[One Workflow] Migrate http step to new connector by semd · Pull Request #249004 · elastic/kibana

semd · 2026-01-14T13:25:57Z

Summary

Replaces the internal http workflow step with a new workflows-specific http connector, preserving the existing step interface while enabling connector-backed HTTP execution.

Issue:

https://github.com/elastic/security-team/issues/15301

Context

Workflows currently expose an internal http step type that allows arbitrary HTTP requests to be executed directly from workflow definitions. This implementation is self-contained and bypasses the connector framework.

The goal is to support HTTP requests backed by connectors in order to gain:

Secure secret and credential management
Reusability across workflows
Centralized configuration (e.g. base URL, authentication, default headers)

At the same time, we want to avoid introducing breaking changes to existing workflows.

Why introduce a new `.http` connector

The internal http step solves parameter flexibility, but comes with significant drawbacks:

No secret or credential management
Authentication details must be embedded directly in workflow definitions
No reuse or centralized configuration

We considered extending the webhook connector to support dynamic parameters, but rejected this option due to its widespread usage across other teams and products, and the risk of introducing behavioral changes or additional complexity outside of workflows.

Instead, this PR introduces a new workflows-specific http connector, derived from the webhook connector implementation but designed to:

Allow dynamic request parameters at execution time
Leverage the connector framework for secrets and credentials
Transparently replace the internal http step (same step signature), avoiding breaking changes

This effectively migrates workflows from an internal HTTP implementation to a connector-backed model while maintaining backward compatibility.

Screenshots

No available from the stack connectors creation flow:

Captura de pantalla 2026-02-11 a les 13 40 20

Connector creation flow available from within Workflows:

Captura de pantalla 2026-02-11 a les 13 43 04

Captura de pantalla 2026-02-11 a les 13 46 59

Configuration:

Captura de pantalla 2026-01-16 a les 16 38 54

Captura de pantalla 2026-01-16 a les 16 38 32

Captura de pantalla 2026-01-16 a les 16 38 17

Usage:

With connector-id.

Without connector-id.

…ctor

semd · 2026-01-14T15:29:25Z

/ci

…ector

semd · 2026-01-16T14:35:03Z

/ci

semd · 2026-01-16T15:48:52Z

/ci

semd · 2026-01-19T13:32:12Z

/ci

…ector' into workflows_http_connector

semd · 2026-02-19T16:55:32Z

@elasticmachine merge upstream

pmuellr

I didn't look at the significance of the removed tests, but figured I'd ask if we can keep them somehow - maybe there is a good reason we should remove them! Not sure :-)

Also, the CODEOWNERS comment ...

Kiryous

Thanks for this foundational work! LGTM

pmuellr

ResponseOps changes LGTM

semd · 2026-02-23T08:53:24Z

@elasticmachine merge upstream

elasticmachine · 2026-02-23T08:53:27Z

merge conflict between base and head

…ector' into workflows_http_connector

elasticmachine · 2026-02-24T09:46:10Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: d1bc879

Failed CI Steps

Test Failures

[job] [logs] Jest Tests #11 / Header QueryTabHeader should render the immutable timeline call out providers

History

💔 Build #399523 failed ace9f6d
💔 Build #398000 failed 272496f
💔 Build #395257 failed 280a1f0
💚 Build #394094 succeeded 091e9ce
💔 Build #394079 failed 2c9136d

