Why is this specific API request failing when sending via wp_remote_post?

Question

I'm pulling my hair out trying to make a POST request to an API endpoint using wp_remote_post.

The API needs a request with content-type multipart/mixed but WordPress doesn't seem to play nicely with that request type. It seems to be doing something to the POST body which causes the server to reject it. The response I receive is 400 Bad Request (nothing specific).

The request works fine when made via cURL or Postman. Moreover, other API requests made via WordPress to the same API (e.g. POST requests with type application/json) work fine so I know it's not a problem with connectivity/authorization, or user-agent issues on the API side.

I suspect WordPress is making changes to the headers or the body somehow before sending the request, or just isn't sending the body as "raw" data.

Here's the code:

$body = "--boundary
Content-Type: application/http

GET /foo/bar
--boundary
Content-Type: application/http

GET /bar/baz
--boundary--";

$endpoint = "https://example.com/api";

$options = [
    'body'        => $body,
    'headers'     => [
        'Content-Type' => 'multipart/mixed; boundary=--boundary',
        'Authorization' => 'Bearer sometoken',
    ],
    'data_format' => 'body'
];

wp_remote_post( $endpoint, $options );

Here is an example of the same cURL request from Postman which works when submitted via Postman or via cURL's command line:

curl -X POST https://example.com/api \
    -H 'Authorization: Bearer sometoken' \
    -H 'Content-Type: multipart/mixed;  boundary=boundary' \
    -d '--boundary
Content-Type: application/http

GET /foo/bar
--boundary
Content-Type: application/http

GET /bar/baz
--boundary--
'

Answer 1

Those with eagle eyes may have noticed that in the PHP code, the boundary string inside the Content-Type header was prefixed with two dashes (--).

Those dashes should have not been there. Removing them allows the request to work.

🤦‍♂️