How to send an HTTP request in Power Automate (with examples)

TL;DR: Add the HTTP action, set Method and URI, supply the API's authentication and test the response; generic HTTP needs premium rights, while supported SharePoint REST calls can use the standard SharePoint connector.

Checked 19 October 2026. Start with the endpoint and operation you need. A service-specific HTTP action supports a defined API surface; a Microsoft 365 hostname alone does not make every request standard-tier or grant access.

Which HTTP action do you need?

Choose by connector support, then check the flow's license context. Microsoft identifies generic HTTP among premium-connector licensing errors. The connector reference classifies SharePoint as standard, while HTTP with Microsoft Entra ID connector is premium for Power Automate.

For standalone premium flows, check the owner for automated/scheduled runs and the caller for instant runs, unless appropriate capacity licensing applies. Qualifying app-context flows can use Power Apps rights; they must meet the association and user requirements in Microsoft's licensing FAQ. Premium entitlement does not override API permissions or tenant data policies.

How do you add the HTTP action to a cloud flow?

In Microsoft's current cloud-flow designer, select the plus icon where the request belongs. The Add an action pane opens; after choosing an action, configure it in the pane. Classic-designer layouts may instead show New step.

1. Open the flow, select plus and search for HTTP.
2. Select the generic HTTP action, checking the connector name rather than a similarly named service action.
3. Set Method and the full URI on the Parameters tab.
4. Add the API's headers, authentication and, when required, request body.
5. Save the flow, select Test and inspect that action's status, headers and body in the run details.

Use the Settings tab for retry and security options. A successful save checks configuration; it does not prove the endpoint accepts the request. The Flow Checker guide explains the validation stage.

How do you set up authentication?

Follow the target API's authentication scheme. Use its supported connection or authentication settings where appropriate. An API key belongs in the documented header, and Basic authentication should use the action's supported option over HTTPS. Do not assume every on-premises authentication scheme works through a generic HTTP action.

For a manual Entra app-only token request, Microsoft's client credentials documentation requires a form-encoded token body. Configure application permissions and required administrator consent before testing. This example shows the fields; substitute and URL-encode each value, and send the body as one line:

Method: POST
URI: https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded
Body: grant_type=client_credentials&client_id={encodedClientId}&client_secret={encodedSecret}&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default

If that action is named Get_token, a later request can set Authorization to Bearer @{body('Get_token')?['access_token']}. Match the token's audience to the API. Use its returned expires_in to plan renewal; there is no universal one-hour lifetime.

Protect token retrieval, credential-bearing requests and downstream consumers with Secure inputs and Secure outputs where applicable. These settings hide run-history values; they do not turn editor-visible literals into a vault. Use approved secret storage such as Azure Key Vault secret environment variables instead of treating an ordinary environment variable or connection reference as secret storage.

How do you parse the JSON response?

For an action named HTTP, use outputs('HTTP')?['statusCode'] for the status and body('HTTP') for its body. Update the action name if yours differs. A response that is already a JSON object can be accessed directly, for example body('HTTP')?['full_name'].

To expose fields as dynamic content, add Parse JSON, select the HTTP body as Content and generate a schema from a representative successful response. Microsoft's data operations guide describes sample-based schema generation. Check optional and nullable fields against other valid responses: a sample is not a complete API contract.

A missing field may yield null with safe navigation; a schema/type mismatch can fail Parse JSON. For arrays, iterate the actual array property rather than assuming every response is an array. Test an empty result and an API error response as separate cases.

What do HTTP requests look like in practice?

This public GET uses GitHub's repository API and needs no token for public repository metadata:

Method: GET
URI: https://api.github.com/repos/microsoft/PowerPlatformConnectors
Headers:
  Accept: application/vnd.github+json
  User-Agent: PowerAutomate-example

Expect a successful response with fields such as full_name and stargazers_count; counts change. Public endpoint checks on 19 October returned HTTP 200 outside Power Automate. Run your own flow test to check tenant policy and licensing too.

For a JSON POST, use your own test endpoint and its documented credentials. This is an illustrative order payload, not a live API:

Method: POST
URI: https://api.example.com/orders
Content-Type: application/json
Body: {"orderId":"demo-1001","amount":42,"status":"confirmed"}

For SharePoint, select Send an HTTP request to SharePoint and use the site's connection. Microsoft's SharePoint HTTP guidance limits the action to SharePoint REST. The URI is relative to the selected Site Address:

Site Address: https://contoso.sharepoint.com/sites/MySite
Method: GET
Uri: _api/web/lists/getbytitle('Orders')/items?$select=Id,Title
Headers: Accept: application/json;odata=nometadata

Replace the site and list with ones the connection user can read. The connector supplies connection authentication; it does not grant new SharePoint permissions. Treat value in this response as the list-item array.

What are the common failure modes?

First separate a flow that never starts from a request that fails after starting. For the former, use the trigger troubleshooting guide. For 401/403 responses, inspect the token, resource permissions, licensing and tenant policy; the authorization error guide covers those checks.

Microsoft's request limits set outbound synchronous requests at 120 seconds; asynchronous operations differ. Use an API's job/status pattern for long work. Increasing the designer's action timeout does not extend a single synchronous request's limit.

Inspect the actual retry settings instead of assuming four fixed retries. Before replaying a timed-out POST, check whether the server created the record; retries can duplicate a write. Follow the API's pagination contract, resolving relative next links against the correct base URL when needed.

How do you check the request before using it in production?

1. Confirm the selected connector supports the exact endpoint and operation.
2. Check the execution user's licensing, API permissions and secret handling.
3. Run a successful request and a valid empty or optional-field response through the parser.
4. Check failure handling and write idempotency before enabling automatic retries.

FAQ

Do I need a premium license for HTTP requests in Power Automate?

Generic HTTP needs premium rights, while SharePoint's supported REST action belongs to the standard SharePoint connector. The full flow's features and execution context determine the licensing requirement.

What is the difference between the HTTP action and Send an HTTP request to SharePoint?

Generic HTTP provides configurable outbound requests. The SharePoint action uses its connection for supported SharePoint REST operations and cannot serve as a general Microsoft Graph proxy.

How do I parse a JSON response in Power Automate?

Use the response body directly or add Parse JSON to expose fields as dynamic content. Generate a sample schema, then adjust it to the API's documented optional fields and types.

How do I add Bearer token authentication to a Power Automate HTTP request?

Use the API's supported OAuth connection or obtain a token with the required permissions and audience. For a manually fetched token, pass it in the Authorization header and protect the token action and its consumers in run history.

What is the HTTP action timeout in Power Automate?

The documented outbound synchronous request limit is 120 seconds. Asynchronous operations have different limits; check the connector and API's supported polling pattern.

Why are my HTTP trigger issues causing flows not to run at all?

A trigger starts the flow; an outbound HTTP action runs after it starts. If there is no run, investigate the trigger before changing the HTTP action's headers or response parser.