cc @semd

…ps-config-rebase * commit 'f135f030951237c5e9b0251931441aee3121b31d': (163 commits) [CPS] Support data view requests and do not sanitize project_routing in data plugin/resolve indices (elastic#253654) [One Workflow] Execute workflow from historical (elastic#253396) [streams][background tasks] gracefully handle non existing stream (elastic#254683) [Lens API] Waffle/Mosaic get green as a default color (elastic#254304) [Security Solution] Remove prebuilt rules customization callout on Rule Management page (elastic#254386) [Workflows] support passing attachments to run_agent step (elastic#251291) [One Discover][Logs UX] Update OpenTelemetry Semantic Conventions (elastic#254367) [kbn-es] Add --docker flag to yarn es snapshot (elastic#254306) [Workplace AI] Remove Data Source Config (elastic#254521) [Entity Store v2] Add CRUD API (elastic#252052) [CI] Increase type checking machine (elastic#254676) [main] Sync bundled packages with Package Storage (elastic#254232) Skip flaky test elastic#254625 (elastic#254662) Upgrade `@elastic/elasticsearch` to 9.3.1 (elastic#253660) [One Workflow] Migrate http step to new connector (elastic#249004) [Entity Store] Store EUID Scripts (elastic#254515) [APM] Fix Otel missing fields undefined errors (elastic#254271) [Console] Add support for documentation links on Serverless (elastic#254489) Create edit ILM flow (elastic#253393) [Agent Builder] Mid term: minimal recommended model set elastic#12875 (elastic#254560) ...

