01 / DIRECT ANSWER
Use the native request object—not curl, LuaSocket or browser fetch
FC 26 Live Editor exposes a creator-defined HTTP layer for its embedded Lua 5.4.6 runtime. Create the request with REQUEST:new(), set a documented method enum and URL, call HTTP:send(req), inspect resp.error and the endpoint’s expected status, then parse resp.text only if its content contract allows it.
Global REQUEST and HTTP objects—not a generic Lua networking recipe.
POST, PUT, PATCH and DELETE can change another system even when Career data stays untouched.
Transport error, unexpected status and invalid body need separate evidence.
02 / EXACT API CHAIN
One request crosses three accountable objects
Returns the request entity documented as HTTPRequest.
The HTTP class documents one method and no fields.
Ten fields expose body, status, error, headers, cookies, redirects and elapsed time.
HTTPResponse HTTP:send(HTTPRequest request)ONE INPUT → ONE RETURN TABLE03 / ORIGINAL SAFETY TOOL
Generate Lua only after the request earns a preflight receipt
The lab uses the exact enums and setters from the Wiki. It checks URL syntax, HTTPS, local/private target patterns, secret-like query names, method effect, body mismatch and auth placeholders. It never makes a network call.
HTTP PREFLIGHT LAB
Build an exact API request, expose risk and copy a reviewed Lua draft. Nothing is sent from this page.
-- DRY-RUN PLAN: review host and replace placeholders before execution
local req = REQUEST:new()
req:SetMethod(HTTP_GET_REQUEST)
req:SetUrl("https://example.com/")
req:SetTimeout(10000)
local resp = HTTP:send(req)
if resp.error and resp.error ~= "" then
print(string.format("HTTP error: %s", resp.error))
return
end
if resp.status_code < 200 or resp.status_code >= 300 then
print(string.format("Unexpected status: %d %s", resp.status_code, resp.reason))
return
end
print(resp.text)TOOL LIMIT: syntax and preflight cannot prove DNS resolution, certificates, server authorization, redirect destination, rate limits or runtime behavior inside your installed build.
04 / HTTPREQUEST
Eight fields and eight setters define the published request surface
The class accepts field initialization and documents a setter for every field. The lab generates setters because each boundary remains visible during review.
method__int32HTTP method enum.
urlstringDestination URL.
bodystringRaw request body.
authtableAuthentication settings.
payloadtableRequest payload.
headerstableRequest-header map.
cookiestableRequest-cookie map.
timeout__int32Timeout in milliseconds.
REQUEST:SetMethod(...)REQUEST:SetUrl(...)REQUEST:SetAuth(...)REQUEST:SetBody(...)REQUEST:SetPayload(...)REQUEST:SetHeaders(...)REQUEST:SetCookies(...)REQUEST:SetTimeout(...)05 / METHOD ENUM
The integer belongs to the Live Editor enum; the effect belongs to the endpoint
HTTP_GET_REQUESTRetrieve a representation; verify endpoint contract.
HTTP_HEAD_REQUESTRetrieve response metadata without a response body.
HTTP_OPTIONS_REQUESTAsk for communication options.
HTTP_PUT_REQUESTCreate or replace remote state.
HTTP_DELETE_REQUESTRequest remote deletion.
HTTP_POST_REQUESTSubmit data or trigger remote processing.
HTTP_PATCH_REQUESTApply a partial remote modification.
DO NOT INFER SAFETY FROM A NUMBER: the enum selects a method. Authorization, idempotence, retry behavior and remote side effects still come from the target API contract and HTTP semantics.
06 / TWO BODY PATHS
SetPayload and SetBody are not interchangeable labels
The official POST example passes a Lua table. Its shown echo places values under form and reports application/x-www-form-urlencoded.
local payload = { ["season"] = "2026" }
req:SetPayload(payload)The official raw-body example passes a string and sets Content-Type separately. For JSON, send a JSON string and declare application/json.
req:SetHeaders({ ["Content-Type"] = "application/json" })
req:SetBody('{"season":"2026"}')ONE PATH PER REQUEST: the Wiki does not publish precedence for setting both payload and raw body. Pick the endpoint’s required representation and leave the other unset.
