diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
index 3b37fc3ae..4ea43edee 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
@@ -83,7 +83,10 @@ common_fields() ->
         {mechanism, emqx_authn_schema:mechanism(password_based)},
         {backend, emqx_authn_schema:backend(http)},
         {url, fun url/1},
-        {body, hoconsc:mk(map([{fuzzy, term(), binary()}]), #{desc => ?DESC(body)})},
+        {body,
+            hoconsc:mk(map([{fuzzy, term(), binary()}]), #{
+                required => false, desc => ?DESC(body)
+            })},
         {request_timeout, fun request_timeout/1}
     ] ++ emqx_authn_schema:common_fields() ++
         maps:to_list(
@@ -160,7 +163,6 @@ create(
         method := Method,
         url := RawURL,
         headers := Headers,
-        body := Body,
         request_timeout := RequestTimeout
     } = Config
 ) ->
@@ -173,10 +175,7 @@ create(
         base_query_template => emqx_authn_utils:parse_deep(
             cow_qs:parse_qs(to_bin(Query))
         ),
-        headers => Headers,
-        body_template => emqx_authn_utils:parse_deep(
-            maps:to_list(Body)
-        ),
+        body_template => emqx_authn_utils:parse_deep(maps:get(body, Config, #{})),
         request_timeout => RequestTimeout,
         resource_id => ResourceId
     },
diff --git a/apps/emqx_authz/src/emqx_authz_api_schema.erl b/apps/emqx_authz/src/emqx_authz_api_schema.erl
index 5550d4769..773e7c938 100644
--- a/apps/emqx_authz/src/emqx_authz_api_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_api_schema.erl
@@ -102,9 +102,14 @@ authz_http_common_fields() ->
     authz_common_fields(http) ++
         [
             {url, fun url/1},
-            {body, map([{fuzzy, term(), binary()}])},
+            {body,
+                hoconsc:mk(map([{fuzzy, term(), binary()}]), #{
+                    required => false, desc => ?DESC(body)
+                })},
             {request_timeout,
-                mk_duration("Request timeout", #{default => "30s", desc => ?DESC(request_timeout)})}
+                mk_duration("Request timeout", #{
+                    required => false, default => "30s", desc => ?DESC(request_timeout)
+                })}
         ] ++
         maps:to_list(
             maps:without(
diff --git a/apps/emqx_authz/src/emqx_authz_schema.erl b/apps/emqx_authz/src/emqx_authz_schema.erl
index 2a6c16e3f..4d200dad2 100644
--- a/apps/emqx_authz/src/emqx_authz_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_schema.erl
@@ -28,6 +28,8 @@
 -type action() :: publish | subscribe | all.
 -type permission() :: allow | deny.
 
+-import(emqx_schema, [mk_duration/2]).
+
 -export([
     namespace/0,
     roots/0,
@@ -177,8 +179,8 @@ http_common_fields() ->
     [
         {url, fun url/1},
         {request_timeout,
-            emqx_schema:mk_duration("Request timeout", #{
-                default => "30s", desc => ?DESC(request_timeout)
+            mk_duration("Request timeout", #{
+                required => false, default => "30s", desc => ?DESC(request_timeout)
             })},
         {body, #{type => map(), required => false, desc => ?DESC(body)}}
     ] ++