Webhooks & integrations

These are the ways other systems connect to Bramble without signing in as a person. Each uses a secret token or key instead, so treat every URL below like a password.

#Flows webhooks

Add a Webhook trigger to a flow in Bramble Flows. It gets a private address:

https://<your-org>.brambleit.cloud/flows/hook/<token>

• Method: whatever the trigger is set to (GET, POST, … or any). Another method gets 405.
• Body: JSON, form or text. The flow receives { method, headers, query, body, received_at }. Cookies, Authorization and forwarding headers are removed before the flow sees them.
• Secret header (optional): set a header name and value on the trigger; calls without it get 401.
• Reply: by default 202 { ok: true, run_id } straight away. If the trigger is set to reply from the flow, a Respond to the webhook step decides the status, headers and body (Bramble waits up to 30 seconds, then sends 202 { ok, run_id, still_running: true }).
• Limits: 120 calls a minute per webhook, plus the flow's own limits (429). If the flow is set to skip while still running, an overlapping call gets 409.
• An unknown token, a turned-off flow, or a hook used on another organisation's address all get the same 404.

curl -X POST -H "Content-Type: application/json" \
  -H "X-Hook-Secret: $SECRET" \
  -d '{"order":1234,"status":"paid"}' \
  https://<your-org>.brambleit.cloud/flows/hook/<token>

#Approvals and forms

Flows' Ask for approval and Ask with a form steps email private links (/flows/hook/a/<token> and /flows/hook/w/<token>). They work without signing in, expire, and only accept one answer.

#Events from Bramble apps

A flow can start when something happens in Bramble. Use the App event trigger and pick the event. From there it can call any system on the internet. Available events:

Who can use each event follows the app's licence and admin rights. Flows can also trigger on audit-log activity and on a schedule.

Flows can't reach private networks (10.x, 192.168.x, localhost, cloud metadata addresses and so on). To call something on your own network, send the request from one of your RMM devices with Flows' device step.

#Calendars and contacts

The .ics link is for calendar services that can only subscribe to a URL. Anyone with the link can read that calendar, so replace it if it leaks.

#Status page

status.brambleit.com runs outside the platform so it stays up when Bramble Cloud is down.

• GET https://status.brambleit.com/api/v1/status.json: current status of every service, open incidents and maintenance. Public, and allowed from any website.
• GET /api/v1/<page>/status.json for another public status page.
• RSS / Atom: /<page>/feed.rss, /<page>/feed.atom.
• Push monitors (for cron jobs and backups that should report in): GET or POST https://status.brambleit.com/api/push/<token>?status=up&msg=....

#Devices (RMM agent)

The Bramble RMM agent talks to BRM-API's /api/v1/app/rmmdev/... routes:

1. Enrol with an enrolment key (Admin Centre → RMM → Enrollment Keys) and a certificate signing request. Bramble returns the device's certificate.
2. Sign in each session by signing a challenge with that certificate (/agent/auth/challenge → /agent/auth/verify). That gives a session token.
3. Check in, report inventory and results, fetch tasks, upload backups and logs with that token.

Enrolment keys are 32 random characters. Anyone who has one can add a device to your organisation, so keep them private and delete the ones you no longer use.