Release date 2026/09/15
Fixed an issue where empty callouts[].request.body.custom or upstream.body.custom maps caused the plugin to send {} request bodies.
Fixed an issue where a callout that failed and then succeeded on retry still returned the earlier failed response. The plugin now returns the response from the successful retry.
Release date 2026/09/16
Fixed an issue where a callout that failed and then succeeded on retry still returned the earlier failed response. The plugin now returns the response from the successful retry.
Release date 2026/09/17
Fixed an issue where a callout that failed and then succeeded on retry still returned the earlier failed response. The plugin now returns the response from the successful retry.
Release date 2025/12/18
added support for the tls_certificate_verify global option. When this option is enabled, the plugin’s ssl_verify setting for HTTPS callouts cannot be disabled.
Fix duplicated content-type headers in the callout request when body.custom is enabled and content-type header is also set in headers.
Release date 2025/11/18
Fix duplicated content-type headers in the callout request when body.custom is enabled and content-type header is also set in headers.
Release date 2025/10/01
The plugin now supports dynamic request URLs in the form of Lua expressions $(some_lua_expression).
Fixed an issue where untrusted_lua_sandbox_requires option was not respected.
Fixed regression where the upstream request body would not be forwarded if upstream.body.custom was empty.
request.by_lua code will now run before a request is made or a cached callout is fetched. Previously, it did not run before an attempt to fetch from cache, which did not allow for cache key customization.
The plugin now uses additional components to generate the cache key: request consumer, consumer groups, plugin ID, route ID; callout request method, URL, query params, headers, and body.
Fixed an issue where expressions could not read headers, query, and URI captures via shortcuts of the form $(headers.some_header).
Release date 2025/09/05
Fix regression where the upstream request body would not be forwarded if upstream.body.custom was empty.
Release date 2025/07/28
Fixed an issue where untrusted_lua_sandbox_requires option was not respected.
request.by_lua code will now run before a request is made or a cached callout is fetched. Previously, it did not run before an attempt to fetch from cache, which did not allow for cache key customization.
The plugin now uses additional components to generate the cache key: request consumer, consumer groups, plugin ID, route ID; callout request method, URL, query params, headers, and body.
Fixed an issue where expressions could not read headers, query, and URI captures via shortcuts of the form $(headers.some_header).
Release date 2025/07/16
Fixed an issue where untrusted_lua_sandbox_requires option was not respected.
Release date 2025/07/03
Marked the auth_password as an encrypted field.
The plugin now logs the request URL, response code, and request latency (in milliseconds).
The plugin now sends a custom User-Agent header if one isn’t provided. The default value is kong/<kong_version>/request-callout.
Fix issue where a callout response would not be available to response by_lua code
Fixed an issue where caching options modified via by_lua would apply to all subsequent callouts.
Fixed an issue where callouts with the same name would be accepted.
Query parameters specified via callout.request.query will now correctly replace those in the callout URL.
Fixed an issue where values in custom would not accept explicit null values for removal of fields
Fixed an issue where callout and upstream request body customizations were not performed when an empty request body was provided; now, an empty JSON body is used and content-type JSON is added to the request.
Fixed an issue where callout plugin failed with timeout when callouts.request.body.custom is null and callouts.request.headers.forward is true.
Fixed an issue where the client request body is forwarded to upstream when upstream.body.forward is false.
Release date 2025/08/07
Fixed an issue where untrusted_lua_sandbox_requires option was not respected.
request.by_lua code will now run before a request is made or a cached callout is fetched. Previously, it did not run before an attempt to fetch from cache, which did not allow for cache key customization.
The plugin now uses additional components to generate the cache key: request consumer, consumer groups, plugin ID, route ID; callout request method, URL, query params, headers, and body.
Fixed an issue where expressions could not read headers, query, and URI captures via shortcuts of the form $(headers.some_header).
Fixed an issue where the client request body is forwarded to upstream when upstream.body.forward is false.
Release date 2025/05/20
The plugin now logs the request URL, response code, and request latency (in milliseconds).
Fixed an issue where a callout response wasn’t available to response by_lua code.
Fixed an issue where caching options modified via by_lua would apply to all subsequent callouts.
Fixed an issue where callouts with the same name would be accepted.
Query parameters specified via callout.request.query now correctly replace those in the callout URL.
Fixed an issue where values in custom wouldn’t accept explicit null values for removal of fields.
Fixed an issue where callout and upstream request body customizations weren’t performed when an empty request body was provided. Now, an empty JSON body is used and Content-Type: application/json is added to the request.
Fixed an issue where the Request Callout plugin failed with a timeout when callouts.request.body.custom was null and callouts.request.headers.forward was set to true.