HTTP server connector

Class: http_server — source only. Binds HTTPS, accepts inbound POST (JSON object, JSON array of objects, NDJSON, or text), and publishes each decoded event to a stream.

Do not configure listen ingest as http. HTTP class: http is an outbound client (poll GET/POST). Do not use splunk for generic webhooks — that class is Splunk HEC paths and Authorization: Splunk.

Create and edit under Sources. There is no HTTP server sink.

Source behavior

Role	Behavior
Source	Listen on endpoint (https:// host + port). Exact POST path (default /). Required bearer or basic ingest auth. Decode then enqueue; 200 empty body after enqueue; channel full → 429 (no Retry-After).
Sink	Not supported.
Streams	Align the ingest stream with tasks / pipelines (Streams).

200 means the batch is on the ingest channel, not that WAL or sinks have committed. A crash after 200 can leave a client that already moved on.

Required fields

Every connector row

Field	Required	Notes
name	Yes	Display name; id derived from it.
class	Yes	Must be http_server.
stream	Yes	Resolved stream id.
type	Yes	source only.
config	Yes	Class-specific object; see below.

Class http_server — required configuration

Setting	Required	Notes
endpoint	Yes	Listen URL. https:// only, host + port. Examples use 127.0.0.1; set 0.0.0.0 only when you mean to expose the port. http:// is invalid.
authentication	Yes	auth_type bearer (token) or basic (username / password). Required even on loopback. Treat token and password as secrets.

Optional: path (default /), health_path (default /health, unauthenticated GET; empty/omit to disable), encoding json (default) / ndjson / text, max_body_bytes (default 1 MiB, cap 16 MiB), max_events_per_request (default 10000), server tls cert/key (or auto-generate under $PADAS_HOME/core/data/security/ like HEC source). Channel capacity (1024 POST batches) is not a UI field.

Create connector

1. Open Sources → Create.
2. Set Class to HTTP Server, set name, stream behavior, and Enabled.
3. Enter https:// endpoint, POST path, and bearer or basic credentials.
4. Choose encoding. Keep health on a separate path if you want an unauthenticated GET probe.
5. Save, deploy to a Core, then wire the stream into tasks / pipelines.

UI field	Connector setting
Endpoint	endpoint
Path	path
Health path	health_path
Encoding	encoding
Auth type / token or username+password	authentication
Max body bytes / max events per request	max_body_bytes, max_events_per_request

Runtime behavior

Case	HTTP
Enqueued	200 empty
Missing or wrong ingest auth	401
Wrong path / wrong method	404 / 405
Body over max_body_bytes	413
Decode error, non-object JSON array element, bad NDJSON line, over max_events_per_request	400 (whole request; no partial enqueue)
Channel full (after 50 ms)	429, no Retry-After
Health GET	200, no auth

• json object → one event (data is that object). json array → one event per object. ndjson → one event per non-blank line. text → string data.
• Prefer 127.0.0.1. Auth and HTTPS are always required for ingest.

Performance and operational notes

• One queue slot is one POST batch, not one event. Large arrays still occupy one slot until drained.
• Tune max_body_bytes, max_events_per_request, poll batch.max_events, and the target stream buffer — not a channel-capacity knob.
• Splunk HEC source uses the same bounded queue but maps full to 503 + {text: "Server is busy", code: 9} — see Splunk connector.

Related pages

• Sources
• HTTP connector — outbound REST client; not listen ingest
• Splunk connector — HEC listen (vendor paths/token)
• Architecture — Connectors
• Streams (advanced)