---
title: "Workspace-scoped outbound HTTP proxy"
method: POST
path: "/api/v1/fetch"
tags: ["Data"]
---

# Workspace-scoped outbound HTTP proxy

`POST /api/v1/fetch`

## Request

- Base URL: `https://core.blink.new`
- URL: `https://core.blink.new/api/v1/fetch`
- Auth: HTTP bearer

Make an outbound HTTP request from Blink's servers and return the response. Useful for bypassing browser CORS restrictions or keeping API secrets server-side. Private IP ranges are blocked (localhost, 10.x, 192.168.x, 172.16–31.x, 169.254.x). Responses are capped at 512 KB; larger payloads return `truncated: true`. Times out after 15 seconds.

## Request body

- object
  - `url` string, uri, required: Target URL to fetch. Must be a public HTTPS/HTTP URL.
  - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS': HTTP method.
  - `headers` object: Request headers.
  - `body` string: Request body as a string.

## Response `200`

Upstream response (possibly truncated)

- object
  - `status` integer: HTTP status code from the upstream server
  - `contentType` string: Content-Type from the upstream response
  - `body` string: Response body as a UTF-8 string
  - `truncated` boolean: Present and `true` when the response exceeded 512 KB

## Other responses

- `400`: Missing or invalid URL
- `401`: Authentication required or invalid API key
- `403`: Private/internal URL blocked (SSRF protection)
- `502`: Upstream request failed (network error)
- `504`: Upstream request timed out (15 s limit)

---

[API](https://skmtc.dev/blink/apis/blink-apis.md) - [All operations](https://skmtc.dev/blink/apis/blink-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/blink/apis/blink-apis/revisions/4c59c706078e?raw)