WebRequest looks like a normal HTTP client, but MetaTrader blocks every request until the exact base URL is listed under Tools, Options, Expert Advisors. The call also insists on HTTPS for most brokers and builds, and it returns false with a specific error when the whitelist, protocol, or timeout is wrong. Until those pieces are set, your EA never reaches the remote host.

What must be true first

  1. Open Tools, Options, Expert Advisors. Enable WebRequest for listed URL, then add the base origin such as https://api.example.com with no path. A path only entry often fails. Save and restart the EA after edits.
  2. Use HTTPS. Plain HTTP is refused in current builds for safety. Certificates must validate.
  3. Pass a timeout in milliseconds. Zero or a tiny value fails under normal latency. A few thousand milliseconds is a common starting point for light JSON APIs.
  4. Headers are a string array. Content type, authorization, and accept belong there. Body is a separate char array or string depending on the overload you call.

Minimal pattern 

bool FetchJson(const string url, string &outBody) { char result[]; char data[]; string headers = "Content-Type: application/json\r\n"; string resultHeaders; int timeout = 5000; ResetLastError(); int code = WebRequest("GET", url, headers, timeout, data, result, resultHeaders); if(code == -1) { int err = GetLastError(); Print("WebRequest failed, last error ", err, " Check Tools > Options > Expert Advisors URL list and HTTPS."); return false; } outBody = CharArrayToString(result, 0, WHOLE_ARRAY, CP_UTF8); if(code < 200 || code >= 300) { Print("HTTP status ", code, " body ", outBody); return false; } return true; } void OnTimer() { string body; string url = "https://api.example.com/v1/health"; if(!FetchJson(url, body)) return; Print("health ok, bytes ", StringLen(body)); }

Errors you will see

  1. Error 4014 (ERR_FUNCTION_NOT_ALLOWED) or a WebRequest specific deny often means the URL is missing from the whitelist, or AutoTrading related options block the call. Add the origin and reload the EA.
  2. A negative return with a network style last error points at DNS, TLS, or a blocked host. Test the same URL in a browser on that machine.
  3. HTTP 4xx or 5xx means the request left the terminal and the server answered. Log status and a short body prefix. Do not treat that the same as a whitelist miss.
  4. Strategy Tester: WebRequest is limited or disabled in many tester modes. Prefer a live or demo chart when validating connectivity, and stub responses in tests.

Practical tips

  1. Keep secrets out of source when you can. Prefer reading a token from a local file the user controls, and never print full authorization headers.
  2. Cap body size and parse defensively. A huge response can stall the EA thread.
  3. Call WebRequest from OnTimer or a worker pattern, not from every tick. Network I/O inside OnTick blocks trading logic.
  4. One origin per API. If you call both https://api.example.com and https://files.example.com, whitelist both.

Whitelist the HTTPS origin, set a real timeout, and treat a failed WebRequest as a configuration problem first. Only then debug the remote API.