HTTP Request action - Who can trigger link issue?

Dan Snyder

@Austen Brown and I both happened to be building adaptive cards to add to our NXT environments and could not get the card to display.

After some digging around, we noticed that the HTTP POST URL created from the HTTP action, even when encoded, was much shorter than others that were working. The only way to fix this issue was to change the “Who can trigger the flow?” from Any user in my tenant to Anyone and the link became longer and when encoded and added to the app URL all worked great?

We were both using the PA template that Blackbaud has published for creating an adaptive card so wondered if this was a bug or if the template had changed since we last used it?

@Erik Leaver @Heather McLean @Glen Hutson @Ashley Moose

Ben Lambert

Hey @Dan Snyder (and Austen)!

The published template pre-dates the concept of “Who can trigger the flow” that Microsoft introduced (and afaik it has not changed since it was published). Prior to that feature, the semantic was “anyone with the URL can trigger the flow”. I just tried creating a new flow using the template, and the default value is “blank” for that field so you'd need to explicitly choose an item (like “Anyone”) from the dropdown. Creating a new flow and manually specifying the HTTP Request trigger has the default value of “Any user in my tenant” (which matches the default described in the documentation).

I haven't tested the other options (Any user/specific users) but I believe they require more complex values in the request (probably involves registering an OAuth application in Azure and figuring out how to get a token, etc.).

So TLDR, I think the only way for the current implementation to work is if “Anyone” is selected.

Alex Wong

I have created a few adaptive cards in the past month, so yes, you need to use the “anyone can invoke” option, and the security of this is in the “validate user identify token”.

Dan Snyder

Thanks for the quick responses @Ben Lambert and @Alex Wong.