Skip to main content
The Automation API lets an integration list workspaces, manage flows and start and follow runs. It is part of /api/v1, so it uses the same tokens, the same envelope and the same errors as the rest of the API.

​
Authentication and scopes

Send the token as Authorization: Bearer cb_.... A token acts as the person who made it and can never do more than that person. Without a scope the answer is 403 INSUFFICIENT_SCOPE. An unknown or expired token gets 401. A person with the viewer role gets 403 on every change, whatever the token’s scope.

​
Pagination

Lists answer { "data": { "items": [...], "nextCursor": "..." } }. Send nextCursor as cursor for the next page. limit is at most 100.

​
Idempotent starts

Send an Idempotency-Key header, up to 200 printable characters, when you start a run. A repeat with the same key within 24 hours answers with the run of the first call and starts nothing. A call that arrives while the first is still being handled gets 409.

​
What the API does not expose

Connection values, secret store settings, OAuth apps, members, the Git connection and the AI provider are not reachable through the API.

​
Endpoints

List workspaces

The workspaces the token owner may see.

Start a run

Start a published flow with a payload.

Call a webhook

Start a flow from another system, with or without waiting for the answer.

Upload a plug

Install your own plug, as the plug command line tool does.

​
Addresses without a token

Three addresses work without a token, because another system calls them: the webhook address, its synchronous variant and the address of a waiting run. The flow id or the token in the address is the credential.
Last modified on October 26, 2026