Flows API
Bramble Flows: building and running automations. Flows and their versions, runs and their step outputs, connections (stored credentials), tables, variables, templates, approvals and forms waiting for an answer — and the public webhook endpoints that start flows from outside.
- Address
https://<your-org>.brambleit.cloud/flows- Sign-in
- Signed-in browser session (the
sso_session/session_idcookies from Bramble sign-in). - Address
https://<your-org>.brambleit.cloud/api- Sign-in
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer). - Endpoints
- 67
- OpenAPI
- flows.json
- Guides
- How Flows works
Personal or organisation. A flow, connection, table or variable is either
personal (yours) or belongs to the organisation (scope: tenant, managed by
Flows admins).
A flow is a graph of steps (graph, the JSON the canvas edits). Saving
takes the version you started from, so two people can't overwrite each other.
Secrets stay in connections. Connection secrets are encrypted and never returned; exports leave secrets and webhook tokens blank.
Calling flows from outside is done with a webhook trigger, not with these endpoints.
Resources
Flows
Create, save, version, switch on and off, copy, import and export flows; run one now; the catalogue of steps.
| Method | Path | Summary |
|---|---|---|
| GET | /api/me | Who you are: the signed-in person and what they can do here |
| GET | /api/catalogue | Steps and triggers available |
| GET | /api/flows | List flows |
| POST | /api/flows | Create a flow |
| GET | /api/flows/:id | Get a flow |
| PUT | /api/flows/:id | Save a flow |
| GET | /api/subflows | Sub-flows a flow may run: same scope (personal: the owner's own; organisation: organisation flows), starting "When another flow runs it" |
| POST | /api/flows/:id/settings | Flow settings: what happens if it's triggered while still running |
| GET | /api/flows/:id/versions | Version history (lib/versions.js) |
| GET | /api/flows/:id/versions/:vid | Get an older version of a flow |
| POST | /api/flows/:id/activate | Switch a flow on |
| POST | /api/flows/:id/deactivate | Switch a flow off |
| POST | /api/flows/:id/duplicate | Copy a flow |
| DELETE | /api/flows/:id | Delete a flow |
| POST | /api/flows/:id/run | Run now. Body: { data?, nodeId?, graph? |
| GET | /api/flows/:id/runs | A flow's runs |
| GET | /api/flows/:id/checks | Checks made by polling triggers (New email), newest first: the last 3 days, including the ones that found nothing |
| GET | /api/flows/:id/export | A flow as a file: secrets and webhook tokens blanked; the connections and tables it uses listed by name so an import can match them up |
| POST | /api/flows/import | Body: { data: <a Flows export or an n8n workflow export>, scope?, name? |
| POST | /api/flows/:id/preview | What an expression gives, using a run's data for a step (the editor's live preview) |
Runs
A run's steps and outputs, cancelling, and running again with the same input.
| Method | Path | Summary |
|---|---|---|
| GET | /api/runs/:id | Get a run with its steps |
| GET | /api/runs/:id/outputs/:nodeId | A step's whole output from a run (the steps list only has the first 25 items) — for pinning |
| POST | /api/runs/:id/cancel | Cancel a run |
| POST | /api/runs/:id/retry | Run the flow again (as it is now) with the same trigger data |
Connections
Stored credentials steps use (mailboxes, HTTP auth, chat webhooks, FTP…), tested before saving.
| Method | Path | Summary |
|---|---|---|
| GET | /api/connection-types | Kinds of connection |
| GET | /api/connections | ?type=a,b ?flow=<id> → only ones that flow could use |
| GET | /api/connections/:id | Editing form: the non-secret fields, and which secrets are set |
| POST | /api/connections | Create a connection |
| PUT | /api/connections/:id | Update a connection |
| DELETE | /api/connections/:id | Delete a connection |
| GET | /api/connections/:id/folders | A mailbox connection's folders (for the IMAP trigger's folder pickers), if the flow (?flow=) may use the connection |
| POST | /api/connections/test | Test a connection: a saved one (:id, optionally with changed fields) or an unsaved one (body.type + body.data) |
Tables
Simple data tables flows can read and write.
| Method | Path | Summary |
|---|---|---|
| GET | /api/tables | List tables |
| POST | /api/tables | Create a table |
| GET | /api/tables/:id | Get a table and its rows |
| PUT | /api/tables/:id | Update a table's columns |
| DELETE | /api/tables/:id | Delete a table |
| POST | /api/tables/:id/rows | Add a row |
| PUT | /api/tables/:id/rows/:rowId | Update a row |
| DELETE | /api/tables/:id/rows/:rowId | Delete a row |
| DELETE | /api/tables/:id/rows | Delete every row |
Variables
Values flows read as $vars.
| Method | Path | Summary |
|---|---|---|
| GET | /api/variables | List variables |
| POST | /api/variables | Create or update a variable |
| DELETE | /api/variables/:id | Delete a variable |
Templates
Built-in, organisation and MSP-shared templates, and making a flow from one.
| Method | Path | Summary |
|---|---|---|
| GET | /api/templates | List templates |
| POST | /api/templates | Save a flow as a template |
| DELETE | /api/templates/:id | Delete a template |
| POST | /api/templates/use | Create a flow from a template |
Approvals & forms
Approvals and forms waiting for you, and answering them.
| Method | Path | Summary |
|---|---|---|
| GET | /api/actions/:token | Open an action link |
| POST | /api/actions/:token | Answer an action link |
| GET | /api/waits | Approvals and forms waiting for me |
| GET | /api/waits/:id | Get an approval or form |
| POST | /api/waits/:id/answer | Answer an approval or form |
Editor helpers
Lists the editor uses for pickers, sample event data, schedule previews and test events.
| Method | Path | Summary |
|---|---|---|
| GET | /api/devices | RMM devices (for the device step) |
| GET | /api/bramble/form | A form's questions, for the "Form response submitted" trigger (as the flow's owner: their own access decides) |
| GET | /api/bramble/options | Pickers in Bramble steps (engine/nodes/bramble.js OPTION_SOURCES), as the flow's owner: ?flow=&source=psa.queues[&project=12] |
| POST | /api/events/test | Sends a "flows.test" event for the current user, to try event triggers |
| POST | /api/schedule/preview | When a schedule would next run, for the settings panel |
| GET | /api/events/:type/sample | Example data for an app event |
Webhooks & public links
No sign-in: the token in the address is the secret. /hook/<token> starts a flow; /hook/a/<token> and /hook/w/<token> are the approval and form links Flows emails.
| Method | Path | Summary |
|---|---|---|
| GET | /hook/w/:token | Open a form link |
| POST | /hook/w/:token | Answer a form link |
| GET | /hook/a/:token | Open an approval link |
| POST | /hook/a/:token | Answer an approval link |
| ALL | /hook/:token | Start a flow (webhook) |
Bramble bridge (BRM-API)
How Flows reaches RMM devices: list devices and run a script on one as the flow's owner. Used by Flows itself with X-Flows-Key; not for outside callers.
| Method | Path | Summary |
|---|---|---|
| GET | /v1/flows/devices | Devices a flow's owner can use |
| POST | /v1/flows/devices/:id/run | Run a script on a device for a flow |
| GET | /v1/flows/commands/:id | Result of a device script |
Web pages
These return pages for the browser rather than data.
GET /