Trigger a Webhook from Streaming Hub

curl --request POST \
  --url https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path} \
  --header 'Content-Type: application/json' \
  --header 'X-Lerian-Tenant-Id: <x-lerian-tenant-id>' \
  --header 'X-Webhook-Signature: <x-webhook-signature>' \
  --header 'X-Webhook-Timestamp: <x-webhook-timestamp>' \
  --data '{}'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path}"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Webhook-Signature", "<x-webhook-signature>")
	req.Header.Add("X-Webhook-Timestamp", "<x-webhook-timestamp>")
	req.Header.Add("X-Lerian-Tenant-Id", "<x-lerian-tenant-id>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {
    'X-Webhook-Signature': '<x-webhook-signature>',
    'X-Webhook-Timestamp': '<x-webhook-timestamp>',
    'X-Lerian-Tenant-Id': '<x-lerian-tenant-id>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
};

fetch('https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path}"

payload = {}
headers = {
    "X-Webhook-Signature": "<x-webhook-signature>",
    "X-Webhook-Timestamp": "<x-webhook-timestamp>",
    "X-Lerian-Tenant-Id": "<x-lerian-tenant-id>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "executionId": "f7e6d5c4-b3a2-1098-7654-321fedcba098",
  "workflowId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "completed",
  "stepResults": [
    {
      "stepNumber": 1,
      "stepName": "action_log-event",
      "nodeId": "log-event",
      "status": "completed",
      "output": {
        "action": "log"
      },
      "executedAt": "2026-03-17T14:35:00Z",
      "durationMs": 0
    }
  ],
  "finalOutput": {
    "workflow": {
      "transactionId": "txn-98765",
      "amount": 1500,
      "currency": "BRL",
      "customerId": "cust-12345",
      "message": "Payment received"
    }
  },
  "startedAt": "2026-03-17T14:35:00Z",
  "completedAt": "2026-03-17T14:35:00Z"
}

{
  "executionId": "f7e6d5c4-b3a2-1098-7654-321fedcba098",
  "startedAt": "2026-03-17T14:35:00Z",
  "status": "running",
  "workflowId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

{
  "code": "FLK-0361",
  "message": "no webhook registered for this path and method",
  "title": "Not Found"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

{
  "code": "FLK-0361",
  "message": "no webhook registered for this path and method",
  "title": "Not Found"
}

{
  "code": "FLK-0361",
  "message": "no webhook registered for this path and method",
  "title": "Not Found"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

Trigger a Webhook from Streaming Hub

Use this endpoint as the endpoint of a Streaming Hub webhook subscription. It triggers the same workflow execution as POST /v1/webhooks/{path}. Only the authentication is different: this route takes no Bearer token. Flowker verifies an HMAC-v1 signature over the raw request body with the tenant’s inbound signing secret, which the deployment keeps in its secrets backend. The signing secret of the subscription and the stored secret must be the same value. Flowker refuses a legacy sha256= (v0) signature, because v0 has no replay protection. Flowker serves this route only when the deployment turns on the signed Streaming Hub ingress. It is off by default.

POST

hub

webhooks

{path}

Trigger a Webhook from Streaming Hub

curl --request POST \
  --url https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path} \
  --header 'Content-Type: application/json' \
  --header 'X-Lerian-Tenant-Id: <x-lerian-tenant-id>' \
  --header 'X-Webhook-Signature: <x-webhook-signature>' \
  --header 'X-Webhook-Timestamp: <x-webhook-timestamp>' \
  --data '{}'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path}"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Webhook-Signature", "<x-webhook-signature>")
	req.Header.Add("X-Webhook-Timestamp", "<x-webhook-timestamp>")
	req.Header.Add("X-Lerian-Tenant-Id", "<x-lerian-tenant-id>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {
    'X-Webhook-Signature': '<x-webhook-signature>',
    'X-Webhook-Timestamp': '<x-webhook-timestamp>',
    'X-Lerian-Tenant-Id': '<x-lerian-tenant-id>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
};

fetch('https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://flowker.sandbox.lerian.net/v1/hub/webhooks/{path}"

payload = {}
headers = {
    "X-Webhook-Signature": "<x-webhook-signature>",
    "X-Webhook-Timestamp": "<x-webhook-timestamp>",
    "X-Lerian-Tenant-Id": "<x-lerian-tenant-id>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "executionId": "f7e6d5c4-b3a2-1098-7654-321fedcba098",
  "workflowId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "completed",
  "stepResults": [
    {
      "stepNumber": 1,
      "stepName": "action_log-event",
      "nodeId": "log-event",
      "status": "completed",
      "output": {
        "action": "log"
      },
      "executedAt": "2026-03-17T14:35:00Z",
      "durationMs": 0
    }
  ],
  "finalOutput": {
    "workflow": {
      "transactionId": "txn-98765",
      "amount": 1500,
      "currency": "BRL",
      "customerId": "cust-12345",
      "message": "Payment received"
    }
  },
  "startedAt": "2026-03-17T14:35:00Z",
  "completedAt": "2026-03-17T14:35:00Z"
}

