When to reach for the HTTP module
Make's app modules cover the common endpoints. When the one you need is missing, you have two options: the app's own universal module, usually called Make an API Call, which, like the app's other modules, works through a connection to that app, [1] or the general HTTP app. The HTTP app has three modules: Make a request, Download a file and Resolve URL. [2]
Prefer an app's Make an API Call module when one exists, because authentication is already handled by the connection. Use HTTP Make a request for apps Make does not list, internal APIs, or public endpoints with no app at all.
The example call: GitHub Get a repository
GitHub documents a public REST endpoint, GET /repos/{owner}/{repo}, that returns a repository's details, including full_name, stargazers_count, open_issues_count and updated_at. [3] Requests go to GitHub's REST API host, api.github.com. [4] GitHub recommends an Accept header of application/vnd.github+json and an X-GitHub-Api-Version header; its examples show the versions 2022-11-28 and 2026-03-10, so pin whichever the endpoint page you follow shows. [4] [3] GitHub also rejects requests without a valid User-Agent header and suggests your GitHub username or app name as the value. [4]
Unauthenticated requests are limited to 60 an hour per originating IP address, while authenticated requests with a personal access token get 5,000 an hour. [5] For anything beyond a test, use a token.
| Make field [2] | Value for this example | Note |
|---|---|---|
| URL | GitHub's REST API host followed by /repos/OWNER/REPO | Make allows only https URLs and rejects self-signed certificates [2] |
| Method | GET | Options: GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS [2] |
| Authentication type | API key, with your token stored as a keychain | GitHub accepts Authorization: Bearer YOUR-TOKEN [4] |
| Headers | Accept: application/vnd.github+json; X-GitHub-Api-Version; User-Agent: your-app-name | Not for credentials or content type [2] |
| Query parameters | None for this endpoint | For list endpoints, add per_page and page [4] |
| Parse response | Yes | Turns the JSON into mappable items [6] |
| Return error if HTTP request fails | Yes | Stops on 4xx or 5xx [2] |
| Timeout | 30 seconds | Accepts 1 to 300 seconds [2] |
Query string or body, and how authentication fits
Query parameters are key-value pairs added to the URL, and Make notes they matter mostly for GET and DELETE. [2] GitHub's own events example adds per_page=2 and page=1 to return two results instead of the default thirty. [4] A request body is for POST, PUT and PATCH; Make offers application/JSON, multipart/form-data for file uploads, application/x-www-form-urlencoded, or Custom. [2] For JSON bodies, choosing a data structure as the input method escapes reserved characters for you, while a raw JSON string does not. [2]
For credentials, use the Authentication type field: No authentication, API key, Basic Auth or OAuth 2.0, with a keychain or connection holding the secret. [2] That keeps the token out of the visible module settings and lets you rotate it in one place. GitHub does not support basic authentication with a username and password; use a personal access token or an app token. [7]
Parse response, Parse JSON and data structures
Set Parse response to Yes. Make Academy's HTTP lesson calls it really important: without it, the Data output is one long string; with it, the response becomes a collection or array you can map field by field. [6] [2]
If you receive JSON as text from somewhere else, such as a webhook field or a stored value, use the JSON app's Parse JSON module. Give it a data structure so later modules can map individual items; if you skip that, run the scenario once and the module identifies the structure from the JSON it receives. [8] A JSON object becomes one bundle, while a top-level array becomes a series of bundles, one per item, [8] which multiplies the modules that run after it.
Make's data structure generator builds a structure from a pasted sample, which you can then edit. [9] Paste a real GitHub response from the run above into it rather than typing fields by hand.
