Automation Webhooks: outgoing, incoming and their signatures
The Send to another app action in an automation signs every request with a secret that’s unique to each automation. The Another app sends data trigger gives you a public URL that accepts JSON up to 64 KB, with an optional signature.
Outgoing: the Send to another app action
It’s set up from the automation actions. The request carries these headers:
X-Workflow-Signaturesha256= + an HMAC of the raw bodyX-Workflow-TimestampX-Workflow-Signature-V2sha256= + an HMAC of timestamp.rawBody (preferred)X-Corteksa-Payload-Version1 or 2, for the shape of the automatic bodyIdempotency-KeyThe secret is unique to each automation, and starts with whsec_. The app doesn’t show it, so to check requests on your side, add a header of your own under Headers in the step, such as a key your system expects.
{ id, label }, assignees by their IDs, and event_id to prevent duplicatesDelivery: a 10-second timeout, redirects aren’t followed, and any 2xx is success. It’s retried on 5xx, 408, 425, 429 and network drops, up to 5 attempts, with a gap that starts at 5 seconds and doubles up to 10 minutes. Delivery is “at least once”, so prevent duplicates with Idempotency-Key.
Internal and private addresses are refused. Up to 20 custom headers, and each value up to 2,048 characters.
Incoming: Another app sends data
A trigger in automations that gives you a public URL, POST /api/v1/workflow-hooks/{token}.
application/json, up to 64 KBX-Corteksa-Timestamp within 5 minutes, and X-Corteksa-Signature: v1=<HMAC(secret, timestamp.rawBody)>Idempotency-Key for a day, or the same body within 10 minutes202 with request_id and duplicatePress Add a signing secret to turn on the signature: the secret shows once, and after that every request must be signed. Lost it? Press Make new. Stop checking turns the signature off.
If something goes wrong
401 BAD_SIGNATUREtimestamp.rawBody with the current secret.409 WORKFLOW_OFF413 BODY_TOO_LARGE415 BODY_NOT_JSON_OBJECT429 HOOK_RATE_LIMITEDRetry-After says, and send fewer requests.429 WORKFLOW_RUNS_USED_UP404 HOOK_NOT_FOUND