2026-09-27

Power Automate HTTP request API: start and poll a Sume run

Call the Sume API from a Power Automate HTTP action: start a Format run, poll it in a Do until loop, and read the key from a Key Vault secret.

6 min readSume

All posts

To call the Sume API from Power Automate, add an HTTP action that POSTs to https://api.sume.com/v1/formats/{handle}/{slug}/runs with an Authorization: Bearer header and an Idempotency-Key, then poll GET /v1/format-runs/{run_id} in a Do until loop with a one-minute Delay until the run's cancelable is false. Read the key from a Key Vault secret, never from the flow itself.

Sume has no Power Automate connector; the HTTP action makes plain HTTPS calls. Sume facts come from Create a run and Runs and results. Microsoft facts come from Power Automate's limits, error reference, designer, and troubleshooting pages, the Power Apps page on Key Vault secrets, and the Azure Logic Apps pages on the HTTP action and Until loops; Microsoft's FAQ describes Logic Apps as having Power Automate's features plus more. All were read on 2026-09-27. For the webhook version of this pattern, see Zapier AI video automation.

What does the flow need before the first call?

Three things, set up once:

A premium license. Microsoft's error reference lists HTTP among the premium connectors: a flow with one, run by a user on a seeded Microsoft 365 license, fails with DirectApiAuthorizationRequired. Its fixes: a Power Automate Premium license for the user who triggers or runs the flow (the owner, for a scheduled or automated flow), or a per-flow Process license.
A Sume key with formats:write and formats:read. Keys created before the Formats API shipped don't carry them and get 403 insufficient_scope.
The key in Azure Key Vault, referenced by an environment variable of type Secret in a solution. Microsoft's secure data guidance says not to hard-code API keys in a flow, because anyone with access to it can open an action's inputs in run history.

How do I pass the Sume key without exposing it?

Secret environment variables aren't offered in the dynamic content selector, so read the secret with an action, as Microsoft's Key Vault page shows:

Add the Microsoft Dataverse action Perform an unbound action, choose RetrieveEnvironmentVariableSecretValue, enter the variable's unique name, rename the step GetSecret, and turn on Secure outputs.
In each Sume HTTP action, set the Authorization header to Bearer followed by the expression body('GetSecret')['EnvironmentVariableSecretValue'], and turn on Secure inputs so run history hides it.
Send Authorization: Bearer or x-api-key, never both.

How do I start the run with the HTTP action?

Add an HTTP action named Start_run with method POST and URI https://api.sume.com/v1/formats/sume/sume-product-usage-demo/runs, a catalog Format, or your own {handle}/{slug}. Add Content-Type: application/json and Idempotency-Key headers. The body must name at least one of instruction, input, previous_run_id, or attachments:

{
  "instruction": "Make a vertical product demo from the attached photo.",
  "attachments": [
    { "type": "input_image", "image_url": "https://example.com/product.jpg" }
  ],
  "generation_spend_cap_usd": 20
}

Which Start_run settings prevent duplicate or stuck calls?

Three settings on the create call matter:

Build Idempotency-Key from the item that triggered the flow plus a version. The default retry policy retries up to 12 times on medium and high profiles with premium connectors, and Sume answers a replay of the same key and body with the original run: 200, no second charge.
Turn off the Asynchronous pattern setting if your HTTP action has one. Microsoft's Logic Apps page says the HTTP action's setting is on by default and suggests turning it off for endpoints whose 202 has no location header, so the action doesn't keep checking. Sume's 202 puts the run's URLs in the JSON body, and its documented response headers include no location header.
generation_spend_cap_usd is this run's generation ceiling, up to the $500 platform maximum.

How do I poll the run until it finishes?

Add a Do until loop. Inside it, add a one-minute Delay, then an HTTP GET named Get_run to https://api.sume.com/v1/format-runs/ followed by the expression body('Start_run')['data']['id'], with the same secured header. Loop until body('Get_run')['data']['cancelable'] is equal to false: cancelable is a boolean on every receipt, true while a run is queued or processing.

A 429 or 503 inside the loop is transient: the run is still executing and spending, so wait and poll again.
Microsoft's Logic Apps loop page says run history shows each iteration's details only after the whole loop completes.

From Power Automate's limits, the Logic Apps loops page, and Sume's Runs and results, read 2026-09-27.
Setting	Microsoft's number	For a Sume run	Why
Delay inside the loop	—	1 minute	Sume says to back off, doubling the gap up to a minute.
Until iterations (Count)	Default 60, maximum 5,000	100	At one poll a minute, 60 iterations cover about an hour.
Until Timeout	Logic Apps default: `PT1H` (one hour)	`PT2H`	A run still going 90 minutes after `created_at` is force-finalized as `failed`.
Outbound synchronous request	120-second limit	Fits	Each `GET` answers at once; Microsoft suggests an Until loop for longer work.

What does the flow do with the finished run?

Add a condition on body('Get_run')['data']['status']. Sume Format run lifecycle covers every field on the receipt.

completed: output, artifacts[], and primary_output_url are populated. Media URLs are durable media.sume.com HTTPS URLs that don't expire and are public to anyone holding them.
failed: error says why, and artifacts[] still carries whatever was made.
canceled: stopped by POST …/cancel. skipped: never ran, because it was sent with on_active_run: "skip" while another run was in flight.