{
  "executionId": "f7e6d5c4-b3a2-1098-7654-321fedcba098",
  "startedAt": "2026-03-17T14:35:00Z",
  "status": "running",
  "workflowId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

{
  "code": "FLK-0361",
  "message": "no webhook registered for this path and method",
  "title": "Not Found"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

{
  "code": "FLK-0361",
  "message": "no webhook registered for this path and method",
  "title": "Not Found"
}

{
  "code": "FLK-0361",
  "message": "no webhook registered for this path and method",
  "title": "Not Found"
}

{
  "code": "FLK-0001",
  "detail": "name is a required field",
  "errors": [
    {
      "location": "body.nodes",
      "message": "expected array length >= 1",
      "value": "<unknown>"
    }
  ],
  "instance": "/v1/workflows",
  "status": 400,
  "title": "Bad Request",
  "type": "https://errors.lerian.studio/v1/FLK-0001"
}

Headers

X-Webhook-Signature

string

required

HMAC-v1 signature over the raw body, in the form v1,sha256=<hex>. The hex value is the HMAC-SHA256 of v1:<X-Webhook-Timestamp>.<raw body>, keyed with the tenant's inbound signing secret. During a signing-secret rotation, the header repeats once for each active secret, two values at most. Flowker accepts the delivery when one value verifies.

X-Webhook-Timestamp

string

required

Unix time in seconds, the same value the signature covers. Flowker rejects a timestamp outside the freshness window, five minutes by default, even when the signature is correct.

X-Lerian-Tenant-Id

string

required

Tenant that owns the delivery. Flowker uses it to select the signing secret to check. A valid signature confirms it.

X-Lerian-Event-Id

string

Streaming Hub event ID. Flowker uses it as the replay key for each workflow. A delivery that repeats an event ID returns the first execution and does not run the workflow again.

X-Lerian-Delivery-Id

string

Delivery-attempt ID, recorded for correlation. It changes on every retry of the same event.

Idempotency-Key

string

Optional idempotency key. A repeated key returns the prior execution. When the delivery carries X-Lerian-Event-Id, the event ID takes precedence.

Path Parameters

path

string

required

Webhook path registered by a workflow. Supports nested paths with multiple segments at runtime. Forward slashes within the path must be percent-encoded as %2F per RFC 3986/OpenAPI 3.1 (for example, use orders%2Fpaid for orders/paid).

Body

application/json

The delivered event, byte for byte. The signature covers these bytes, so they must not be re-encoded in transit. Maximum size is 1 MB.

Event payload. When the webhook trigger defines an input contract, Flowker validates the payload against it.

Response

The workflow finished inside the synchronous window. The body carries the final business results.

completedAt

string<date-time>

Timestamp when the execution finished.

Example:

"2026-03-17T14:35:12Z"

executionId

string<uuid>

Unique identifier of the execution.

Example:

"f7e6d5c4-b3a2-1098-7654-321fedcba098"

finalOutput

object

Aggregated output from the last step or the workflow's final result.

Show child attributes

Example:

{
  "workflow": {
    "transactionId": "txn-98765",
    "amount": 1500,
    "currency": "BRL",
    "customerId": "cust-12345",
    "message": "Payment received"
  }
}

startedAt

string<date-time>

Timestamp when the execution started.

Example:

"2026-03-17T14:35:00Z"

status

string

Final status of the execution.

Example:

"completed"

stepResults

object[]

Ordered list of results for each step executed.

Show child attributes

workflowId

string<uuid>

ID of the workflow that was executed.

Example:

"a1b2c3d4-e5f6-7890-abcd-ef1234567890"

Getting started

Catalog API

Workflows API

Schedule API

Executions API

Dashboards API

Executor Configurations API

Provider Configurations API

Schema Registry API

OpenAPI Schemas API

XSD Schemas API

Webhooks API

Error handling

Trigger a Webhook from Streaming Hub

Headers

Path Parameters

Body

Response