http_write

Gate: gated on net, target the host of the URL, e.g. api.github.com · write

Send data somewhere. The split from http_read is not about the HTTP verb being trustworthy — it is so the tool the model picks already states the intent, and so a grant for reading a host never silently becomes permission to post to it. Reach, credentials and leak scanning live on the net kind.

Input

Field	Type	Required	Notes
url	string	yes	The URL to send to.
method	string	no	POST, PUT, PATCH or DELETE. Default POST.
body	string	no	The request body.
content_type	string	no	Content-Type of the body. Default application/json.

Output

The same JSON envelope http_read returns:

{ "status": 201, "statusText": "Created", "headers": { "Location": "/items/42" }, "body": "…" }

From JavaScript

wrapper (idiomatic)

const r = await fetch("https://api.example.com/items", {
  method: "POST",
  body: JSON.stringify({ title: "hello" }),
});
if (!r.ok) throw new Error("post failed: " + r.status);

nocturn.call

const res = JSON.parse(nocturn.call("http_write", {
  url: "https://api.example.com/items",
  method: "POST",
  body: JSON.stringify({ title: "hello" }),
  content_type: "application/json",
}));

Notes

A body carrying a stored vault secret is blocked by the egress scan before the host's own credential is attached — the write never leaves.