07 / HTTPRESPONSE
Ten fields turn “it failed” into a diagnosable result
textstringResponse body.
raw_headerstringRaw header string.
status_linestringHTTP status line.
reasonstringReason associated with the status.
errorstringError message.
status_code__int32HTTP response status code.
redirect_count__int32Number of redirects.
elapseddoubleTotal request time in seconds.
headertableMap-like response headers.
cookiestableMap-like response cookies.
LOG SELECTIVELY: raw headers, cookies, request URLs and response bodies can contain credentials or private data. Record the smallest diagnostic surface that proves the failure.
08 / DOCUMENTATION AUDIT
The field says milliseconds; the sample comment miscalculates them
HTTPRequest.timeout and SetTimeout(int timeout) both identify ms.
That value equals 10,000 ms, which is 10 seconds—not 1 second.
The generated draft keeps the literal value and labels it correctly.
SOURCE DISCIPLINE: this page corrects the arithmetic, not undocumented runtime behavior. It does not claim a default timeout or maximum the Wiki never states.
09 / AUTH & SECRETS
Four modes are documented; zero real credentials belong in a shared script
username + passwordusername + passwordusername + passwordaccess_tokenShared, synced or uploaded Lua can expose literals.
URLs commonly survive in logs and history.
Headers, cookies and bodies can reproduce a token.
Debug evidence can outlive the test account.
PUBLISHED API ≠ SECRET STORE: the request class accepts credentials, but the Wiki does not document an environment-secret manager. The lab therefore emits replacement placeholders only.
10 / DESTINATION TRUST
Review the host before attaching Career data or authorization
Prefer authenticated transport and reject accidental plain HTTP in your own policy.
Do not let untrusted input select arbitrary loopback, private or link-local targets.
Send only fields the remote contract requires; never upload a whole Career snapshot by convenience.
The response reports a count, but the documented request setters expose no final-host policy.
Once transmitted, rollback belongs to the remote system. A Career backup cannot recall a request body.
11 / CONTROLLED RUN
Prove a harmless request before adding data, auth or remote writes
- 01PAIRRecord FC build, LE version and source revision
The Wiki has one HTTP-page revision dated 1 October 2025 and publishes no separate minimum editor version.
- 02HOSTApprove one exact HTTPS destination
Resolve owner, purpose, path and expected redirect behavior outside the script.
- 03READ TESTStart without auth or Career data
Use a harmless GET and a finite timeout; preserve error, status and elapsed evidence.
- 04CONTRACTMatch the expected status and content type
Do not decode every 2xx or HTML error page as JSON.
- 05DATAAdd the minimum synthetic payload
Prove form payload or raw-body behavior with non-sensitive values.
- 06AUTHUse a constrained test credential
Keep it out of source, URL, logs and screenshots; revoke it after the experiment.
- 07WRITEEnable remote mutation last
Use a disposable remote record, verify exactly one effect and preserve the response receipt.
12 / FAILURE ROUTING
The first failing field chooses the diagnostic branch
Check REQUEST:new(), the exact uppercase enum and the current Lua API context.
Record the minimal message, URL host, timeout and version pair without secrets.
Retest without auth and approve the destination independently.
Inspect method, path, headers, auth and payload—not the JSON decoder first.
Stop retries that could duplicate writes; follow the endpoint’s retry contract.
Preserve status and content type; handle text, empty or malformed responses explicitly.
13 / VIDEO & INTENT AUDIT
Current Lua videos show execution demand—not the HTTP object model
Four YouTube searches produced 60 result slots and 33 unique videos. Results were dominated by generic Live Editor promotions, face scripts, coach editing, mod setup and unrelated Lua tools. No result documented REQUEST:new, the seven enums, the response table or secret/redirect handling.
