Ana içeriğe geç

Start a flow from another system (public)

POST 
/api/flows/webhook/:token

The dispatcher for the webhook flow trigger. Public, server-to-server: no session, no tenant context.

Trust is X-Signature: sha256=<hex> — an HMAC over the raw body, keyed by the per-trigger secret. The body is verified before anything parses it: a re-encoded body changes bytes (key order, unicode escaping) and would fail verification on exactly the deliveries carrying a Turkish name, and no attacker-controlled bytes should reach a parser before the signature is checked.

The payload must say who the event is about — contact_id, email or phone. It becomes vars.payload.* and the flow branches on it; it can never name a node, pick a branch or carry a flow id.

By default nobody is created: an event about a stranger is accepted and answered ignored: no_contact. The trigger's own config.create_contact switches that on — the decision belongs to the author, not to this endpoint, because a public url that mints contacts on its own is a way of filling a database that helps nobody. Even switched on it needs a phone or an e-mail: a contact with neither is a row nobody can reach, match or delete.

Deliveries are deduplicated by token + X-Event-Id (or the body hash), so a retry of "payment received" is not a second payment. A verified-but-unusable delivery still answers 2xx — retrying cannot add a phone number to a body that has none. Rejections say only not_found or forbidden: a response that told them apart would tell a prober which of their guessed urls exists.

Request​

Responses​

Accepted. ignored says why nothing ran, when nothing did.