Request Callout

Release date 2025/07/28

Bugfix

• Fixed an issue where untrusted_lua_sandbox_requires option was not respected.

• request.by_lua code will now run before a request is made or a cached callout is fetched. Previously, it did not run before an attempt to fetch from cache, which did not allow for cache key customization.

• The plugin now uses additional components to generate the cache key: request consumer, consumer groups, plugin ID, route ID; callout request method, URL, query params, headers, and body.

• Fixed an issue where expressions could not read headers, query, and URI captures via shortcuts of the form $(headers.some_header).

Release date 2025/07/16

Bugfix

• Fixed an issue where untrusted_lua_sandbox_requires option was not respected.

Release date 2025/07/03

Feature

• Marked the auth_password as an encrypted field.

• The plugin now logs the request URL, response code, and request latency (in milliseconds).

• The plugin now sends a custom User-Agent header if one isn’t provided. The default value is kong/<kong_version>/request-callout.

Bugfix

• Fix issue where a callout response would not be available to response by_lua code

• Fixed an issue where caching options modified via by_lua would apply to all subsequent callouts.

• Fixed an issue where callouts with the same name would be accepted.

• Query parameters specified via callout.request.query will now correctly replace those in the callout URL.

• Fixed an issue where values in custom would not accept explicit null values for removal of fields

• Fixed an issue where callout and upstream request body customizations were not performed when an empty request body was provided; now, an empty JSON body is used and content-type JSON is added to the request.

• Fixed an issue where callout plugin failed with timeout when callouts.request.body.custom is null and callouts.request.headers.forward is true.

• Fixed an issue where the client request body is forwarded to upstream when upstream.body.forward is false.

Release date 2025/08/07

Bugfix

• Fixed an issue where untrusted_lua_sandbox_requires option was not respected.

• request.by_lua code will now run before a request is made or a cached callout is fetched. Previously, it did not run before an attempt to fetch from cache, which did not allow for cache key customization.

• The plugin now uses additional components to generate the cache key: request consumer, consumer groups, plugin ID, route ID; callout request method, URL, query params, headers, and body.

• Fixed an issue where expressions could not read headers, query, and URI captures via shortcuts of the form $(headers.some_header).

• Fixed an issue where the client request body is forwarded to upstream when upstream.body.forward is false.

Release date 2025/05/20

Bugfix

• The plugin now logs the request URL, response code, and request latency (in milliseconds).

• Fixed an issue where a callout response wasn’t available to response by_lua code.

• Fixed an issue where caching options modified via by_lua would apply to all subsequent callouts.

• Fixed an issue where callouts with the same name would be accepted.

• Query parameters specified via callout.request.query now correctly replace those in the callout URL.

• Fixed an issue where values in custom wouldn’t accept explicit null values for removal of fields.

• Fixed an issue where callout and upstream request body customizations weren’t performed when an empty request body was provided. Now, an empty JSON body is used and Content-Type: application/json is added to the request.

• Fixed an issue where the Request Callout plugin failed with a timeout when callouts.request.body.custom was null and callouts.request.headers.forward was set to true.

Release date 2025/03/27

Feature

• Added the request-callout plugin, which provides complex request augmentation and internal authentication.