Http

An HTTP Source in Flowlyze reads and acquires data from remote endpoints over HTTP/HTTPS, typically exposed by web services, REST APIs, or microservices.
Data is processed as JSON, the standard for structured inter-system exchange.

Advanced HTTP Source configurations let you flexibly control many aspects of integration.

Incremental reading (Delta Reading)

Configure the HTTP source to perform incremental reads, i.e., only new or changed data since the last run.
This uses Flowlyze’s memory and reduces transferred data volume.

Payload parsing

Define parsing and transformation rules for the JSON payload returned by the HTTP endpoint using JSONPath expressions to identify fields, extract portions of data, or reshape the message for the downstream flow.

Parsing options are available in the Source settings:

Field	Description
Extract From Response Field	JSONPath expression (or multiple comma-separated expressions) pointing to the records in the response. If left empty, Flowlyze applies the default parsing rules described below.
Wrap as Single Object	When enabled, extracted records are combined into a single JSON message instead of being sent as separate messages.
Wrap Under Target Field	Custom key used to nest extracted data when Wrap as Single Object is active. If empty, arrays are placed under the data key, while a single object is used directly as the message root.

Default behavior (without dataField)

When Extract From Response Field is not set, Flowlyze parses the entire JSON response:

• If the response is a JSON array, each array element becomes a separate message.
• If the response is a JSON object:
  • if it contains a data field of type array, each element in data becomes a separate message;
  • otherwise, the whole object is treated as a single message.

Custom extraction with JSONPath (dataField)

When Extract From Response Field is set, Flowlyze uses JSONPath to locate data in the response. You can provide multiple comma-separated expressions to extract data from several paths at once.

For each matched value:

• if it is an array, each element is added as a message;
• if it is an object, it is added as a single message;
• if it is a primitive value (string, number, boolean, null), it is wrapped as { "value": <value> }.

Example: if the response is:

{
  "meta": { "page": 1 },
  "result": {
    "items": [{ "id": 1 }, { "id": 2 }]
  }
}

with dataField = $.result.items, two messages are extracted: { "id": 1 } and { "id": 2 }.

Combining into a single message (isSingleObject)

With Wrap as Single Object enabled, all extracted records are merged into one message before being sent to the flow:

• if Wrap Under Target Field is set (e.g. result), extracted data is nested under that key: a single record remains an object, multiple records become an array;
• if Wrap Under Target Field is empty:
  • with multiple records, the result is { "data": [ ... ] };
  • with a single record, the message is the extracted object itself.

Example: extracting three records with Wrap as Single Object enabled and no Wrap Under Target Field produces:

{
  "data": [{ "id": 1 }, { "id": 2 }, { "id": 3 }]
}

With the same settings and Wrap Under Target Field = items:

{
  "items": [{ "id": 1 }, { "id": 2 }, { "id": 3 }]
}

Supported authentication modes

OAuth2 (Bearer Token)

What it does: obtains an access token from an Authorization Server and sends it as Authorization: Bearer <token>.

When to use: modern enterprise/public APIs (OpenAPI), strong security, token expiry/rotation, scopes/permissions.

Typical Flowlyze config

• Grant type: commonly Client Credentials for server-to-server (or Authorization Code for interactive users)
• Token URL: OAuth2 endpoint (e.g., https://auth.example.com/oauth/token)
• Client ID / Client Secret
• Scope (optional)
• Outbound header: Authorization: Bearer {{access_token}} (inserted automatically)

Custom JWT Bearer

What it does: builds a signed JWT (typically RS256) with agreed claims and either sends it directly as Bearer or exchanges it for an access token at a custom endpoint.

When to use: proprietary APIs requiring a signed JWT instead of a standard OAuth token, or a custom “JWT → access token” flow.

Typical Flowlyze config

• Algorithm: RS256/ES256/HS256 (usually RS256)

• Private key / Key ID (kid)

• Claims: iss, sub, aud, iat, exp, plus custom claims

• Token emission:

  • Direct Bearer: send JWT as Authorization: Bearer <jwt>
  • Exchange: send JWT to an endpoint to obtain an access token, then use as Bearer

Final header example (direct bearer)

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Template Variable (optional)

Controls where the obtained token is used:

• Not specified (default): the token is automatically added to the Authorization: Bearer <token> header.
• Specified: the token is not sent in the Authorization header; instead it replaces the {{variableName}} placeholder in configurable HTTP request fields (URL, headers, query string, body).

In the Template Variable field, enter only the variable name (e.g. templateVariableField); in other fields use the same Handlebars syntax, e.g. {{templateVariableField}}.

Example (token in URL)

• URL: http://example/{{templateVariableField}}/test
• Template Variable: templateVariableField

Flowlyze replaces {{templateVariableField}} with the generated token value.

Custom Auth Token

What it does: obtains an access token by calling a custom endpoint (typically via POST with a JSON body) and uses it to authenticate requests to the source API.

When to use: proprietary APIs with custom authentication flows that return a token in a JSON response field, without a standard OAuth2 flow.

Typical Flowlyze config

• Endpoint: authentication service URL (e.g. https://auth.example.com/token)
• JsonBody: JSON body sent in the authentication request
• Headers: optional additional headers for the authentication call
• TokenJsonPathField: name of the JSON response field containing the token (e.g. access_token)

Template Variable (optional)

Same behavior as Custom JWT Bearer: if not specified, the token goes in the Authorization header; if specified, it replaces {{variableName}} in request fields (URL, headers, query string, body).

Example (token in URL)

• URL: http://example/{{templateVariableField}}/test
• Template Variable: templateVariableField

Basic Auth

What it does: sends username:password Base64-encoded in the Authorization header.

When to use: legacy/internal services exposing Basic Auth over HTTPS.

Typical Flowlyze config

• Username
• Password
• Outbound header (automatic)

Note: Always use HTTPS; otherwise Basic Auth credentials are exposed.

API Key

What it does: sends a static key as header or query string.

When to use: simple/public services where OAuth is not required.

Typical Flowlyze config

• Key value
• Location: Header (e.g., x-api-key: <key>) or Query (e.g., ?apikey=<key>)

Complete example

https://api.example.com/data?filter=update_date>{{last_update}}

The {last_update} placeholder is set by Flowlyze with the last stored incremental value (e.g., max update_date).

If the API returns this structure:

{
  "data": [{}, {}, {}]
}

If Extract From Response Field is left empty, Flowlyze automatically detects the data array and sends each element as a separate message.