Invoke-WebRequest

Gets content from a web page on the internet. The Invoke-WebRequest cmdlet sends HTTP, HTTPS, FTP, and FILE requests to a web page or web service. It parses the response and returns collections of forms, links, images, and other significant HTML elements. This cmdlet was introduced in Windows PowerShell 3.0. WARNING: By default, Invoke-WebRequest parses the content of the web page. Script code in the web page might be run when the page is parsed. On December 9, 2025, Microsoft released a security update for CVE-2025-54100 that changes the default behavior of Invoke-WebRequest. After you install the updates, when you use the Invoke-WebRequest command you see the following confirmation prompt with security warning of script execution risk: To avoid the confirmation prompt, you must use the UseBasicParsing parameter. There is no way to bypass this prompt without using the UseBasicParsing parameter. If you answer "Y" to the prompt, the command runs with full parsing of the web page content, which could run script code in the web page. For more information about this security update, see PowerShell 5.1: Preventing script execution from web content. By default, the HTTP request includes default values for the following HTTP headers: - Host - User-Agent Use the Headers parameter to add other headers or override the default values. This command can be run using the iwr, curl, or wget aliases.

Invoke-WebRequest [-UseBasicParsing] [-Uri] <Uri> [-WebSession <WebRequestSession>] [-SessionVariable <String>] [-Credential <PSCredential>] [-UseDefaultCredentials] [-CertificateThumbprint <String>] [-Certificate <X509Certificate>] [-UserAgent <String>] [-DisableKeepAlive] [-TimeoutSec <Int32>] [-Headers <IDictionary>] [-MaximumRedirection <Int32>] [-Method <WebRequestMethod>] [-Proxy <Uri>] [-ProxyCredential <PSCredential>] [-ProxyUseDefaultCredentials] [-Body <Object>] [-ContentType <String>] [-TransferEncoding <String>] [-InFile <String>] [-OutFile <String>] [-PassThru] [<CommonParameters>]

Its page in the reference: Invoke-WebRequest.

Show its 23 parameters

-BodySpecifies the body of the request. The body is the content of the request that follows the headers. You can also pipe a body value to Invoke-WebRequest. The Body parameter can be used to specify a list of query parameters or specify the content of the response. When the input is a GET request and the body is an IDictionary (typically, a hash table), the body is added to the URI as query parameters. For other request types (such as POST), the body is set as the value of the request body in the standard name=value format. When the body is a form, or it is the output of an Invoke-WebRequest call, PowerShell sets the request content to the form fields. For example: $r = Invoke-WebRequest https://website.com/login.aspx $r.Forms[0].Name = "MyName" $r.Forms[0].Password = "MyPassword" Invoke-RestMethod https://website.com/service.aspx -Body $r - or - Invoke-RestMethod https://website.com/service.aspx -Body $r.Forms[0]

-CertificateSpecifies the client certificate that's used for a secure web request. Enter a variable that contains a certificate or a command or expression that gets the certificate. To find a certificate, use Get-PfxCertificate or use the Get-ChildItem cmdlet in the Certificate (Cert:) drive. If the certificate isn't valid or doesn't have sufficient authority, the command fails.

-CertificateThumbprintSpecifies the digital public key certificate (X509) of a user account that has permission to send the request. Enter the certificate thumbprint of the certificate. Certificates are used in client certificate-based authentication. Certificates can only be mapped only to local user accounts, not domain accounts. To see the certificate thumbprint, use the Get-Item or Get-ChildItem command to find the certificate in Cert:\CurrentUser\My.

-ContentTypeSpecifies the content type of the web request. If the value for ContentType contains the encoding format (as charset), the cmdlet uses that format to encode the body of the web request. If the ContentType doesn't specify an encoding format, the default encoding format is used instead. An example of a ContentType with an encoding format is text/plain; charset=iso-8859-5, which specifies the Latin/Cyrillic alphabet. If you omit the parameter, the content type may be different based on the HTTP method you use: - For a POST method, the content type is application/x-www-form-urlencoded - For a PUT method, the content type is application/json - For other methods, the content type isn't specified in the request If you are using the InFile parameter to upload a file, you should set the content type. Usually, the type should be application/octet-stream. However, you need to set the content type based on the requirements of the endpoint.

-CredentialSpecifies a user account that has permission to send the request. The default is the current user. Credentials are stored in a PSCredential object and the password is stored as a SecureString. NOTE: For more information about SecureString data protection, see How secure is SecureString?.

-DisableKeepAliveIndicates that the cmdlet sets the KeepAlive value in the HTTP header to False. By default, KeepAlive is True. KeepAlive establishes a persistent connection to the server to facilitate subsequent requests.

-HeadersSpecifies the headers of the web request. Enter a hash table or dictionary. To set UserAgent headers, use the UserAgent parameter. You cannot use this parameter to specify UserAgent or cookie headers.

