Enhancement: HTTP Request Action - Sensitive Request Headers

Announcements Product News
, ,
1

:sparkles: Description

Identity Security Cloud Workflows HTTP Request action now includes Sensitive Request Headers, an optional field for API keys, bearer tokens, and other secrets. Values are masked in the builder, hidden in workflow definitions, and omitted from execution history for new runs.

:information_source: What You Need to Know

  • Optional: Sensitive Request Headers is optional. Existing workflows and Request Headers keep working as they do today.

  • Sensitive vs standard headers: Put secret values in Sensitive Request Headers. Keep non-sensitive headers in Request Headers.

  • Execution history: New runs hide sensitive values. Past executions that used plain-text Request Headers are not updated.

:red_exclamation_mark: Problem

Sensitive values in Request Headers can appear in plain text in workflow definitions and execution history, which increases exposure risk for API keys, tokens, and similar data.

:light_bulb: Solution

  1. Sensitive Request Headers: Masked key-value pairs for secrets.

  2. Protected storage and display: Values are encrypted and hidden in definitions and new execution history.

2026-08-24_07-34-49
2026-08-24_07-34-492072×1314 225 KB

:red_question_mark: Who is affected?

Workflow authors who configure HTTP Request actions with authentication headers, API keys, or other sensitive values in Identity Security Cloud.

Action required: None.
Action highly recommended: Move secret header values from Request Headers into Sensitive Request Headers when you edit a workflow.

:spiral_calendar: Important dates

Phased rollout:

Environment Date
Sandbox (STG) Aug 26, 2026
Production Sep 2 - 9, 2026
4 Likes
2

Nice functionality @takato!

Will using the “duplicate workflow” functionality copy the underlying value, or are those stripped?

3

Yes, duplicate will copy the value, however, users will not be able to reveal or view the data within the sensitive fields. This behavior will be the same for downloading the script of a workflow too. Hope this helps.

4

Yes that clarifies it, thank you! :slight_smile:

5

Is it available for request body too ? Like I want to use OAuth Password grant type, which HTTP Action doesn’t support. So I was planning to use HTTP Action to obtain a acces token first using Token request POST call. As part of the request I have to provide sensitive field like “password” in the request body of type “Form”.

6

Unfortunately, it’s only available in the header at the moment. We may create an enhancement in the future to support the request body.

1 Like