.
* Use type checks and conversion actions when a value may arrive as text.
* Validate structured bodies with
  [Validate JSON Schema](/reference/actions/utilities/validate-json-schema).
* Return a clear `4xx` response when the request cannot be processed.

<Warning>
  Do not place secrets in query parameters. URLs are commonly stored in browser,
  proxy, and service logs. Prefer a request header or body field when the
  sending service supports it.
</Warning>

## Return one response

Add the response action that matches the endpoint contract:

| Response action                                          | Result                                |
| -------------------------------------------------------- | ------------------------------------- |
| [Respond Text](/reference/actions/http/respond)          | Plain text with a configurable status |
| [Respond JSON](/reference/actions/http/respond-json)     | A JSON response body                  |
| [Respond HTML](/reference/actions/http/respond-html)     | Rendered HTML                         |
| [Respond File](/reference/actions/http/respond-file)     | A downloadable or inline file         |
| [Respond Status](/reference/actions/http/respond-status) | Status code without a body            |
| [Redirect](/reference/actions/http/redirect)             | Redirect to another URL               |

Only response actions compatible with the selected trigger can be added. If
several branches can respond, design them so one branch wins for each request.

## Example: create a JSON endpoint

1. Create a workflow with the **Webhook** trigger.
2. Read the parsed body from Trigger Data.
3. Validate the required fields.
4. Run the actions that process the request.
5. Build a result object.
6. Connect it to **Respond JSON**.
7. Wait for **Saved!**, enable the workflow, and send a representative `POST`.
8. Inspect the run and the caller's response.

For an error branch, connect the validation result to a condition and return:

```json theme={null}
{
  "ok": false,
  "error": "email is required"
}
```

with status `400`. The success branch can return status `200` or `201`.

## Operate the endpoint

* Keep the workflow **Live** while callers depend on it.
* Watch [Run History](/essentials/workflow-runs) for failed requests and node
  errors.
* Preserve a stable response shape when downstream applications parse it.
* If you pause the workflow, new requests produce paused-workflow failures;
  they are not queued for later.

See [HTTP and webhook triggers](/guides/http-webhooks) for payload limits,
response timing, and the differences between the three trigger types.