---
slug: 32-http-client
title: Cliente HTTP
description: Hacé requests HTTP en Synsema — http/http_get/post/put/delete y fetch — todo gateado por net(host), con un map de respuesta uniforme.
example_ids: [http-client]
---

# Cliente HTTP

Cada request (`http*` y `fetch`) está gateado por `net(host)` — deny-by-default, incluso bajo `run`. HTTPS funciona de fábrica (rustls + root CAs del SO).

```synsema
-- Doc example: the HTTP client is gated by net(host). A request to an undeclared
-- host is refused at the capability check — before any network call happens.
intent: "doc example: HTTP client capability gating"
require net("api.allowed.com")

task reach_undeclared()
    give http_get("https://evil.example.com/data")    -- host not declared → denied

test "a request to an undeclared host is blocked (deny-by-default)"
    assert_error(reach_undeclared)
```

## Hacer requests

```synsema
require net("api.store.com")

let r be http_get("https://api.store.com/products")
let r be http_get(url, {"x-api-key": secret("API_KEY")}, {"page": "1"})   -- headers, query
let r be http_post(url, {"name": "Alice"}, {"Authorization": bearer(secret("API_KEY"))})
let r be http("POST", url, headers, query, body)                          -- control total
```

Las credenciales van en **headers** (un `secret` se materializa solo en el socket) — ver **[Secretos](/es/0.6.x/21-secrets)**.

## Timeout

Cada builtin HTTP acepta un **timeout en segundos** opcional como último argumento (default **30**;
ausente o inválido cae a 30 — nunca es error):

```synsema
let r be http("GET", url, nothing, nothing, nothing, 120)   -- API lenta: esperar hasta 2 min
let r be http_get(url, nothing, nothing, 5)                  -- fallar rápido: 5s
let r be fetch(url, "GET", nothing, nothing, 60)
```

Firmas: `http(method, url, headers?, query?, body?, timeout?)` · `http_get(url, headers?, query?,
timeout?)` · `http_post(url, body, headers?, timeout?)` · `http_put(url, body, headers?, timeout?)`
· `http_delete(url, headers?, timeout?)` · `fetch(url, method?, headers?, body?, timeout?)`. Al
vencer el timeout la respuesta vuelve con `ok: false` y el error del SO en `error of r`.

## La respuesta

Un request devuelve un map:

```synsema
status of r     -- 200
ok of r         -- true (200–299)
body of r       -- texto crudo
json of r       -- JSON parseado (si el content-type es JSON)
headers of r    -- headers de respuesta
error of r      -- mensaje de error si falló
```

`require net` / `net("*")` permiten cualquier host; `net("*.x.com")` matchea subdominios.