Read request data safely

Route values, query parameters, headers, and the request body enter the workflow as execution data. Validate them before using them to select records, construct requests, or change state.

Available inputs#

Use distinct names for caller input, stored configuration, and node results. Do not treat a caller-supplied userId as an authenticated identity.

Read a JSON body in Python#

Use ${body} directly in the Function script. For a JSON request body, the unquoted selector resolves to its Python value:

import json

data = ${body}
if not isinstance(data, dict):
    raise ValueError("Send a JSON object")
name = data.get("name")
if not isinstance(name, str) or not name.strip():
    raise ValueError("name is required")

return json.dumps({"name": name.strip()})

Send {"name":"Avery"} with Content-Type: application/json. This example returns {"name":"Avery"} and rejects a missing or blank name. Cloudgate resolves the selector as data; you do not need a separate Python input variable or an input-template setup step.

Read a previous node's result#

If an HTTP Request node named FetchCustomer returns a JSON customer object, use its name as the selector in the next Function:

import json

customer = ${FetchCustomer}
return json.dumps({
    "id": customer["id"],
    "name": customer.get("name", "")
})

Use an unquoted selector for structured data and a quoted selector when you want text, such as order_id = "${orderId}". Confirm the upstream response shape before accessing its fields. A node result becomes available only after that node executes on the current path.

Validate the contract#

Check required fields, types, allowed values, and record ownership. Test malformed JSON, missing values, empty strings, and unexpected fields. Keep validation errors useful without echoing credentials or entire private payloads.