API & webhooks
Run your workflows from your own code. And hear back when they're done.
Start a workflow from your backend with one HTTP call, read each step's result, and get a signed webhook the moment a run succeeds, fails or waits for a person.
What you get
Built for production integrations.
Scoped keys
Give each system its own key with only the scopes it needs, an optional expiry and instant revocation. Keys are stored hashed and shown once.
Safe retries
Send an Idempotency-Key and a retried request returns the same run instead of starting a second one.
Results, not just status
Each run returns its steps with status, duration and output (secrets removed), plus review details when it's waiting for a person.
Wait or get called back
Wait up to 25 seconds for the result in the same request, poll the run, or subscribe to signed webhooks.
Limits by plan
Every plan includes the API.
Requests per minute for each API key. A workspace can make twice that across all its keys.
| Plan | API requests |
|---|---|
| Free | No API runs (upgrade to run live) |
| Basic | 120/min per key · 5 runs at once |
| Pro | 600/min per key · 20 runs at once |
| Business | 900/min per key · 35 runs at once |
| Elite | 1,200/min per key · 50 runs at once |
| Enterprise | Custom limits |
Start a run and wait for the result
curl -X POST https://flow.fluxosuite.com/api/v1/workflows/WORKFLOW_ID/runs \
-H "Authorization: Bearer $FLUXO_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{"input": {"email": "ana@example.com"}, "wait": true}'Outbound webhooks
Hear about runs as they happen.
Subscribe an https endpoint to the events you care about.
Run and review events
Run succeeded, failed or paused for review, review decided, workflow updated.
Signed deliveries
HMAC-SHA256 signature with a timestamp on every delivery, with verification code for Node.js and Python.
Retries for a day
Failed deliveries are retried with backoff for about 24 hours. Endpoints that keep failing are turned off, and admins are emailed.
Secret rotation
Rotate a signing secret with a 24-hour overlap, so receivers can switch without missing an event.
Scoped API keys
Each key gets only the scopes it needs, an optional expiry, and can be revoked instantly.
Good to know
- Call the API from your server. Browser requests are refused so keys never end up in web pages.
- An OpenAPI 3.1 file and a full reference with curl, JavaScript and Python examples are in the docs.
- Breaking changes only ship in a new version path (/api/v2); deprecated endpoints keep working for at least 12 months.
FAQ
Questions, answered.
Is the API included in my plan?
Yes, on every paid plan. The Free plan can't start live runs, through the API or otherwise. Limits are per API key: Basic 120, Pro 600, Business 900, Elite 1,200 requests per minute; Enterprise limits are custom.
What can I do with it?
List and read workflows, start runs with an input payload, read run results step by step, cancel queued runs or runs waiting for review, and manage outbound webhook endpoints and their delivery log. Building workflows happens in the app.
How do I verify that a webhook came from Fluxo Flow?
Every delivery has a Fluxo-Signature header: an HMAC-SHA256 of the timestamp and raw body made with your endpoint's secret. The docs include ready-made verification code for Node.js and Python.
Are there SDKs?
Not yet. The API is plain JSON over HTTPS, and you can generate a typed client from the OpenAPI file.
Connect Fluxo Flow to your stack.
Build and Dry Run on the Free plan, no credit card. Run live on a paid plan, on your own AI key at cost.
Free to explore · No credit card · 30-day money-back guarantee on paid plans