ioLoop Docs

Appearance

API Call Connection ​

The API Call Connection configures a reusable HTTP request to an external API. Use it when a Project needs to call an endpoint that is not covered by another Connection service or when a fixed endpoint should be selectable from Page Flow and Cloud Flow.

Authentication belongs to the Profile. The endpoint, HTTP method, content type, default request data, and query parameters belong to the Connection. This lets several API Call Connections reuse the same credentials while targeting different operations.

Capabilities ​

CapabilityAvailability
Connection service identifierapicall
Page Flow commandInvoke
Cloud Flow commandInvoke
Server API$io.apicall
Connection methodinvoke
Authenticated SDK objectNot applicable

The Invoke command supports both client and server contexts. A Page Flow call is initiated by the browser but executed by the server.

Preparing the External API ​

Before creating the Connection, obtain:

  • The endpoint URL.
  • The HTTP method.
  • The required authentication scheme and credential.
  • Any fixed request headers.
  • The expected request body or query parameters.
  • The provider's timeout and rate-limit expectations.

Do not put credentials into the URL, default data, or Page Flow values when the Profile can apply them securely.

Profile Settings ​

Create or select an API Call Profile. The Profile provides:

SettingPurpose
Authorization TypeSelect none, Basic, Bearer, or Custom.
User NameSupplies the user name used by Basic authorization.
SecretSupplies the password, token, API key, or custom authorization value.
Additional Request HeadersAdds Profile-level headers as a JSON object.
Send Secret via POST DataWhen enabled, parses the Secret as JSON and adds it to supported request bodies.

Use valid JSON for additional headers and POST data. Keep a Profile limited to credentials that are intentionally shared by its Connections.

Connection Settings ​

SettingPurpose
URLThe HTTP or HTTPS endpoint.
Request TypeGET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS.
Additional Request HeadersConnection-specific headers represented as JSON.
Post Content TypeDefault JSON, Form, or Multipart Form for request methods with a body.
Request DataDefault request body values represented as JSON.
Request ParametersDefault query-string values represented as JSON.
TimeoutMilliseconds before the request times out; the default is 10,000 milliseconds.

Command input can add dynamic data and query parameters to the configured values. It can also supply a URL override. Do not allow untrusted input to replace the URL unless the application intentionally permits calls to that destination and validates it on the server.

Access ​

The Connection exposes an Invoke/Execute Access operation. Public access is permitted by the service but produces a warning.

Public invocation can allow unauthenticated users to consume provider quotas, send data to an external system, or reach a URL using the Project's credentials. Restrict the operation to appropriate User Groups unless public use is an intentional, validated requirement.

Using the Connection ​

For Page Flow, select the Connection and the Invoke command with Execute Connection Command. Supply dynamic data, params, or an approved URL override as needed.

For Cloud Flow, use the same command, the Connection Function Call block with the invoke method, or the documented $io.apicall API.

Prefer Cloud Flow when the request requires trusted validation, sensitive data, response filtering, retries, or authorization beyond the Connection Access policy.

Testing ​

Test the configured URL and each intended HTTP method. Verify:

  • Authentication headers are accepted.
  • JSON settings parse correctly.
  • Dynamic data merges as expected.
  • Error responses and timeouts follow the failure path.
  • The response contains only data that is safe to return to the browser.

An API Call Connection can make real external changes during Preview and Cloud Flow testing.