Status codes and what each one means in Make
Make Academy notes that the HTTP module does not stop a scenario on 400 errors by default, so a bad request can flow on with no data. [10] Make's current HTTP documentation names the switch Return error if HTTP request fails; choose Yes to stop the scenario on any 4xx or 5xx response. [2] Make Academy's HTTP lesson calls the same idea Evaluate all states as errors (except for 2xx and 3xx), under Show advanced settings. [10] Once errors stop the module, error handlers and incomplete executions can take over.
| Status | What it means | GitHub specifics | What to do in Make |
|---|---|---|---|
| 200 | Request received and processed [10] | Repository details returned [3] | Map the parsed fields |
| 401 Unauthorized | Missing or invalid authentication credentials [11] | Basic username and password auth is not supported [7] | Check the keychain or connection; replace an expired token |
| 403 Forbidden | Valid credentials but no permission [11] | Also returned for an invalid User-Agent and for rate limits [4] [5] | Add a User-Agent header; check token permissions or rate-limit headers |
| 404 Not Found | Resource cannot be found [10] | GitHub returns 404 instead of 403 for private repositories it will not confirm exist [7] | Check the URL for typos, then the token's scopes and owner [7] |
| 429 Too Many Requests | Too many requests in a period; may include Retry-After [12] | Also 403 with x-ratelimit-remaining at 0; wait until x-ratelimit-reset [5] | Make's RateLimitError corresponds to HTTP 429; slow the scenario or add a delay [13] |
| 5xx or timeout | Server-side failure [10] | Requests taking over 10 seconds are terminated [7] | Retry later or simplify the request [7] |
Pre-flight checklist for any API call
Run through this before activating a scenario that depends on an HTTP call. Most first-call failures are one of these items.
- URL starts with https and has no trailing slash or typo. [2] [7]
- Credentials sit in Authentication type and a keychain, not in Headers. [2]
- Required headers are set: for GitHub, Accept, X-GitHub-Api-Version and User-Agent. [4]
- Parse response is Yes. [6]
- Return error if HTTP request fails is Yes, and the module has an error handler or the scenario stores incomplete executions. [2] [14]
- Timeout is set below the 300-second maximum unless the API is known to be slow. [2]
- You know the API's rate limit and have compared it with how often the scenario runs: for GitHub, 60 an hour unauthenticated and 5,000 with a token. [5]
- For instant scenarios, Maximum runs to start per minute is set to keep under that limit. [13]
Watch demos / Official walkthroughs
See how the tools work.
Videos load from YouTube only when you press play. These are provider videos, not our own product tests.
Make / Official video
Make—Building Your First Automated Workflow from Scratch
What to look for: Follow how modules connect and how data moves through the first workflow.
Watch on YouTubeQuestions before you decide
Why does my Make HTTP module return one long string instead of fields?
Parse response is off. Make Academy shows that without it the Data field is a single long string, and with it the JSON becomes a collection you can map. If you cannot change the module, pass the string to the JSON app's Parse JSON module with a data structure.
Does a 404 or 401 stop my Make scenario?
Not necessarily. Make Academy says the HTTP module does not stop a scenario on 400 errors by default. Make's HTTP documentation offers Return error if HTTP request fails; set it to Yes to stop on any 4xx or 5xx response so an error handler or incomplete execution can deal with it.
Where should I put an API key in the Make HTTP module?
Use the Authentication type field, which offers API key, Basic Auth and OAuth 2.0, and store the key in a keychain or connection. Make's HTTP documentation says the Headers field should not be used for credentials or content type.
How long will the Make HTTP module wait for a slow API?
The Timeout setting accepts 1 to 300 seconds. The API may give up sooner: GitHub, for example, terminates REST requests that take more than 10 seconds to process.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Make Help Center: Types of modules Accessed 30 Oct 2026
- Make Apps Documentation: HTTP Accessed 30 Oct 2026
- GitHub REST API: Get a repository Accessed 30 Oct 2026
- GitHub Docs: Getting started with the REST API Accessed 30 Oct 2026
- GitHub Docs: Rate limits for the REST API Accessed 30 Oct 2026
- Make Academy: HTTP GET Accessed 30 Oct 2026
- GitHub Docs: Troubleshooting the REST API Accessed 30 Oct 2026
- Make Apps Documentation: JSON Accessed 30 Oct 2026
- Make Help Center: Data structures Accessed 30 Oct 2026
- Make Academy: Introduction to HTTP Accessed 30 Oct 2026
- MDN: 401 Unauthorized Accessed 30 Oct 2026
- MDN: 429 Too Many Requests Accessed 30 Oct 2026
- Make Help Center: Fix rate limit errors Accessed 30 Oct 2026
- Make Help Center: Scenario settings Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.