*Workflows › Guides*

# Start a workflow from your own system

> Your web shop posts each new order to Filmo. The workflow shows an internal notification with the order number and total.

> **Before you start:** All data below is fictitious. You need an administrator role. The workflow only shows a notification inside the app: it sends no email and changes no data.

## Build it

1. **Create the workflow** «New workflow», «Set up a trigger», «Webhook».
2. **Declare the body** Under «Body», declare a «Structure» with three fields: `orderNumber` («Text»), `customerEmail` («Text») and `total` («Number»).
3. **Show a notification** Add «Internal notification». Style neutral, to all users. Title: "New web order". Message: insert the variables `orderNumber` and `total` from the trigger's body.
4. **Publish and go live** «Publish and activate». Then copy the «Endpoint» and the «Secret» from the trigger's side panel.

## Send a delivery

*A valid delivery*

```bash
curl -sS -X POST "https://app.filmo.io/api/webhooks/workflows/whk_<token>" \
  -H "X-Webhook-Secret: whsec_<secret>" \
  -H "Idempotency-Key: web-order-1001" \
  -H "Content-Type: application/json" \
  -d '{"orderNumber":"W-1001","customerEmail":"ana@example.com","total":120.5}'
```

Filmo answers 202 with the id of the run. Open the Runs tab: the run completed, and everyone in the app received the notification. Send the same command again: the second answer is 200 with `duplicate: true` and the same run id, because the `Idempotency-Key` is the same.

## See the part that surprises

*A delivery whose total is text*

```bash
curl -sS -X POST "https://app.filmo.io/api/webhooks/workflows/whk_<token>" \
  -H "X-Webhook-Secret: whsec_<secret>" \
  -H "Content-Type: application/json" \
  -d '{"orderNumber":"W-1002","customerEmail":"ana@example.com","total":"120.5"}'
```

This one also answers 202. But `total` is the text "120.5", not a number, so the run starts and fails with "the webhook body does not match the declared type: total: expected a number and received a text". The sender is never told. This is why you should check the Runs tab, or declare the field as Unknown if your sender cannot be trusted to send numbers.

## Things to check

- 404 means not published, not live, paused or a wrong token. 401 means a missing or wrong secret.
- There is no way to change the token or the secret. If one leaks, build a new workflow.
- Anyone who can open a public workflow can read its secret (administrators can still open private ones). Make it private if that matters.
- Send an `Idempotency-Key` for anything that must not run twice.

> **Note:** The complete contract, with every response and limit, is in [Incoming webhooks](https://docs.filmo.io/workflows/incoming-webhooks).

---

Canonical URL: https://docs.filmo.io/workflows/guides/start-from-your-system  
Last updated: 2026-10-09