## Summary Replaces the internal `http` workflow step with a new workflows-specific `http` connector, preserving the existing step interface while enabling connector-backed HTTP execution. Issue: * elastic/security-team#15301 ## Context Workflows currently expose an internal `http` step type that allows arbitrary HTTP requests to be executed directly from workflow definitions. This implementation is self-contained and bypasses the connector framework. The goal is to support HTTP requests backed by connectors in order to gain: * Secure secret and credential management * Reusability across workflows * Centralized configuration (e.g. base URL, authentication, default headers) At the same time, we want to avoid introducing breaking changes to existing workflows. ## Why introduce a new `.http` connector The internal `http` step solves parameter flexibility, but comes with significant drawbacks: * No secret or credential management * Authentication details must be embedded directly in workflow definitions * No reuse or centralized configuration We considered extending the webhook connector to support dynamic parameters, but rejected this option due to its widespread usage across other teams and products, and the risk of introducing behavioral changes or additional complexity outside of workflows. Instead, this PR introduces a new workflows-specific `http` connector, derived from the `webhook` connector implementation but designed to: * Allow dynamic request parameters at execution time * Leverage the connector framework for secrets and credentials * Transparently replace the internal `http` step (same step signature), avoiding breaking changes This effectively migrates workflows from an internal HTTP implementation to a connector-backed model while maintaining backward compatibility. ### Screenshots No available from the stack connectors creation flow: <img width="965" height="599" alt="Captura de pantalla 2026-02-11 a les 13 40 20" src="https://github.com/user-attachments/assets/cf721676-a8ee-4b42-98c8-882bd6f33f6f" /> Connector creation flow available from within Workflows: <img width="727" height="227" alt="Captura de pantalla 2026-02-11 a les 13 43 04" src="https://github.com/user-attachments/assets/fd27e989-5991-4f61-b17e-d5dbf12d58f6" /> <img width="1351" height="862" alt="Captura de pantalla 2026-02-11 a les 13 46 59" src="https://github.com/user-attachments/assets/dff8a29d-3220-437c-af6d-22f21f342f5c" /> #### Configuration: <img width="964" height="937" alt="Captura de pantalla 2026-01-16 a les 16 38 54" src="https://github.com/user-attachments/assets/c538f341-d6c6-44b8-bb86-affbb1266a99" /> <img width="964" height="937" alt="Captura de pantalla 2026-01-16 a les 16 38 32" src="https://github.com/user-attachments/assets/b527117a-65fb-4d97-8654-e338ce24c11f" /> <img width="964" height="937" alt="Captura de pantalla 2026-01-16 a les 16 38 17" src="https://github.com/user-attachments/assets/3051bab6-f1fb-44a2-b0cc-4ed40be0c1d7" /> #### Usage: With `connector-id`. <img width="1450" height="607" alt="Captura de pantalla 2026-01-16 a les 16 52 19" src="https://github.com/user-attachments/assets/ac09aaf2-e74f-43b5-af68-c9d28bac8de2" /> Without `connector-id`. <img width="1450" height="607" alt="Captura de pantalla 2026-01-16 a les 16 51 23" src="https://github.com/user-attachments/assets/a6d14213-0886-430e-ab22-83d293292059" /> --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…256084) ## Summary Follow-up of: - #249004 We missed the serverless `enabledActionTypes` configs when implementing the new connector. It needs to be enabled for: - es - observability (logs essentials): Workflows disabled in this tier, but just in case it's enabled someday So workflows don't crash when using `.http` and `.http-system` connectors. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…lastic#256084) ## Summary Follow-up of: - elastic#249004 We missed the serverless `enabledActionTypes` configs when implementing the new connector. It needs to be enabled for: - es - observability (logs essentials): Workflows disabled in this tier, but just in case it's enabled someday So workflows don't crash when using `.http` and `.http-system` connectors. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary Replaces the internal `http` workflow step with a new workflows-specific `http` connector, preserving the existing step interface while enabling connector-backed HTTP execution. Issue: * elastic/security-team#15301 ## Context Workflows currently expose an internal `http` step type that allows arbitrary HTTP requests to be executed directly from workflow definitions. This implementation is self-contained and bypasses the connector framework. The goal is to support HTTP requests backed by connectors in order to gain: * Secure secret and credential management * Reusability across workflows * Centralized configuration (e.g. base URL, authentication, default headers) At the same time, we want to avoid introducing breaking changes to existing workflows. ## Why introduce a new `.http` connector The internal `http` step solves parameter flexibility, but comes with significant drawbacks: * No secret or credential management * Authentication details must be embedded directly in workflow definitions * No reuse or centralized configuration We considered extending the webhook connector to support dynamic parameters, but rejected this option due to its widespread usage across other teams and products, and the risk of introducing behavioral changes or additional complexity outside of workflows. Instead, this PR introduces a new workflows-specific `http` connector, derived from the `webhook` connector implementation but designed to: * Allow dynamic request parameters at execution time * Leverage the connector framework for secrets and credentials * Transparently replace the internal `http` step (same step signature), avoiding breaking changes This effectively migrates workflows from an internal HTTP implementation to a connector-backed model while maintaining backward compatibility. ### Screenshots No available from the stack connectors creation flow: <img width="965" height="599" alt="Captura de pantalla 2026-02-11 a les 13 40 20" src="https://github.com/user-attachments/assets/cf721676-a8ee-4b42-98c8-882bd6f33f6f" /> Connector creation flow available from within Workflows: <img width="727" height="227" alt="Captura de pantalla 2026-02-11 a les 13 43 04" src="https://github.com/user-attachments/assets/fd27e989-5991-4f61-b17e-d5dbf12d58f6" /> <img width="1351" height="862" alt="Captura de pantalla 2026-02-11 a les 13 46 59" src="https://github.com/user-attachments/assets/dff8a29d-3220-437c-af6d-22f21f342f5c" /> #### Configuration: <img width="964" height="937" alt="Captura de pantalla 2026-01-16 a les 16 38 54" src="https://github.com/user-attachments/assets/c538f341-d6c6-44b8-bb86-affbb1266a99" /> <img width="964" height="937" alt="Captura de pantalla 2026-01-16 a les 16 38 32" src="https://github.com/user-attachments/assets/b527117a-65fb-4d97-8654-e338ce24c11f" /> <img width="964" height="937" alt="Captura de pantalla 2026-01-16 a les 16 38 17" src="https://github.com/user-attachments/assets/3051bab6-f1fb-44a2-b0cc-4ed40be0c1d7" /> #### Usage: With `connector-id`. <img width="1450" height="607" alt="Captura de pantalla 2026-01-16 a les 16 52 19" src="https://github.com/user-attachments/assets/ac09aaf2-e74f-43b5-af68-c9d28bac8de2" /> Without `connector-id`. <img width="1450" height="607" alt="Captura de pantalla 2026-01-16 a les 16 51 23" src="https://github.com/user-attachments/assets/a6d14213-0886-430e-ab22-83d293292059" /> --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…lastic#256084) ## Summary Follow-up of: - elastic#249004 We missed the serverless `enabledActionTypes` configs when implementing the new connector. It needs to be enabled for: - es - observability (logs essentials): Workflows disabled in this tier, but just in case it's enabled someday So workflows don't crash when using `.http` and `.http-system` connectors. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

