HTTP and egress
Calling webhooks and LAN devices from a smart app, and the addresses the hub refuses.
httpRequest({
url: 'https://hooks.example.com/novon',
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ event: 'garage-open', at: new Date().toISOString() }),
});httpRequest is fire-and-forget: it returns { ok, reason? } describing whether the request was
accepted (URL and policy checks), the hub performs it off-thread, and the response is never visible to
your code. Failures are logged on the hub. If you need the response, that work belongs in an
integration, whose novon.http returns the body.
What you can reach
| Destination | Allowed |
|---|---|
public internet over http / https | yes |
LAN devices (RFC1918: 10/8, 172.16/12, 192.168/16) | yes |
| the hub itself (loopback) | no |
link-local and cloud metadata (169.254.0.0/16) | no |
| multicast, unspecified addresses | no |
other schemes (ftp:, ws:) | no |
The check runs on the URL and again on every resolved IP at connect time, so a hostname that later resolves to a blocked address is refused too. Redirects are not followed. The generated table is on Egress policy.
Patterns
- Webhooks out (chat, IFTTT, a home server): include what happened and when in the body; keep secrets in the URL path or a header, not in logs.
- LAN devices without an integration: a
GETto a device's HTTP API is fine for "do this", but you cannot read its answer; if you need state, write an integration. - Retries: there are none. If the call matters, send it and also record the intent in
stateso a later handler can notice it was never acknowledged.
Methods: GET, POST, PUT, PATCH, DELETE. headers values must be strings; body is sent
verbatim, so set Content-Type yourself.