Transform, HTTP Request & Action Secrets

Compose Full Automation Pipelines

Endpoint Actions can now reshape data, call external APIs, and keep sensitive credentials encrypted — all with the same redacted, step-by-step execution traces you already rely on.

Transform

Build a bounded JSON value from incoming request data without running arbitrary code. Transform operations execute in order on a copy of your request, provider, email, or earlier-step context:

• select — pick a single JSON Pointer path
• set — write a literal, context pointer, or bounded template value
• remove — drop a field at the specified path
• rename — move a value without overwriting an existing destination
• pick — construct an object from named paths
• wrap — nest the value under a single key

The Transform result is available to later steps during the same run. Traces show a bounded type summary — not raw payloads.

HTTP Request

Build a new outbound HTTP request from the bounded step context. URL, header values, and body templates use the strict action template language. Supports GET, POST, PUT, PATCH, DELETE, and HEAD.

HTTP Request shares the same pinned-DNS SSRF protections as Forward steps, rejects redirects, and enforces bounded URL, body, response sizes, and timeouts. A 2xx response marks the step successful. A bounded response preview may be passed to later steps when the action continues.

HTTP Request requires an active paid subscription.

Action Secrets

Store encrypted values in Workspace → Action Secrets and reference them by name in HTTP Request templates — for example {{ secrets.fulfillment_api_token }}. Secret values are write-only: CatchHook will not display them after creation. Updating a secret replaces the current value. Deletion is blocked while any step references the secret.

Per-Step Conditions

Each step can now carry its own AND-only conditions using RFC 6901 JSON Pointer paths. Conditions inspect the original request, provider, or email context and the outputs of earlier enabled steps. A false condition records a redacted skipped entry in the trace rather than failing the step.

Plan Limits

API & MCP

All composition features are manageable through the REST API and MCP tools. The action preview endpoint validates templates and Transform operations without sending any outbound requests.