Resume a paused flow run (public, one-time)
POST/api/flows/callback/:token
The await_callback step's own url. Public, and deliberately
unsigned: unlike the webhook trigger's long-lived shared url, this
one was handed to a caller by us mid-run and is good for exactly one
resume. The token IS the secret — 32 bytes of randomness, burned on
use — and a signature over a one-time capability adds a key to manage
without adding a guarantee. The same reasoning as a password-reset link.
Used, expired and never-minted all answer 404 with the same body, so
nobody can sweep for live runs.
The posted body lands where a form's answers land — in the run's own bag — and the flow branches on it. It can never name a node or pick a branch.
Request
Responses
- 200
- 404
- 413
Accepted. ignored: not_waiting when the run had already moved on — the token is burned either way, because a retry of "payment received" is not a second payment.
No such token, or it has been used or has expired.
The body is larger than this endpoint accepts.