semd added 7 commits December 17, 2025 13:27

new api connector

ab3931d

test params form

6ad1c19

Merge remote-tracking branch 'upstream/main' into workflows/api_conne…

49194ac

…ctor

Merge remote-tracking branch 'upstream/main' into workflows/api_conne…

e0c80fb

…ctor

api connector

293db76

introduce new http connector step

010fdd2

solve conflict

ca005d0

semd self-assigned this Jan 14, 2026

semd added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:One Workflow Team label for One Workflow (Workflow automation) v9.4.0 labels Jan 14, 2026

semd added 2 commits January 14, 2026 15:30

fix types

61e7393

fix isHttp type

c802a5f

semd added 2 commits January 16, 2026 11:44

Merge remote-tracking branch 'upstream/main' into workflows_http_conn…

8a97e42

…ector

fix tests

3f2d452

semd added ci:cloud-deploy Create or update a Cloud deployment ci:cloud-persist-deployment Persist cloud deployment indefinitely labels Jan 16, 2026

semd added 2 commits January 16, 2026 16:27

new connector formalizations

9c7b53b

fix test

325cb59

semd changed the title ~~[One Workflows] Http connector step replacement~~ [One Workflows] Migrate http step to new connector Jan 19, 2026

fix more test

c8d72cc

semd marked this pull request as ready for review January 19, 2026 13:32

semd requested review from a team as code owners January 19, 2026 13:32

fix test snapshot

a184a54

semd and others added 9 commits February 12, 2026 14:57

add keepAlive to httpAgent

6013d6e

Changes from node scripts/eslint_all_files --no-cache --fix

a7fc502

add ftr test for http connector

bcf9e70

add test for http connector

d01b0c8

update http simulator

2c9136d

Changes from node scripts/eslint_all_files --no-cache --fix

091e9ce

add keep-alive comment

d46dbbb

conflict solved

e655bdd

Merge remote-tracking branch 'refs/remotes/origin/workflows_http_conn…

280a1f0

…ector' into workflows_http_connector

Merge branch 'main' into workflows_http_connector

272496f

pmuellr reviewed Feb 20, 2026

View reviewed changes

pmuellr requested changes Feb 20, 2026

View reviewed changes

Kiryous approved these changes Feb 20, 2026

View reviewed changes

pmuellr approved these changes Feb 20, 2026

View reviewed changes

semd added 3 commits February 23, 2026 18:25

solve conflicts

c7b484d

Merge remote-tracking branch 'refs/remotes/origin/workflows_http_conn…

ace9f6d

…ector' into workflows_http_connector

remove old impl

d1bc879

semd merged commit f68f7c3 into elastic:main Feb 24, 2026
16 checks passed

semd mentioned this pull request Feb 24, 2026

[One Workflow] Fix url param of http step to render templates #254732

Merged

semd mentioned this pull request Mar 5, 2026

[One Workflow] Add new http connectors to enabledActionTypes configs #256084

Merged

Conversation

semd commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Why introduce a new .http connector

Screenshots

Configuration:

Usage:

Uh oh!

semd commented Jan 14, 2026

Uh oh!

semd commented Jan 16, 2026

Uh oh!

semd commented Jan 16, 2026

Uh oh!

semd commented Jan 19, 2026

Uh oh!

semd commented Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pmuellr left a comment

Choose a reason for hiding this comment

Uh oh!

Kiryous left a comment

Choose a reason for hiding this comment

Uh oh!

pmuellr left a comment

Choose a reason for hiding this comment

Uh oh!

semd commented Feb 23, 2026

Uh oh!

elasticmachine commented Feb 23, 2026

Uh oh!

elasticmachine commented Feb 24, 2026

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

semd commented Jan 14, 2026 •

edited

Loading

Why introduce a new `.http` connector