Description: Hi Team, We’ve identified a limitation related to header injection when configuring API calls via button actions in Harness. Issue: Currently, we are unable to pass the logged-in user’s email dynamically in the API request header from a button action. Impact: This restriction is preventing us from implementing fine-grained access control based on the logged-in user context. Without this capability, we are unable to enforce proper authorization logic in downstream services. Current Workaround: We are passing the user email via query parameters instead of headers. However, this is not ideal due to: Security concerns (query params are more exposed/logged) Standard API design practices prefer headers for identity/context propagation Request: Introduce support for injecting logged-in user attributes (e.g., email) into API request headers for button-triggered actions. Ideally,this should align with how user context is exposed in formContext or similar constructs and allow consistent usage across API
