https-outcalls

Call the management canister's http_request method with a URL, method, headers, and a transform function. In Motoko use Call.httpRequest from the ic mops package; in Rust use ic_cdk::management_canister::http_request, both of which attach the required cycles automatically.

All replicas on the subnet execute the same request, but raw responses differ in headers, timestamps, and JSON field ordering. The transform function strips non-deterministic data so every replica sees an identical response and consensus can be reached.

Cost is computed by the ic0.cost_http_request system API from request size and max_response_bytes. On a 13-node subnet the base is about 49 million cycles plus per-byte charges; omitting max_response_bytes defaults to 2MB and costs roughly 21.5 billion cycles.

No. HTTPS outcalls only reach public internet endpoints with valid TLS certificates. Localhost, 10.x.x.x, 192.168.x.x, and other private ranges are blocked, and plain HTTP URLs are rejected.

The transform function is not making responses identical across replicas. Strip all headers, normalize JSON field ordering by parsing and re-serializing, and remove timestamps or per-replica fields like origin IPs from the body.

The maximum response body is 2MB (2,097,152 bytes). Set max_response_bytes to a realistic upper bound for your API, since cycles are charged against this limit rather than the actual response size.