Automations
Workflows and webhooks that react to system events
List automations (staff)
Staff only (owner, admin, instructor). Optionally only workflows or only webhooks.
Create a workflow automation (staff)
Staff only (owner, admin, instructor). 400 when a trigger is reserved, not an event the system emits or an unsupported schedule, or an action is reserved for webhooks.
List the actions automations can use (staff)
Staff only (owner, admin, instructor).
List the domain events automations can react to (staff)
Staff only (owner, admin, instructor).
Get an automation (staff)
Staff only (owner, admin, instructor). Workflows and webhooks alike.
Update a workflow automation (staff)
Staff only (owner, admin, instructor). Webhooks change through the webhook endpoints (409). 400 when a trigger is reserved, not an event the system emits or an unsupported schedule, or an action is reserved for webhooks.
Delete a workflow automation (staff)
Staff only (owner, admin, instructor). Webhooks are deleted through the webhook endpoints, and system automations cannot be deleted (409). Its runs stay readable.
List an automation's runs (staff)
Staff only (owner, admin, instructor). A deleted automation's runs remain reachable as an audit trail, so an unknown id answers an empty page rather than 404. A run's event carries the fields a webhook delivery of that event would.
Run a finished run again (staff)
Staff only (owner, admin, instructor). Dispatches the same run again with the automation's current steps; the new outcome replaces the run's previous one. For a webhook this resends the delivery to its current URL. A run that is still running can't be rerun (409).
List the organization's webhooks (staff)
Staff only (owner, admin, instructor). Signing secrets are not included.
Create a webhook (staff)
Staff only (owner, admin, instructor). `url` must be a public address: localhost and private network addresses are refused when saved and when delivering. Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.
Get a webhook (staff)
Staff only (owner, admin, instructor). The signing secret is not included.
Change a webhook's URL, events, description or enabled flag (staff)
Staff only (owner, admin, instructor). Changes only the fields sent. 400 when an event is reserved or unknown.
Delete a webhook and its signing secret (staff)
Staff only (owner, admin, instructor). Its delivery history is kept.
Reveal a webhook's signing secret (staff)
Staff only (owner, admin, instructor).
Replace a webhook's signing secret (staff)
Staff only (owner, admin, instructor). The old secret stops working immediately.