Forum Discussion
Setting Host and Date header fields in Web query
Hi mbowler,
Thanks for reaching out to the Microsoft fabric community forum.
Power Query blocks you from setting certain HTTP headers directly (Host, Date, Referer, Cookie, and a few others) because these are considered restricted and are controlled by the underlying HTTP stack for security and protocol compliance reasons.
For Host, Power Query automatically sets it based on the URL you pass to Web.Contents. The only way to change it is to make the request to that exact host in your _Uri, you can’t override it in the Headers record.
For Date it’s similar, Power Query will generate it automatically when needed, and it can’t be injected via the Headers parameter. If your API requires a specific timestamp for HMAC signing, you’ll need to generate the timestamp in M. Then use it when building your HMAC signature and pass it to the API in a custom header name (e.g. x-my-date) if the API supports it, or ensure the server uses the auto-generated Date header in the validation.
Unfortunately, there’s no supported way to override those restricted headers from within M code, even in a custom connector it’s a limitation of the Power Query engine. If your API requires your exact Host and Date header values, the only workaround would be to make the call outside of Power Query (e.g. via an Azure Function, API gateway, or other middleware) and then pull the results into Power Query.
If I misunderstand your needs or you still have problems on it, please feel free to let us know.
Best Regards,
Hammad.
Hi mbowler,
As we haven’t heard back from you, so just following up to our previous message. I'd like to confirm if you've successfully resolved this issue or if you need further help.
If yes, you are welcome to share your workaround so that other users can benefit as well. And if you're still looking for guidance, feel free to give us an update, we’re here for you.
Best Regards,
Hammad.
Hi Hammad, thanks for your reply.
I can see that the if M sets the Host to the base of the query url then that will be fine as this is what the API is expecting but unfortunately Date header needs to be the exact same string as was used in the generation of the HMAC. The encoded text used to generate the HMAC is a combination of the full query and the Date:
"GET
https://the.host.com/api/events?quantity=100
Tue, 19 Aug 2025 10:10:18 GMT"
I find it curious that M restricts the setting of Date and Host headers for security reasons because the same restriction is not applied to Power Automate, I was easily able to create a HTTP action and set these fields. I would have used PA to automate the getting of the data from this API except for the problem of dynamically generating the HMAC in PA online. There are paid-for connectors available but I'm looking for no-cost solution.
Is it usual practice to set the Accept as Solution when the solution is "there is no solution"? If so, I'll set it.
Hi mbowler,
Thanks for following up to the issue and clarifying further. You are correct since your API is validating the HMAC against the exact Date header value, the restriction in Power Query becomes a blocking issue. Unlike Power Automate or other HTTP clients, Power Query simply does not allow you to override Date or Host. Those headers are locked by the underlying engine and there isn’t a supported way around it in either M scripts or a custom connector.
In these cases, the usual pattern is to introduce a middle layer (for example, an Azure Function, API Management, or any lightweight service) that can accept your signed request, inject the required Date and Host headers, and then forward the call to the target API. Power Query would then just call that middle endpoint. That way you stay within the Power Query limits but still satisfy the API’s HMAC requirements.
Also yes if the answer is that Power Query cannot do this, then marking it as “Solution” is still the right step, so others searching will know that the limitation is by design.
Best Regards,
Hammad.