Acting as

API & webhooks

Use this project from other servers: authenticate with an API key, call /api/v1, and receive signed webhook events.

API keys

Name	Key	Created	Last used

Quick start

# List startable workflows
curl -H "Authorization: Bearer $WF_API_KEY" https://<host>/api/v1/workflows

# Start a case (Idempotency-Key makes retries safe)
curl -X POST https://<host>/api/v1/cases \
  -H "Authorization: Bearer $WF_API_KEY" -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1234" \
  -d '{"workflowId":"<id>","actorId":"<user id>","input":{ ... }}'

# Complete a task / send an external callback
curl -X POST https://<host>/api/v1/cases/<caseId>/events -H "Authorization: Bearer $WF_API_KEY" \
  -H "Content-Type: application/json" -d '{"type":"submit","taskId":"<id>","action":"approve","actorId":"<user>","input":{}}'

# Full reference: https://<host>/api/v1/openapi.json

Webhooks

Each request carries X-WF-Event, X-WF-Delivery and X-WF-Signature: t=…,v1=… (HMAC-SHA256 of `${t}.${body}` with the secret). Failed deliveries retry with exponential backoff (8 attempts).

Recent deliveries

Event	Status	Attempts	Last result	Queued