# Call an API from a Lambda

An overview of how to make API calls from Lambdas.

> For the index of this section of the site, see [llms.txt](https://4002.18-224-161-104.sslip.io/docs/llms.txt)

> **PLAN:** This feature requires [at least an Essentials plan](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/plans-features.md#essentials-features).

Lambda HTTP Connect allows you to make HTTP requests from within a lambda with `fetch()`. Lambdas can contact any URL accessible from your FusionAuth instance.

This features allows you to access data from external systems to configure token claims or to add data to a user profile. It also allows you to push profile or other data from FusionAuth to an external system as needed.

Here's a video showing more details about Lambda HTTP Connect:

[Play](https://youtube.com/watch?v=_TnDUPQm3aQ)

## Example Lambda

To make a request, call `fetch()`, passing:

*   a string containing a URL
*   optionally, an object containing options to configure the request.

The following lambda makes an HTTP `GET` request to an API hosted at `api.example.com` with the `Content-Type` header set to `application/json`. The lambda uses the response returned from that API to add additional claims to a JWT:

A lambda which adds claims based on an external API.

```javascript
function populate(jwt, user, registration) {
  var response = fetch("https://api.example.com/api/status?" + user.id, {
    method: "GET",
    headers: {
      "Content-Type": "application/json"
    }
  });

  if (response.status === 200) {
    // assuming successful response looks like:
    // {"status":"statusValue"}
    var jsonResponse = JSON.parse(response.body);
    jwt.status = jsonResponse.status;
  } else {
    jwt.status = "basic";
  }
}
```

You can also call FusionAuth APIs with a valid API key:

A lambda which adds claims based on a FusionAuth API.

```javascript
function populate(jwt, user, registration) {
  var response = fetch("http://localhost:9012/api/group", {
    method: "GET",
    headers: {
      "Authorization": "bf69486b-4733-4470-a592-f1bfce7af580"
    }
  });

  if (response.status === 200) {
    // a successful response as defined in the Groups API
    var jsonResponse = JSON.parse(response.body);
    jwt.groups = jsonResponse.groups;
  } else {
    jwt.groups = [];
  }
}
```

Use the local FusionAuth HTTP port (`fusionauth-app.http-local.port`, default value `9012`), whenever making a FusionAuth API call in a lambda. Doing so minimizes network traffic contention and improves performance.

## Options

### Timeouts

Available since `1.55.1`

Within lambda functions, external requests should always return quickly. Every moment of delay causes additional latency during the FusionAuth request, which can reduce the performance of FusionAuth or even cause errors. This happens because lambda functions are blocking, rather than asynchronous: FusionAuth must wait for the lambda to complete before the user interaction can complete.

Lambdas use default connect and read timeouts of 2 seconds. But you can modify these timeouts if you know a request may be slow. To specify a timeout, pass the optional second parameter to `fetch()` and assign a value and assign an integer value (in milliseconds) to the `connectTimeout` or `readTimeout` fields in that object:

```javascript
var response = fetch("https://api.example.com/api/status", {
    method: "GET",
    connectTimeout: 42000,   // 42,000 ms, or 42 seconds
    readTimeout: 42000       // 42,000 ms, or 42 seconds
  });
```

### Body

By default, `fetch()` does not send a request body. To specify a request body, pass the optional second parameter to `fetch()` and assign a **string** value to the `body` field in that object:

```javascript
var response = fetch("https://api.example.com/api/status", {
    method: "PUT",
    body: "test body pls ignore"
  });
```

### Method

By default, `fetch()` issues an HTTP `GET` request. To use a different method, pass the optional second parameter to `fetch()` and pass any valid [HTTP method](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods) as a **string** to the `method` field in that object:

```javascript
var response = fetch("https://api.example.com/api/status", {
    method: "DELETE"
  });
```

### Headers

By default, `fetch()` does not specify any headers. To specify headers in a request, pass the optional second parameter to `fetch()` and assign a value to the `header` field in that object:

```javascript
var response = fetch("https://example.org", {
  method: "GET",
  headers: {
    "Content-Type": "application/json"
  }
});
```

You can provide request header values in the following ways:

*   An anonymous object:
    
    ```javascript
    headers: {
       "Content-Type": "application/json"
    }
    ```
    
*   A hash or map:
    
    ```javascript
    headers: new Headers({
       "Content-Type": "application/json"
    })
    ```
    
*   An array:
    
    ```javascript
    headers: new Headers([
        ["Content-Type", "application/json"]
    ])
    ```
    

## Response

`fetch()` returns an object that contains the following fields:

`headers`

*   Type: `Object`

The headers returned by the response. The keys of this object are the header names. All header keys are lower cased.

`status`

*   Type: `Integer`

The HTTP status code of the response.

