Webhook

Inbound flow webhooks are configured on the flow (Webhooks tab, including the Actionflow Studio webhooks panel). There is no webhook start-node type. Use a Start node on the canvas, then create the webhook endpoint.

There is at most one inbound webhook per flow. Organization outgoing event webhooks are a different product; see Webhooks.

URL

https://actionflows.ai/app/webhooks/actionflows/{actionFlowId}/{token}

The Endpoint card is the source of truth. Production URLs use NEXT_PUBLIC_WEB_URL plus /app/webhooks/actionflows/{actionFlowId}/{token} (for example https://actionflows.ai/app/webhooks/actionflows/...). The host is not app.actionflows.ai/webhooks/....

Request body

POST JSON whose keys match {nodeId}_{inputName} when you want to fill empty node inputs.

The full request is also merged onto the start node as:

• body
• headers
• query
• method

Downstream nodes can wire from the start node even when no form inputs are empty.

curl -X POST https://actionflows.ai/app/webhooks/actionflows/{actionFlowId}/{token} \
  -H "Content-Type: application/json" \
  -H "X-Idempotency-Key: order-created-ORD-12345" \
  -d '{
    "event": "order.created",
    "data": {
      "order_id": "ORD-12345",
      "customer_email": "[email protected]",
      "total": 299.99
    }
  }'

A successful enqueue returns 202 with runId / queueId. triggerSource is webhook.

Security

• The secret token is in the path (timing-safe compare).
• Regenerate the token if it may be leaked.
• Deleted webhooks stop accepting traffic.
• Disabled webhooks reject requests.
• Paused flows (active: false, shown as passive in Settings) return 409 without enqueueing.
• POST only. Rate limited per organization and client IP.
• Send X-Idempotency-Key to deduplicate deliveries.

Webhook vs API

Related

• Webhooks overview (inbound plus org outbound HMAC events)
• API
• Settings for active vs passive (passive webhooks return 409)
• Scheduled if you need a timer instead of a POST