Automation & Webhooks

Integrations → Automation Hub sends Graften events to any HTTPS endpoint (a generic "Webhook" trigger in Zapier, Make, Power Automate or n8n, or your own receiver), or straight into an action you built in Custom Connectors. API keys let those tools call Graften back.

Viewing rules, delivery logs and keys is open to everyone on the account. Creating, changing, testing or deleting them needs an account admin, and the same applies to Custom Connectors and inbound webhooks. This is enforced by the API, not just hidden in the portal.

Events

alert.created, incident.created, incident.updated, ticket.created, ticket.updated, score.changed, remediation.issued, change.approved, change.rejected, quote.approved, quote.rejected, agent.checkin, and custom.<name> for your own inbound webhooks. * subscribes to everything.

change.approved / change.rejected fire for every decision — an internal approval, the client's own approval link, or a client decision a staff member recorded — and the payload says which (decided_by, and method for client decisions). ticket.created also fires for tickets raised by a Make scenario.

Every delivery is signed

Each POST carries:

Verify V2: recompute the HMAC with your rule's signing secret over the timestamp, a full stop, and the exact bytes of the body; compare in constant time; and reject a timestamp more than five minutes old. That stops a captured delivery being replayed later. Use X-Graften-Delivery to drop duplicates.

expected = "sha256=" + hex(hmac_sha256(secret, timestamp + "." + raw_body))
accept if constant_time_equal(expected, header) and |now - timestamp| <= 300

Signing secrets

The secret is shown once, when the rule is created. It is stored encrypted with your account's own key, never in plain text. To change it, use New secret on the rule (admin only): the new secret is shown once and every delivery from that moment is signed with it, so update your receiver straight away — there is no overlap period. A delivery whose secret cannot be read is not sent at all, and the log says why; nothing is ever sent unsigned.

Retries and the delivery log

A delivery that gets no response, a 408, a 429 or a 5xx is tried twice more: after about 5 seconds and again after about 30. Any other 4xx is treated as your receiver refusing that payload and is not retried. Before each retry the rule is read again, so a rule you deactivate or delete is not retried. Connector-action rules are never retried — they change things in another system, and a retry after a timeout could do it twice. Each rule is limited to 60 deliveries a minute; anything over that is skipped and logged.

Test sends a test.ping and reports what actually happened: delivered with the receiver's status code, or not delivered and why. The delivery log keeps the most recent 200 attempts per rule.

Destinations must be public HTTPS addresses. The address is checked when a rule is saved and again on every connection and redirect, so a DNS change cannot point a rule at an internal address.

API keys

Keys (gfk_live_…) act as the person who created them, with the role they were issued with, never above that person's current role. A key works only while its creator does: if the creator is removed or deactivated, the key stops working and the key list says so. Generate a new key from a current team member.

New keys can only read. Tick Allow this key to make changes to add the write scope. Each key has an expiry (365 days by default, at most 730). The key list shows each key's creator, scopes, expiry and last use. Every change made with a key is recorded in the audit log against the key's name and its creator.

Some actions need a person signed in and refuse an API key:

• managing users, billing and account settings, and the other admin-only actions;
• client portal invites and links;
• creating or revoking API keys, so a key cannot extend its own life;
• the creator's own profile, password and MFA;
• raising a change request.

API

GET/POST /api/v1/automation/webhooks, PUT/DELETE /api/v1/automation/webhooks/{id}, POST /api/v1/automation/webhooks/{id}/test, POST /api/v1/automation/webhooks/{id}/rotate-secret, GET /api/v1/automation/webhooks/{id}/deliveries, POST /api/v1/automation/connector-actions, GET/POST /api/v1/automation/keys, DELETE /api/v1/automation/keys/{id}.