Skip to main content

Resume a paused flow run (public, one-time)

POST 
/api/flows/callback/:token

The await_callback step's own url. Public, and deliberately unsigned: unlike the webhook trigger's long-lived shared url, this one was handed to a caller by us mid-run and is good for exactly one resume. The token IS the secret — 32 bytes of randomness, burned on use — and a signature over a one-time capability adds a key to manage without adding a guarantee. The same reasoning as a password-reset link.

Used, expired and never-minted all answer 404 with the same body, so nobody can sweep for live runs.

The posted body lands where a form's answers land — in the run's own bag — and the flow branches on it. It can never name a node or pick a branch.

Request​

Responses​

Accepted. ignored: not_waiting when the run had already moved on — the token is burned either way, because a retry of "payment received" is not a second payment.