Skip to content

Triggers#

A trigger starts a workflow on its own: a call to its own address (an HTTP trigger), or a schedule. A workflow has up to 10; without any, it runs only when someone runs it. Every workflow can always be run by hand too — from its page, astra iris workflows run, or the API.

Only the current version's triggers fire. A new version that is made current brings its own; one written without becoming current changes nothing yet.

The event#

Whatever started an execution is its event, and every box reads it: ${{ event.text }}, event.amount > 100, event.card.last4.

Started by Its event
An HTTP call The body: JSON as it is; a form as an object of its fields; plain text as {"text": "…"}; a GET as an object of its query's fields.
A schedule {"trigger": "<id>", "scheduled_at": "2026-10-19T10:30:00+00:00"}: the time it fired for, in UTC.
A person The event they give (astra iris workflows run --event, the API's event), or none.

An event is at most 128 KiB. A bigger file belongs on a drive, with its path in the event.

HTTP triggers#

An HTTP trigger gives the workflow an address on Astralyx: anything that can send an HTTP request starts it — a bank's or a shop's webhook, a camera's, an iPhone Shortcut, a script, another product calling the workflow as an API. You make the address once the workflow is saved; it holds a secret, shown once.

How a call proves it may (auth), only the way the trigger names:

auth The call carries
url (default) The secret as the address's last part: …/hooks/<id>/ih_…. Simplest; anyone who sees the address can call it.
bearer Authorization: Bearer ih_…. The address alone is not enough.
hmac A signature of the body: HMAC-SHA256 with the secret, in hex, in X-Signature-256 (or the header you name), sha256=<hex> or <hex> — as GitHub, Stripe and many banks sign their webhooks. A body changed on the way fails.

At once, or with the outputs (mode):

  • async (default): the call is answered 202 at once, with the execution's name; the workflow goes on.
  • sync: the call waits for the execution to end — wait_seconds, 60 s by default, at most 90 — and is answered 200 with the workflow's outputs as its JSON body: the workflow as an API. A failure answers 502 WORKFLOW_FAILED with the reason; an execution still going at the end of the wait answers 202, to look up later.

Repeats (dedupe): senders retry, and some send the same event twice. A key read from the event — ${{ event.id }} — makes calls with the same key within dedupe_seconds (a minute by default, at most a day) start one execution; the later calls are answered with it, marked "deduplicated": true.

Calls a minute (per_minute): 60 by default, up to 600. Beyond, a call is answered 429. The calls counted are those answered without an error in the last minute.

Places: the workflow's concurrency applies: past its limit a call's execution waits its turn, or the call is refused with 429 FLOW_BUSY (when_full: drop).

See Start a workflow with an HTTP call.

Schedules#

A schedule starts an execution every so many minutes (5 to 1 440, at the interval's multiples counted from midnight UTC: every 15 minutes is :00, :15, :30, :45) or at a time of day (HH:MM), on the days you choose, in a time zone (UTC by default). Its event says which trigger and for which time.

  • Counted from when it is saved. A schedule written or changed fires first at its next time to come, never at one already past.
  • Missed times. When a time passes while Astralyx cannot start it, the schedule fires once for it, up to an hour late; later than that, it skips it, records Missed … on the trigger, and fires again at its next time. It never fires once per time missed.
  • Once per time. The execution of a time is named after the workflow, the trigger and the time: it is never started twice.

See Run a workflow on a schedule.

Whom it runs as#

Trigger Runs as
HTTP Whoever made the address (or last made a new secret for it). Each call checks that they still reach the workspace and hold flows:trigger; when they no longer do, calls are refused (403 HOOK_OWNER_GONE, 403 HOOK_OWNER_NOT_ALLOWED) until someone who may makes the address again.
Schedule The workflow's owner: whoever created it.

That person's access is what the execution's boxes have: an assistant reads their memory, and a notify box with no to tells them.

What a trigger leaves#

  • An HTTP trigger's address keeps its last calls for 30 days: when, from which address, the answer's status, the execution it started, whether it was a repeat, and the error — never what the call carried.
  • A schedule's state says when it fires next, when it last fired, the execution it started and why it last could not start one: the workflow's Triggers tab, astra iris workflows triggers, or GET …/flows/{name}/triggers.
  • An execution a trigger started names it (Trigger on its page, spec.trigger in the API).

Not yet#

Triggers are HTTP calls and schedules. Starting a workflow from a camera's stream, an MQTT topic or an incoming e-mail is not offered yet: send those as HTTP calls (most cameras and mail services can call a webhook).