Start a workflow from your own system

1. 1

   Create the workflow

   «New workflow», «Set up a trigger», «Webhook».

2. 2

   Declare the body

   Under «Body», declare a «Structure» with three fields: orderNumber («Text»), customerEmail («Text») and total («Number»).

3. 3

   Show a notification

   Add «Internal notification». Style neutral, to all users. Title: "New web order". Message: insert the variables orderNumber and total from the trigger's body.

4. 4

   Publish and go live

   «Publish and activate». Then copy the «Endpoint» and the «Secret» from the trigger's side panel.

curl -sS -X POST "https://app.filmo.io/api/webhooks/workflows/whk_<token>" \
  -H "X-Webhook-Secret: whsec_<secret>" \
  -H "Idempotency-Key: web-order-1001" \
  -H "Content-Type: application/json" \
  -d '{"orderNumber":"W-1001","customerEmail":"ana@example.com","total":120.5}'

Filmo answers 202 with the id of the run. Open the Runs tab: the run completed, and everyone in the app received the notification. Send the same command again: the second answer is 200 with duplicate: true and the same run id, because the Idempotency-Key is the same.

curl -sS -X POST "https://app.filmo.io/api/webhooks/workflows/whk_<token>" \
  -H "X-Webhook-Secret: whsec_<secret>" \
  -H "Content-Type: application/json" \
  -d '{"orderNumber":"W-1002","customerEmail":"ana@example.com","total":"120.5"}'

This one also answers 202. But total is the text "120.5", not a number, so the run starts and fails with "the webhook body does not match the declared type: total: expected a number and received a text". The sender is never told. This is why you should check the Runs tab, or declare the field as Unknown if your sender cannot be trusted to send numbers.

• 404 means not published, not live, paused or a wrong token. 401 means a missing or wrong secret.
• There is no way to change the token or the secret. If one leaks, build a new workflow.
• Anyone who can open a public workflow can read its secret (administrators can still open private ones). Make it private if that matters.
• Send an Idempotency-Key for anything that must not run twice.