Triggers

A flow starts from at most one trigger node. A flow with no trigger node is manual: it runs when you press Run, when another flow calls it, when an app action runs it, or when an API client starts it.

Webhook

Settings live on the trigger node:

• Enable webhook trigger and the Webhook URL (copy button). The address has the form https://if.neblex.com/api/hooks/<workspace>/<flow id or custom path>.
• Custom path (optional): a readable path such as orders-inbound (letters, digits, -, _; up to 64). Available only when Authentication is not None; an unauthenticated webhook keeps its unguessable address.
• HTTP methods: GET, POST, PUT, PATCH, DELETE (default POST).
• Authentication: None (public URL), Basic (username and password), Header secret, JWT (HS256), HMAC signature, Body signature (for providers such as GitHub: X-Hub-Signature-256, HMAC-SHA256 or SHA1), API consumer key, AS2 trading partner, AS4 trading partner. Secrets are held in a Secret connection; the Header name is configurable.
• Respond: When the flow finishes (return its data) or Immediately (run in the background).
• API lifecycle: Active, Deprecated (adds a Deprecation header and a Sunset date), Retired (answers 410 Gone).
• Reverse proxy to backend (optional): forward the request to your own backend instead of running the flow, with timeout, body and response size limits, caching, header rules and a request body schema.
• Auto Register With: GitHub, Stripe or Shopify. Choose the provider API connection and events; when the flow is activated the webhook is registered with the provider for you, and removed when it is turned off.
• Who can call this flow: workspace default, anyone, or only listed IP ranges. See Inbound Access.

# Call a webhook protected with a header secret
curl -X POST "https://if.neblex.com/api/hooks/acme/orders-inbound" \
  -H "content-type: application/json" \
  -H "X-Api-Key: <secret from the connection>" \
  -d '{"id":"A-1001","customer":"Acme","amount":250}'

In the flow, read the body with paths such as body.id and headers with headers.x-request-id.

Form (starts flow)

Pick the Form (a draft form shows a warning; publish it for the trigger to work), check the Output sample, and choose Who can submit: Anyone with the link, Capability link only (signed, expiring links), or Named people only (a list of emails). Inbound access rules apply as for webhooks. See Forms.

Schedule

• Every N minutes/hours/days (minimum one minute) or a Cron expression with a Timezone. Examples: 0 9 * * 1-5 (09:00 weekdays), */15 * * * * (every 15 minutes), 0 0 1 * * (midnight on the 1st).
• Missed schedule occurrences: Run the latest occurrence (default), Run every occurrence, or Skip the backlog, for times when the flow could not run (for example while disabled).
• Scheduled runs know their timing: run.occurrence (in the schedule's time zone), run.occurrence_utc, run.previous_occurrence and run.time_zone. Use them for "since last run" queries.

Poll for changes (including change data capture)

The poll trigger checks a system on a schedule and passes on only what is new. The first poll sets a baseline and fires nothing.

1. 1
   Choose the Connector. For databases type the query in SQL / command (for example SELECT id, name, amount, updated_at FROM orders) or pick a saved operation; for apps choose an Event or Fetch operation.
2. 2
   Choose how new records are recognized:

   • Cursor field (default updated_at): passes on records whose cursor is newer than last time.
   • Change detection key (CDC): enter the field(s) that identify a record, such as id (comma-separated for a composite key). The platform remembers a fingerprint of every record and reports inserts, updates and deletes.
3. 3
   Choose the Connection and Poll every, save and set the flow Active.

With a change detection key each change arrives as one record with _change (insert, update or delete) and _key. Route on _change with conditional edges. A record is delivered only when its content really changes, and an empty poll starts no run.

Pause when trigger deduplication is unavailable makes the trigger wait rather than risk a duplicate if its memory of past records cannot be checked.

Native log CDC (write-ahead log)

Turn on Native log CDC to read the database's own change log instead of querying tables: true inserts, updates and deletes in commit order, no polling load on the source, and resume exactly where it left off. PostgreSQL is generally available; the others are marked Experimental in the product.

Schema drift: know when the source changes shape

Every poll also watches the shape of what it fetches. When columns appear or disappear, the builder shows an amber banner naming the new and missing columns and the flow's Health page lists the change under Source schema changes. Review the mappings that depend on those columns, then Acknowledge; the new column set becomes the baseline. Pair drift detection with Assert Data Quality to stop bad batches.

Live stream

Starts a run for each message on a persistent subscription. See Streaming triggers for every source and its settings.

Other ways a run starts

• Run another flow step (the flow is used as a sub-flow).
• An app action or a Button on a form.
• An AI agent tool (Flow as a Skill).
• The runs API or an AI client.
• An escalation flow of an overdue task.