Call external services over HTTPS

Call an external service from a backend module

Production modules use BlinkHost's guarded HTTP host capability. A request supplies an HTTPS URL, method, headers and optional text body. Runtime policy must permit outbound HTTP. General outbound HTTPS is currently disabled in preview; a working production call is not evidence of preview parity.

This path can call a database provider's HTTPS API, but doing so does not use a native database binding. Your application owns provider credentials, request idempotency and outcome reconciliation. It does not gain the native receipt, primary/session read or replica contract.

Destination and resource boundaries

The client rejects URL credentials and IP literal destinations, validates resolved addresses, disables redirects and ambient proxies, and applies bounded request/response sizes and a five-second client timeout. These safeguards do not make every public service trustworthy.

Scoped module rules, when published through a compatible rollout, restrict exact canonical hostnames, ports and methods. Wildcards and private-network exceptions are not supported. Organization rules act as ceilings. A present empty module rule denies access; a historical policy omitting the scoped field retains coarse outbound permissions during migration. Check your project's effective policy rather than assuming a destination allowlist exists.

Calls charge operations and request/response body bytes. Accounting is not a measurement of all TLS/socket traffic. Responses are text; this interface is unsuitable for arbitrary binary files or large upload bodies. Use Hosted Object Storage for supported application uploads.

An uncertain response is not a failed effect

The versioned response distinguishes:

Outcome	Meaning
not_sent	This attempt did not send the external request. It does not settle a different earlier attempt.
response_received	An HTTP response arrived. Interpret its status and body using the provider's contract; it is not automatically business success.
unknown	The provider may have processed the request despite a timeout, cancellation or response failure.

BlinkHost does not automatically retry external mutations. Persist a business operation ID, use the provider's idempotency key when supported, and query its status before retrying uncertain work. A new random ID after a timeout can duplicate a payment or email.

Commit application state and a durable outbox together in the application's sole database, then perform external work outside the transaction. Record and reconcile outcomes. An outbox is application logic; it does not imply that a managed background worker is automatically created.

A module allowed to read a secret can disclose it through permitted HTTP, its response or its own logs. Destination rules reduce exposure but are not a substitute for trustworthy application code and authorization.