CURRENT LUA RESULT: the realfaces tutorial demonstrates script execution, not network calls.
LEGACY WORKFLOW: an EAFC25 Lua guide supports UI vocabulary only.
NO EXACT HTTP GUIDE: creator Wiki and class pages remain the only product-specific contract.
Third-party scripts must pass the same host, method, payload and secret review as original code.
14 / FAQ
FC 26 Lua HTTP questions answered at the object boundary
01What is the exact FC 26 Live Editor HTTP call?+
Create an HTTPRequest through REQUEST:new(), configure it, then call HTTP:send(req). The call returns an HTTPResponse table.
02Do I need os.execute and curl?+
No. The official Wiki describes the HTTP module as a replacement for invoking curl through os.execute and says it is backed by libcpr.
03Which HTTP methods are documented?+
GET, HEAD, OPTIONS, PUT, DELETE, POST and PATCH are mapped to integer enum values 1 through 7.
04Is timeout measured in seconds?+
No. HTTPRequest documents timeout in milliseconds. The Wiki example uses 10000 while calling it 1s; those two statements conflict, because 10000 ms is 10 seconds.
05What is the difference between SetPayload and SetBody?+
The official payload example sends a Lua table and the shown response identifies form data. SetBody accepts a raw string; the separate example adds a Content-Type header.
06Can I send JSON?+
The Wiki demonstrates decoding response text with imports/external/json. For a JSON request, use a raw JSON string with SetBody and an explicit application/json Content-Type; treat this as a constructed pattern and test it against your endpoint.
07How should I parse a JSON response?+
Check transport and HTTP status first, then call json.decode inside pcall so malformed or non-JSON response text does not abort the remaining script.
08Does status code 200 cover every successful API operation?+
No. The official examples assert 200, but an endpoint can define another 2xx success code. Match the exact endpoint contract rather than copying one assertion universally.
09Which authentication modes exist?+
The request class documents Basic, Digest, NTLM and Bearer modes. Keep credentials out of shared source, screenshots, query strings and response logs.
10Can an HTTP script change my Career save?+
A request does not itself write Career data, but it can transmit information or change a remote service. Any code that processes the response may then perform additional local or Career operations.
11Why should redirects be treated carefully?+
HTTPResponse exposes redirect_count, but the documented HTTPRequest setters do not expose a redirect allowlist or final-URL field. Test redirect behavior before attaching sensitive authentication.
12Does the preflight lab make a real request?+
No. It only analyses the entered text and generates Lua in your browser. Copying is gated, credentials stay as placeholders and no fetch call exists in the component.
15 / EVIDENCE LEDGER
Creator classes define the API; standards define the network terms
Product behavior comes from the FC 26 Wiki, repository and manifest. Lua, HTTP, JSON and security references only explain their own language or protocol boundaries. Video contributes search-intent evidence—not method semantics.
Primary HTTP:send declaration and official GET, cookies, headers, auth, payload and body examples.
Primary eight fields, eight setters, seven method enums and four auth enums.
Primary ten returned response fields.
Official Lua 5.4.6 engine context and HTTP surface link.
Creator-owned project provenance.
Current game and Live Editor mapping; not an invented HTTP minimum.
Release chronology; no separate HTTP introduction claim found.
Official logging surface for controlled diagnostics.
Upstream native HTTP library identified by the creator Wiki.
Protected-call semantics used for defensive response decoding.
HTTP method and response semantics.
JSON data interchange specification.
Host allowlisting and private-network target threat model.
Secret lifecycle and exposure guidance.
Reserved example.com use in documentation and dry-run samples.
Closest current Lua execution result; no HTTP API coverage.
Legacy execution vocabulary only.
Current scripting demand; unrelated to HTTP contracts.