-InFileGets the content of the web request body from a file. Enter a path and filename. If you omit the path, the default is the current location. You also need to set the content type of the request. For example, to upload a file you should set the content type. Usually, the type should be application/octet-stream. However, you need to set the content type based on the requirements of the endpoint.

-MaximumRedirectionSpecifies how many times PowerShell redirects a connection to an alternate Uniform Resource Identifier (URI) before the connection fails. The default value is 5. A value of 0 (zero) prevents all redirection.

-MethodSpecifies the method used for the web request. The acceptable values for this parameter are: - Default - Delete - Get - Head - Merge - Options - Patch - Post - Put - Trace

-OutFileSpecifies the output file for which this cmdlet saves the response body. Enter a path and file name. If you omit the path, the default is the current location. By default, Invoke-WebRequest returns the results to the pipeline. To send the results to a file and to the pipeline, use the PassThru parameter.

-PassThruIndicates that the cmdlet returns the results, in addition to writing them to a file. This parameter is valid only when the OutFile parameter is also used in the command. NOTE: When you use the PassThru parameter, the output is written to the pipeline but the file is empty. For more information, see PowerShell Issue #15409.

-ProxySpecifies a proxy server for the request, rather than connecting directly to the Internet resource. Enter the URI of a network proxy server.

-ProxyCredentialSpecifies a user account that has permission to use the proxy server specified by the Proxy parameter. The default is the current user. This parameter is valid only when the Proxy parameter is also used in the command. You can't use the ProxyCredential and ProxyUseDefaultCredentials parameters in the same command.

-ProxyUseDefaultCredentialsIndicates that the cmdlet uses the credentials of the current user to access the proxy server that is specified by the Proxy parameter. This parameter is valid only when the Proxy parameter is also used in the command. You can't use the ProxyCredential and ProxyUseDefaultCredentials parameters in the same command.

-SessionVariableSpecifies a variable for which this cmdlet creates a web request session and saves it in the value. Enter a variable name without the dollar sign ($) symbol. When you specify a session variable, Invoke-WebRequest creates a web request session object and assigns it to a variable with the specified name in your PowerShell session. You can use the variable in your session as soon as the command completes. Unlike a remote session, the web request session isn't a persistent connection. It's an object that contains information about the connection and the request, including cookies, credentials, the maximum redirection value, and the user agent string. You can use it to share state and data among web requests. To use the web request session in subsequent web requests, specify the session variable in the value of the WebSession parameter. PowerShell uses the data in the web request session object when establishing the new connection. To override a value in the web request session, use a cmdlet parameter, such as UserAgent or Credential. Parameter values take precedence over values in the web request session. …

-TimeoutSecSpecifies how long the request can be pending before it times out. Enter a value in seconds. The default value, 0, specifies an indefinite time-out. A Domain Name System (DNS) query can take up to 15 seconds to return or time out. If your request contains a host name that requires resolution, and you set TimeoutSec to a value greater than zero, but less than 15 seconds, it can take 15 seconds or more before a WebException is thrown, and your request times out.

-TransferEncodingSpecifies a value for the transfer-encoding HTTP response header. The acceptable values for this parameter are: - Chunked - Compress - Deflate - GZip - Identity

-UriSpecifies the Uniform Resource Identifier (URI) of the Internet resource to which the web request is sent. Enter a URI. This parameter supports HTTP, HTTPS, FTP, and FILE values. This parameter is required. The parameter name Uri is optional.

-UseBasicParsingIndicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.

-UseDefaultCredentialsIndicates that the cmdlet uses the credentials of the current user to send the web request.

-UserAgentSpecifies a user agent string for the web request. The default user agent is similar to Mozilla/5.0 (Windows NT; Windows NT 6.1; en-US) WindowsPowerShell/3.0 with slight variations for each operating system and platform. To test a website with the standard user agent string that is used by most Internet browsers, use the properties of the PSUserAgent class, such as Chrome, Firefox, InternetExplorer, Opera, and Safari. For example, the following command uses the user agent string for Internet Explorer: Invoke-WebRequest -Uri https://website.com/ -UserAgent ([Microsoft.PowerShell.Commands.PSUserAgent]::InternetExplorer)

-WebSessionSpecifies a web request session. Enter the variable name, including the dollar sign ($). To override a value in the web request session, use a cmdlet parameter, such as UserAgent or Credential. Parameter values take precedence over values in the web request session. Unlike a remote session, the web request session is not a persistent connection. It is an object that contains information about the connection and the request, including cookies, credentials, the maximum redirection value, and the user agent string. You can use it to share state and data among web requests. To create a web request session, enter a variable name, without a dollar sign, in the value of the SessionVariable parameter of an Invoke-WebRequest command. Invoke-WebRequest creates the session and saves it in the variable. In subsequent commands, use the variable as the value of the WebSession parameter. You can't use the SessionVariable and WebSession parameters in the same command.