REST API
GraphQL is the API for everything you manage in FluidGrids: workflows, versions, runs, credentials, schedules. See GraphQL API. There is no general-purpose REST API.
The HTTP endpoints below exist for callers that cannot speak GraphQL or hold a FluidGrids token: other services sending webhooks, and people answering a form or an approval. They are all served from the workspace gateway host:
https://graphqlworkspaces.burdenoff.com
You never build these URLs by hand. The builder shows each one on the node that owns it, and the run passes resume URLs to the nodes that need them.
Endpoints
| Method and path | What it does | How it is protected |
|---|---|---|
POST /api/webhooks/t/{webhookToken} | Starts the Active version of the workflow whose Webhook Trigger owns this URL | The trigger's authentication setting, allowed methods and IP allowlist. See Webhooks. |
POST /api/webhooks/test/{testToken} | Starts one test run of the version open in the builder, while Listen for test event is armed | The same checks, against the version under test |
POST /api/webhooks/wait/{token} | Continues a run parked at a Wait node in webhook mode | A signed, expiring token naming one run, plus the Wait node's own authentication, methods and IP allowlist. Single use. |
POST /api/webhooks/resume/{runId} | Continues a waiting run by ID | A FluidGrids token and x-workspace-id, like a GraphQL call |
GET /api/forms/{formId} | The hosted page of a Form trigger | Public while the workflow is Active |
GET /api/webhooks/waitform/{token} | The hosted page a person fills in to continue a waiting run | Signed, expiring, single-use token |
GET /api/webhooks/respond/{token} | The hosted approve / decline page for a run waiting on a person | Signed token |
Older workflows may show a URL of the form /api/webhooks/trigger/{source}/{type}. It still works; the per-trigger /api/webhooks/t/... URL is preferred because it reaches exactly one workflow.
Responses
| Status | Meaning |
|---|---|
200 | Accepted: the run is queued, or (for a Webhook Trigger set to respond later) the response the workflow built. |
202 | A trigger set to wait for the result did not finish within its response timeout; the run carries on. |
400 | The request body could not be read, or a required value is missing. |
401 | Authentication failed, or a Wait-node URL has expired or was already used. For Wait-node URLs the message is deliberately the same in each case. |
403 | The caller's IP is not on the trigger's allowlist, or the trigger's event filter rejected the event. |
404 | No Active trigger listens on this URL. Activate a version, or check you copied the production URL rather than the test URL. |
405 | The trigger does not accept this HTTP method. |
429 | Too many requests to this URL or workspace in a short window. The response carries Retry-After; wait that many seconds. |
Rate limits
Webhook ingress is rate-limited per URL and per workspace over short fixed windows. A sender that gets 429 should wait for the Retry-After seconds before retrying. If a legitimate integration keeps hitting the limit, contact support.