Trigger a Webhook from Streaming Hub

Use this endpoint as the endpoint of a Streaming Hub webhook subscription. It triggers the same workflow execution as POST /v1/webhooks/{path}. Only the authentication is different: this route takes no Bearer token. Flowker verifies an HMAC-v1 signature over the raw request body with the tenant’s inbound signing secret, which the deployment keeps in its secrets backend. The signing secret of the subscription and the stored secret must be the same value. Flowker refuses a legacy sha256= (v0) signature, because v0 has no replay protection. Flowker serves this route only when the deployment turns on the signed Streaming Hub ingress. It is off by default. A sync route can return a status other than 200. A sync run whose execution failed answers 502 on every response view, so the caller can redeliver. The passthrough response view relays the provider’s status and body only when the run completed, which means the status is in the step’s success_status_codes. A set_output node’s responseStatusCode can set the status of a completed run. A verification ping answers 204 once its signature verifies and runs no workflow.

POST /v1/hub/webhooks/{path}

Trigger a Webhook from Streaming Hub

cURL

curl --request POST \
  --url https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path} \
  --header 'Content-Type: application/json' \
  --header 'X-Lerian-Tenant-Id: <x-lerian-tenant-id>' \
  --header 'X-Webhook-Signature: <x-webhook-signature>' \
  --header 'X-Webhook-Timestamp: <x-webhook-timestamp>' \
  --data '{}'

200

{
  "executionId": "f7e6d5c4-b3a2-1098-7654-321fedcba098",
  "workflowId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "completed",
  "stepResults": [
    {
      "stepNumber": 1,
      "stepName": "Set Payment Output",
      "nodeId": "set-output",
      "status": "completed",
      "output": {
        "actionType": "set_output",
        "output": {
          "status": "received"
        }
      },
      "executedAt": "2026-03-17T14:35:00Z",
      "durationMs": 0
    }
  ],
  "finalOutput": {
    "status": "received"
  },
  "startedAt": "2026-03-17T14:35:00Z",
  "completedAt": "2026-03-17T14:35:00Z"
}

Encabezados

X-Webhook-Signature · string · requerido

HMAC-v1 signature over the raw body, in the form v1,sha256=<hex>. The hex value is the HMAC-SHA256 of v1:<X-Webhook-Timestamp>.<raw body>, keyed with the tenant's inbound signing secret. During a signing-secret rotation, the header repeats once for each active secret, two values at most. Flowker accepts the delivery when one value verifies.

X-Webhook-Timestamp · string · requerido

Unix time in seconds, the same value the signature covers. Flowker rejects a timestamp outside the freshness window, five minutes by default, even when the signature is correct.

X-Lerian-Tenant-Id · string · requerido

Tenant that owns the delivery. Flowker uses it to select the signing secret to check. A valid signature confirms it.

X-Lerian-Event-Id · string

Streaming Hub event ID. Flowker uses it as the replay key for each workflow. A delivery that repeats an event ID returns the first execution and does not run the workflow again while it exists: an execution with a write step is kept without a time limit; a read-only one may be deleted after the retention window, after which the same key starts a new execution.

X-Lerian-Delivery-Id · string

Delivery-attempt ID, recorded for correlation. It changes on every retry of the same event.

Idempotency-Key · string

Optional idempotency key. When a verified Streaming Hub event ID is present, Flowker uses it instead. A repeated key replays the first execution while it exists: an execution with a write step is kept without a time limit; a read-only one may be deleted after the retention window, after which the same key starts a new execution.

X-Lerian-Event-Type · string

Type of the delivered event. The value hub.subscription.verification_ping marks the subscription verification ping. The signature does not cover this header.

Parámetros de ruta

path · string · requerido

Webhook path registered by a workflow. Supports nested paths with multiple segments at runtime. Forward slashes within the path must be percent-encoded as %2F per RFC 3986/OpenAPI 3.1 (for example, use orders%2Fpaid for orders/paid).

Cuerpo

application/json

The delivered event, byte for byte. The signature covers these bytes, so they must not be re-encoded in transit. Maximum size is 1 MB.

Event payload. When the webhook trigger defines an input contract, Flowker validates the payload against it.

Respuesta

200

application/json

The workflow finished inside the synchronous window. The body carries the final business results.

completedAt · string<date-time>

Timestamp when the execution finished.

Ejemplo:

"2026-03-17T14:35:12Z"

executionId · string<uuid>

Unique identifier of the execution.

Ejemplo:

"f7e6d5c4-b3a2-1098-7654-321fedcba098"

finalOutput · object

Aggregated output from the last step or the workflow's final result.

Ejemplo:

{ "status": "received" }

startedAt · string<date-time>

Timestamp when the execution started.

Ejemplo:

"2026-03-17T14:35:00Z"

status · string

Final status of the execution.

Ejemplo:

"completed"

stepResults · object[]

Ordered list of results for each step executed.

Show child attributes

workflowId · string<uuid>

ID of the workflow that was executed.

Ejemplo:

"a1b2c3d4-e5f6-7890-abcd-ef1234567890"