Webhook URLs

A workflow whose trigger is Webhook (Auto Appy) can be started by sending an HTTP request to its URL. No API key is needed: the URL itself is the secret.

In the course

• VCA plain HTML enquiry form posts to the webhook. Lesson 1: Reply to every enquiry in seconds →
• SRThe website server posts cleaned data and shows its own thank-you page. Lesson 6: Plug in the website and a daily report →

The URL

https://api.autoappy.com/workflows/execute/{id}

{id} is the workflow’s ID (it’s the same as the main trigger’s ID), shown in the trigger’s Setup tab under Your Webhook URL. Each extra trigger has its own URL with its own ID.

Methods	POST (recommended), PUT, PATCH, GET
Body	JSON, form fields (application/x-www-form-urlencoded or multipart/form-data) or query-string parameters. They’re merged; each key becomes a field.
Authentication	None. Keep the URL private. Don’t send an aa_key_ API key to this URL (it will be refused).
Field names	Spaces in keys become underscores (first name → first_name). Values are kept as sent, including spaces.
Timing	The request waits while the workflow runs and answers when it finishes (or reaches a Delay). A run can take up to 15 minutes.

Send a request

HTML form

<form method="POST" action="https://api.autoappy.com/workflows/execute/YOUR_WORKFLOW_ID">
  <input name="name" required>
  <input name="phone" required>
  <input name="email" type="email">
  <input type="hidden" name="source" value="website-contact">
  <button>Send</button>
</form>

The visitor’s browser shows Auto Appy’s JSON reply after submitting. For a thank-you page, submit from your server instead (below), or from a form tool that supports webhooks.

curl

curl -X POST "https://api.autoappy.com/workflows/execute/YOUR_WORKFLOW_ID" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"name":"Asha Rao","phone":"919876543210","email":"asha@example.com"}'

# Form fields instead of JSON:
curl -X POST "https://api.autoappy.com/workflows/execute/YOUR_WORKFLOW_ID" \
  -d "name=Asha Rao" -d "phone=919876543210"

JavaScript (Node)

// Server-side (Node 18+). Keep the URL in an environment variable.
const res = await fetch(process.env.AUTOAPPY_WEBHOOK_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
  body: JSON.stringify({ name: 'Asha Rao', phone: '919876543210', email: 'asha@example.com' }),
});
const body = await res.json();
if (!res.ok) throw new Error(`Auto Appy said ${res.status}: ${body.message ?? body.error}`);
console.log('Run started', body.execution_id);

Python

import os, requests

res = requests.post(
    os.environ["AUTOAPPY_WEBHOOK_URL"],
    json={"name": "Asha Rao", "phone": "919876543210", "email": "asha@example.com"},
    headers={"Accept": "application/json"},
    timeout=120,
)
res.raise_for_status()
print("Run", res.json()["execution_id"])

PHP

<?php
$ch = curl_init(getenv('AUTOAPPY_WEBHOOK_URL'));
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'Accept: application/json'],
    CURLOPT_POSTFIELDS => json_encode(['name' => 'Asha Rao', 'phone' => '919876543210']),
    CURLOPT_TIMEOUT => 120,
]);
$body = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo $status === 200 ? "Run {$body['execution_id']}\n" : "Error {$status}\n";

Calling from a browser

A fetch() with a JSON body from someone else’s website is blocked by the browser’s cross-origin (CORS) rules. Use a plain HTML form post, call the URL from your server, or use a form tool’s built-in webhook setting.

Responses

Status	Body	When
200	{"message":"The workflow is executed successfully","execution_id":1842,"status_code":200}	The run finished (or reached a Delay).
200	{"message":"Message data captured successfully","status_code":200}	The trigger was capturing a sample: the data was saved as the sample and nothing ran.
409	{"message":"The workflow or trigger is paused or in draft.","status_code":409}	The workflow or this trigger isn’t Live.
403	{"error":"Insufficient task balance."}	The account has no tasks left.
422	Add a workflow trigger before running this workflow.	The workflow has no trigger.
404	—	No workflow or trigger with that ID.
4xx/5xx	{"message":"Execution failed: …"}	Something went wrong while starting the run.

A 200 doesn't mean every step succeeded

The webhook answers 200 once the run has been processed, even if a later step failed. Use execution_id with run history (or the API) to check each step.

Testing

1. In the trigger’s Setup tab, click Start Capturing Sample Data.
2. Send one request with realistic values and your real field names.
3. Auto Appy answers “Message data captured successfully”, shows the fields under Sample Data Preview, and switches the trigger and workflow Live.

To capture again later, use Re-capture Sample Data on the Test tab.

Several sources, one workflow

Add extra triggers to accept data from several places (website, Google Form, event QR code) into the same steps. Each gets its own URL. With two or more triggers, every run includes:

{
  "trigger_source": {
    "id": "…",
    "name": "Event QR code",
    "app": "global_trigger",
    "main": false,
    "received_at": "2026-10-05T10:24:11Z"
  }
}

Map {{workflow.trigger_source.name}} into a CRM Source field. Auto Appy sets this itself, overwriting any trigger_source a caller sends, so it can’t be faked.

Security checklist

• Treat webhook URLs like passwords: keep them out of public code repositories.
• Validate data in the workflow (conditions such as phone → Exists) before acting on it.
• If a URL leaks, pause the workflow at once. An extra trigger can be deleted and added again to get a new URL. The main trigger’s URL is tied to the workflow, so ask the Auto Appy team through Help, or rebuild the workflow, to get a new one.

API keys

REST API