> For the complete documentation index, see [llms.txt](https://docs.getmesa.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.getmesa.com/tools/web-request.md).

# Web Request

Create a unique URL with the MESA Web Request trigger that runs a full workflow and returns the last step result, handy for single page apps and proxies.

The **Web Request** [trigger](https://docs.getmesa.com/workflow-builder/triggers/) creates a unique URL that you can call to execute a MESA workflow. Unlike the [Webhook](https://docs.getmesa.com/tools/webhook/) trigger, the entire workflow will execute, and the result of the last step in the workflow will be returned as the response. Using the **Web Request** trigger, you can retrieve Shopify Customer Metadata values to use in your single page app, proxy an API call to a third party app, or even display an HTML table of data stored in a [Data](https://docs.getmesa.com/tools/data/) table. If you would like to combine data retrieved from multiple steps in your response, we recommend making the last step of your workflow a Mapping or Editor [Transform](https://docs.getmesa.com/tools/transform/) action.

## Configuration

### Passing Data

Querystring parameters appended to your URL will be available as [Variables](https://docs.getmesa.com/workflow-builder/fields/variables/) in your workflow. For example, if you append `&limit=1` to the **Web Request URL**, it will be available as the `{{webrequest.querystring.limit}}` variable. To easily select the variable from the Variable selector modal, make a test request and refresh the builder. The querystring parameters sent in your previous workflow run will appear in the variable selector:

<figure><img src="https://docs.getmesa.com/assets/DW-web-request-querystring%20%282%29.png" alt="Screenshot of the MESA variable selector modal after a Web Request test run showing the querystring parameters from the previous run. Spotlight the webrequest querystring variables."><figcaption></figcaption></figure>

If you make a POST request to the **Web Request** trigger, all data passed will be available in the body variable. For example: `{{webrequest.querystring.id}}`. Similar to querystring parameters, to see these variables in the variable selector model, make a test request and refresh the builder.

All headers passed in the request are also available as variables. For example, you could use the `Authorization` header to authenticate requests in a [Custom Code](https://docs.getmesa.com/tools/custom-code/) step

### Custom Response Headers

The Response Headers returned by the completed automation can be customized under the **More options** section. Change the `Content-Type` value to `text/xml` and end your workflow with a Transform Editor step to return an XML document. Change the `Content-Type` to `text/html` and end your workflow with a Transform Editor step to return an HTML document that will render in the browser:

<figure><img src="https://docs.getmesa.com/assets/Edit%20Automation%20Head%20Tag%20-%20Step%200.png" alt="Screenshot of the Web Request trigger More options section for customizing Response Headers. Spotlight the Content-Type header value."><figcaption></figcaption></figure>

You can make the response a redirect by including a `code` of either 301 or 302 and `location` in the response in the last step of your workflow:

<figure><img src="https://docs.getmesa.com/assets/Theshoppad%20Workflow%20-%20Step%200%20%281%29.png" alt="Screenshot of the last step of a workflow returning a redirect response with a code of 301 or 302 and a location. Spotlight the code and location response values."><figcaption></figcaption></figure>

You can remove the `.json` in the URL or replace it with `.html` or `.xml` to improve the clarity of your endpoints as well, but simply changing the URL suffix will do nothing if the `Content-Type` header is not changed as well.

<figure><img src="https://docs.getmesa.com/assets/DW-web-request-transform-editor%20%281%29.png" alt="Screenshot of the Web Request trigger URL where the .json suffix can be changed to .html or .xml. Spotlight the Web Request URL suffix."><figcaption></figcaption></figure>

The `Access-Control-Allow-Origin` and `Access-Control-Allow-Headers` headers can be customized to fine-tune your [CORS](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) security settings, and additional custom headers can be added with static values or values from variables passed from other steps.

### Technical Notes

* Each request executes a workflow and counts as an automation run. You can see a history of all automation runs within the[ Activity](https://docs.getmesa.com/workflow-activity/) tab.
* Requests are rate-limited based on the [Incoming rate limit](https://docs.getmesa.com/going-further/platform-thresholds-and-limits/#limits) of your plan.
* The maximum request time is limited based on the [Task compute](https://docs.getmesa.com/going-further/platform-thresholds-and-limits/#limits) limit of your plan. There is also a limit of 60 seconds per request, even if your plan allows longer requests. Requests that take more time to execute will be timed out, and no response will be returned.
* Certain actions, including Loop and Delay, are not supported by the Web Request tool. If you need to delay a couple of seconds, you might be able to use [Mesa.request.sleep](https://docs.getmesa.com/tools/custom-code/sdk?q=sle#vendor-mesa.js-mesa.request.sleep) in a Custom Code step.
* The URL of your Web Request trigger is static and includes a mandatory `apikey` querystring parameter. If you want a shorter URL, we recommend using a URL shortener service like [bit.ly](http://bit.ly/).