Integrations

Webhook Reference

All event types, headers, payload formats, and how token auth works.

Endpoint

text

POST /api/webhooks/inbound/{tenant_id}

# Example:
POST http://localhost:8000/api/webhooks/inbound/acme-retail

Required headers

Header	Value	Required
Content-Type	application/json	Yes
X-Webhook-Token	Your tenant's HMAC token	Yes (in production)
X-Source	sap \| oracle \| dynamics \| netsuite \| n8n \| generic	Recommended

ℹIn development (when WEBHOOK_SECRET_KEY=change-me-in-production), the token check is skipped. Set a real secret in production.

Payload format

json

{
  "event_type": "purchase_order_created",
  "source":     "sap",
  "tenant_id":  "acme-retail",
  "data": {
    "purchase_order_id": "PO-4901",
    "supplier_name":     "Supplier Alpha",
    "quantity":          500,
    "currency":          "GBP",
    "status":            "pending_approval",
    "created_date":      "2026-06-01"
  }
}

EasyFlow normalises common ERP field aliases automatically. SAP's PurchaseOrder becomes purchase_order_id. Oracle's PONumber becomes purchase_order_id. You don't need to rename fields in n8n for supported source types.

Token authentication

Each tenant's token is an HMAC-SHA256 hash of the tenant ID signed with the platform's webhook secret key. To get your token:

bash

# Get your webhook token from the API
curl http://localhost:8000/api/webhooks/token/your-tenant-id

# Response:
# {
#   "tenant_id": "your-tenant-id",
#   "token": "abc123...",
#   "endpoint": "/api/webhooks/inbound/your-tenant-id",
#   "n8n_header": "X-Webhook-Token"
# }

# Or find it in the EasyFlow Integrations page (lightning bolt in sidebar)

All event types

Event type	Category	Typical trigger
purchase_order_created	Procurement	New PO raised in ERP
purchase_order_approved	Procurement	PO approved in ERP or by manager
purchase_order_rejected	Procurement	PO rejected
purchase_order_received	Procurement	Goods receipt confirmed
stock_updated	Inventory	Any stock level change
stock_low_alert	Inventory	Stock below reorder point
stock_replenishment_needed	Inventory	Calculated need for restock
shipment_dispatched	Logistics	Shipment leaves warehouse
shipment_delivered	Logistics	Delivery confirmed
shipment_delayed	Logistics	Expected delivery date missed
supplier_confirmed	Suppliers	Supplier accepts PO
supplier_rejected	Suppliers	Supplier rejects or modifies PO
supplier_sla_breach	Suppliers	Fill rate or lead time SLA missed
workflow_trigger	General	Custom trigger from any system
custom_event	General	Fallback for unknown event types

Response codes

Code	Meaning
202 Accepted	Event received, queued for processing
400 Bad Request	Invalid JSON or missing required fields
401 Unauthorized	Invalid or missing X-Webhook-Token
404 Not Found	Tenant ID not found
503 Service Unavailable	Event accepted but could not be queued (RabbitMQ down)

Available Connectors

Databricks Risk Intelligence