Both AI Action webhooks and a Workflow API step call an address you provide. If Mando rejects that address, it is protecting the request. This explains the common reasons and the fix.
It must be a public https URL
The address has to start with https:// and include a host. A plain http:// address, or one with no host, is rejected with URL must start with https:// and include a host.
[SCREENSHOT] Capture: a webhook URL field showing a validation error. Highlight: the URL field and its red validation message. Suggested alt text: "A rejected webhook URL in Mando". Replace this block with the image.
It cannot point to a private address
When you run a test, Mando checks that the URL resolves to a public server. An address on a private or internal network, such as localhost or an internal IP, is refused with a message like URL resolves to non-public address or Cannot resolve host. For a flow API step the test reports it more simply as URL must be a public https endpoint.
How to fix it
Use a public https endpoint with a valid hostname, hosted somewhere the internet can reach. Do not point at localhost or an internal address. If a flow test says the limit was reached, wait and try again, since flow API tests are capped per hour.
Frequently asked questions
Why is http not allowed?
Only secure https addresses are accepted, so the connection is encrypted.
My local server URL is refused.
Private and localhost addresses are blocked. Use a public endpoint the internet can reach.
Publishing a flow API step is blocked.
Publishing a Workflow that calls an API needs an admin.