Technology
ICP HTTPS Outcalls Explained
A pure smart contract is sealed off from the world — it can only see what is on its own chain. The Internet Computer breaks that seal: canisters can make HTTPS requests to any public API, directly from on-chain code. This is the feature that lets a canister know the price of ICP, check a weather feed, or fetch data without an oracle. Here is how it works.
August 16, 2026 · 5 min read
The oracle problem
Most blockchains have a hard boundary: smart contracts cannot call external APIs. To bring real-world data on-chain, they rely on oracles — separate services that fetch data off-chain and push it in. Oracles add a trusted third party, a lag, and (historically) an attack surface.
HTTPS outcalls let a canister fetch the data itself. No separate service, no trusted intermediary — the canister asks the network to perform an HTTP request on its behalf and receives the response as part of its own execution.
How an outcall works
The pattern is simple: your canister code specifies a URL, headers, and method, and calls the management canister to perform the request. The HTTP request is executed by the subnet's nodes, and the response is delivered back to your canister deterministically — every node that participates gets the same result, so state stays consistent across the subnet.
Because the request is part of canister execution, the fetched data becomes part of the replicated state. If a canister fetches the ICP price and stores it, that price is now certified on-chain — available to every other canister and queryable by users.
Costs and limits
HTTPS outcalls are metered in cycles like everything else on ICP. A single outcall costs on the order of tens of millions of cycles — a small fraction of a cent at the XDR peg. The practical constraint is the response size: developers declare a max_response_bytes bound, and cost scales partly with that declared maximum. Set it as tight as your use case allows, or you pay for a ceiling you never use.
What canisters can do with them
- Live prices — a wallet or dashboard canister fetches the latest ICP price from an exchange API.
- Data relays — a canister reads real-world data and posts it to another chain, replacing a centralized oracle network.
- Notifications — trigger a webhook when on-chain conditions change.
- Off-chain settlement — fetch order status or verification results from an external service.
The trust trade-off
HTTPS outcalls remove the oracle as an intermediary, but the external API itself is still a source of truth you do not control. If a canister trusts a single price API, that API can lie to it. Production patterns mitigate this by querying multiple providers — the same consensus-style approach the EVM RPC canister uses for Ethereum, or the exchange-rate canister uses for prices.
The key property is that whatever the canister accepts becomes certified on-chain. The choice of how many sources to trust is the developer's, not the network's.