Exposing Flows as REST Endpoints

Publishing a flow makes it callable over HTTPS. Each published flow receives a stable endpoint, and you can lock it down with workspace API keys so external callers authenticate the same way they would with any other REST service.

Publish to get an endpoint

When you publish a flow, FlowGenie issues a REST endpoint in the shape:

POST https://app.flowgenie.pro/api/flow/{flowId}

The flowId is the same ID you see in the URL of the flow editor. Internally, this route loads your saved flow config and executes it via runFlow with the request body mapped into the Start node inputs.

Authenticate with workspace API keys

Flows can require an API key. Keys are generated per workspace in Settings → API and stored on the server (see the aPIKey model and workspace router). To call a protected flow, include:

Authorization: Bearer <API_KEY>

If a flow is marked public, you can omit the key; otherwise, requests without a workspace-matching key receive 401/403.

Send inputs as JSON

POST a JSON body whose fields match the Start node inputs (including types) defined in your flow. Arrays and objects are supported; array inputs expect JSON arrays, and object inputs expect JSON objects.

curl -X POST "https://app.flowgenie.pro/api/flow/<FLOW_ID>" \
  -H "Authorization: Bearer fk_example_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "customer@example.com",
    "items": ["sku_123", "sku_456"],
    "metadata": { "source": "landing" }
  }'

Behind the scenes, runFlow reads the raw request body, matches it to Start node handles, and injects environment variables and nested flows as needed.

Receive the flow outputs

The response mirrors your End node outputs. Whatever outputs you defined—strings, numbers, objects, arrays—are serialized to JSON and returned in the result payload:

{
  "result": {
    "status": "ok",
    "summary": "2 items processed",
    "errors": []
  },
  "logs": [
    "info: webhook fired",
    "system: queued retry"
  ]
}

Flow runs are also persisted (flowRun) with request/response bodies and headers so you can inspect or replay later from the History panel.