`body`

*   Type: `String`

The body of the response.

## Securing API Keys In Lambdas

Available since `1.64.0`

To securely store secret values used in lambdas, like API keys and application passwords, use a [lambda secret](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas.md#secrets). To create a secret, open the Admin UI and navigate to Settings -> Key Master .

To access secrets, use the `context` parameter. Pass a secret **name** to `context.services.secrets.get('<key>')` to retrieve the corresponding secret **value** as a string:

```javascript
function populate(jwt, user, registration, context) {
  var apiKey = context.services.secrets.get('my-api-key');
  if (apiKey) {
    jwt.apiKeyPresent = true;
  }
}
```

## Lambda HTTP Connect Limitations

Do not call any FusionAuth API that itself invokes the calling lambda: the circular dependency on your lambda will cause the request to fail. For example, in a JWT Populate lambda, do not invoke the Login API.

The `fetch` method in a lambda does not implement the [entire fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) as implemented in a browser: for example, the first argument to `fetch` must always be a string.

Related

[Extend CIMD Client Registration Lambda An overview of the CIMD client registration lambda. fusionauth lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/cimd-client-registration.md)

[Extend Client Credentials JWT Populate Lambda An overview of the Client Credentials JWT Populate lambda. fusionauth lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/client-credentials-jwt-populate.md)

[Extend Lambdas An overview of FusionAuth's lambdas, which are pluggable JavaScript code that run at various points in the user lifecycle. fusionauth lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas.md)

[Extend JWT Populate Lambda An overview of the JWT populate lambda. fusionauth lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md)
---

## Other pages in Lambdas

> For the full index of this section, see [Extend](https://4002.18-224-161-104.sslip.io/docs/llms-extend.txt).

- [CIMD Client Registration Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/cimd-client-registration.md): An overview of the CIMD client registration lambda.
- [Client Credentials JWT Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/client-credentials-jwt-populate.md): An overview of the Client Credentials JWT Populate lambda.
- [Lambdas](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas.md): An overview of FusionAuth's lambdas, which are pluggable JavaScript code that run at various points in the user lifecycle.
- [JWT Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md): An overview of the JWT populate lambda.
- [Login Validation Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/login-validation.md): An overview of the login validation lambda.
- [MFA Requirement Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/mfa-requirement.md): An overview of the MFA requirement lambda.
- [Apple Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/apple-reconcile.md): An overview of the Apple Reconcile lambda.
- [Epic Games Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/epic-games-reconcile.md): An overview of the Epic Games Reconcile lambda.
- [External JWT Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/external-jwt-reconcile.md): An overview of the External JWT Reconcile lambda.
- [Facebook Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/facebook-reconcile.md): An overview of the Facebook Reconcile lambda.
- [Google Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/google-reconcile.md): An overview of the Google Reconcile lambda.
- [HYPR Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/hypr-reconcile.md): An overview of the HYPR Reconcile lambda.
- [LDAP Connector Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/ldap-connector-reconcile.md): An overview of the LDAP Connector Reconcile lambda.
- [LinkedIn Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/linkedin-reconcile.md): An overview of the LinkedIn Reconcile lambda.
- [Nintendo Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/nintendo-reconcile.md): An overview of the Nintendo Reconcile lambda.
- [OpenID Connect Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/openid-connect-response-reconcile.md): An overview of the OpenID Connect Response Reconcile lambda.
- [SAML v2 Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/samlv2-response-reconcile.md): An overview of the SAML v2 Response Reconcile lambda.
- [Sony PlayStation Network Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/sony-playstation-network-reconcile.md): An overview of the Sony PlayStation Network Reconcile lambda.
- [Steam Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/steam-reconcile.md): An overview of the Steam Reconcile lambda.
- [Twitch Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitch-reconcile.md): An overview of the Twitch Reconcile lambda.
- [Twitter Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitter-reconcile.md): An overview of the Twitter Reconcile lambda.
- [Xbox Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/xbox-reconcile.md): An overview of the Xbox Reconcile lambda.
- [SAML v2 Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/samlv2-response-populate.md): An overview of the SAML v2 populate lambda.
- [SCIM Group Request Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-request-converter.md): An overview of the SCIM Group Request Converter lambda.
- [SCIM Group Response Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-response-converter.md): An overview of the SCIM Group Response Converter lambda.
- [SCIM User Request Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-request-converter.md): An overview of the SCIM User Request Converter lambda.
- [SCIM User Response Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-response-converter.md): An overview of the SCIM User Response Converter lambda.
- [Self-Service Registration Validation Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/self-service-registration.md): An overview of the Self-Service Registration Validation lambda.
- [Test Lambdas](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/testing.md): A guide on how to create and test lambdas with FusionAuth.
- [UserInfo Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/userinfo-populate.md): An overview of the UserInfo populate lambda.