Dify Code and HTTP Request Nodes: Custom Logic and External APIs

Who this is for, and what you will be able to do

This guide is for builders who need a Dify workflow to do something the preset nodes cannot, such as a custom calculation or a call to an external API. After reading it, you will know how to write a code node function, which output limits to plan for, and how to configure an HTTP request node with the right method, authentication, body type and retries.

When to use a code node

The code node runs custom Python or JavaScript for complex data transformation, calculation and logic. Use it when a preset node cannot meet your processing need^[1].

Write the function

Define input variables to access data from other nodes, then reference them in the code. The function must return a dictionary that contains the output variables you have declared^[1]. A minimal function looks like this^[1]:

def main(input_variable: str) -> dict:
    # Process the input
    result = input_variable.upper()
    return {
        'output_variable': result
    }

Python or JavaScript

Both languages run in a secure sandbox and can access common data-processing libraries^[1]. Python includes standard library modules such as json, math, datetime and re, which suit data analysis, mathematical operations and text processing^[1]. This example averages a list and rounds the result up^[1]:

def main(data: list) -> dict:
    import json
    import math
    
    average = sum(data) / len(data)
    return {'result': math.ceil(average)}

JavaScript provides standard built-in objects and methods, which suit JSON and string operations^[1]. This example converts each item of a list to upper case^[1]:

function main(data) {
    const processed = data.map(item => item.toUpperCase());
    return { result: processed };
}

Retries and error handling

Failed code execution can be retried automatically, up to 10 times with an interval of up to 5000 ms, which helps with temporary processing problems^[1]. Error handling lets you define a fallback path for when the code fails, so the workflow can keep running^[1].

Output limits

A node fails when its output exceeds any of these limits^[1]:

• Strings: 400,000 characters.
• Numbers: plus or minus 9,223,372,036,854,775,807. Return larger numbers, such as long IDs, as strings.
• Decimals: 20 decimal places.
• Nested objects: 3 levels in an object output; arrays do not count as a level.
• Array elements: 500 elements for array[string], array[object] and array[number] outputs.

Before returning, trim or split overly long strings and arrays, and flatten objects that are nested too deeply^[1].

What the sandbox allows

Code runs in an isolated sandbox that blocks file system access and system commands, which keeps code execution separate from the underlying infrastructure^[1]. Do not try to read system files or run shell commands. Use the input variables and the libraries available in the sandbox instead^[1].

External packages

Both Python and JavaScript can import external dependencies. The sandbox has a preinstalled set of standard packages, and importing a package outside that set fails at execution^[1]. This Python example uses numpy and pandas^[1]:

# Python: Import numpy, pandas, requests, etc.
import numpy as np
import pandas as pd

def main(data: list) -> dict:
    df = pd.DataFrame(data)
    return {'mean': float(np.mean(df['values']))}

Call external APIs with the HTTP request node

The HTTP request node connects a workflow to external APIs and web services. Use it to fetch data, send webhooks, upload files or integrate with any service that accepts HTTP requests^[2].

Choose the method

GET retrieves data without changing anything. HEAD returns only the response headers. POST sends data and is usually used to create a resource. PUT creates or fully replaces a resource. PATCH partly updates a resource. DELETE removes a resource^[2].

Insert variables

Reference workflow variables with {{variable_name}}. Deep object access works too, so a nested value can be extracted with a path such as {{api_response.data.items[0].id}}^[2]. Secret-type environment variables appear masked in workflow run logs and in the node's request logs^[2].

Set timeouts and authentication

Connection, read and write timeouts are all configurable. They cover the maximum time to establish a connection, to read the response data and to send the request data^[2].

The no-auth type (type "no-auth") adds no header. The API key type has three subtypes: basic, which adds a base64-encoded Basic header; bearer, which adds an Authorization: Bearer token header; and custom, which adds a header with the name and value you specify^[2].

Choose the body type

Use JSON for structured data, form data for traditional web forms, binary for file uploads, and raw text for custom content types^[2].

Files and responses

Responses are detected as files using Content-Disposition, the MIME type and, for ambiguous types, sampling of the first 1024 bytes. Text responses such as JSON, XML and HTML are treated as regular data, while binary content becomes a file variable^[2]. Downstream nodes can read the response body, status code, headers, files and size information, which is shown in readable units such as KB or MB^[2].

SSL verification and retries

SSL certificate verification can be configured per node with the ssl_verify parameter. This lets the node connect to internal services that use self-signed certificates while external APIs stay verified^[2]. Failed HTTP requests can be retried automatically up to 10 times, with an interval of up to 5000 ms, to handle temporary network problems or service unavailability^[2].

Next steps

For the full configuration options of both nodes, see the Dify documentation^[1][2].

Adapted from the Dify documentation pages *Code* and *HTTP request*^[1][2], released under the CC BY 4.0 license.