6
node types
4
trigger types
2
permission layers
156
automated checks
What a run looks like from outside
An endpoint per trigger, configured per trigger.
Each webhook sets its own HTTP method, where it expects its secret, which payload fields are mandatory, and whether the caller gets an immediate 202 or waits for the result. All of it is enforced at the endpoint — a wrong method gets 405 naming the right one, and a missing required field gets 400 with no run created.
The run itself walks the graph: prompt a model, call an API, branch on what the model said, stop for an approval, save the result.
curl -X POST https://<app>/api/webhooks/<trigger-id> \
-H 'x-webhook-secret: 9f3c…' \
-d '{"text": "Charged twice and the page crashed"}'{
"workflow_run_id": "7c1e…",
"status": "completed",
"duration_ms": 1846,
"output": { "text": "negative", "model": "llama-3.1-8b-instant" },
"outputs": [ { "key": "verdict", "value": "negative" } ]
}Try it
Four seeded accounts, so the rules are visible rather than described.
Sign in as two of them side by side. The interesting one is owner-b — paste an Org A workflow id into their URL bar and the page reports that it does not exist, because for them it does not.
| Account | Organization | Can |
|---|---|---|
| owner-a | Northwind Support | Everything — including db_write and notify nodes, webhook triggers and LLM connections. |
| editor-a | Northwind Support | Build, run and approve. Refused the owner-only node types, by the database. |
| viewer-a | Northwind Support | Read. Cannot start a run or clear a gate. |
| owner-b | Contoso Logistics | Org B only — and cannot see that Org A exists. |
Addresses are <name>@agentflow.test, password Password123!, created by npm run seed. Signing up with your own email works too — a new account belongs to no organization yet, so it asks you to create one.