Actions

Workflow Actions

Actions are what workflows do when their query conditions are met. AI for Database supports email and generic webhook actions.

Send Email

Send an email to a single recipient. The subject and body can include workflow variables.

Configuration:

• To -- a valid recipient email address
• Subject -- text with query variables
• Body -- text with query variables; query result tables are appended automatically

Example subject: "Alert: {{query_1.row_count}} overdue invoices found"

Call Webhook

Send an HTTP request to a public HTTPS endpoint. Webhook drafts can be incomplete while you work, but publishing is blocked until the complete action is valid.

Configuration:

• URL -- a public HTTPS endpoint on port 443
• Method -- GET, POST, PUT, PATCH, or DELETE
• Credential -- an encrypted API-key, Bearer, or Basic credential bound to the destination hostname
• Headers -- non-secret custom headers
• Body type -- none, JSON, raw text, or form URL-encoded
• Body -- a template with query variables
• Timeout and retries -- 1–30 second timeout and up to five attempts
• Success statuses -- optional exact HTTP status codes when any 2xx is too broad
• Critical -- whether a failed delivery fails the whole run

Example body:

{
  "text": "{{query_1.row_count}} new signups today",
  "rows": {{query_1.rows}}
}

Bare JSON variables such as {{query_1.rows}} preserve arrays, objects, numbers, and booleans. Variables embedded inside JSON strings are escaped safely.

By default, every 2xx response is successful. For batch APIs that use a 2xx code for partial acceptance, set successStatusCodes explicitly. For example, Brevo POST /v3/events/batch should use [202], so its HTTP 207 partial response is retained as a failed delivery for inspection.

Security and Delivery

Secret values are encrypted and never returned by workflow APIs or stored in delivery logs. Destinations are checked against private and reserved IP ranges on every attempt and redirect, DNS is pinned to the validated public address, cross-host redirects are blocked, response bodies are bounded, and secret values are redacted.

Each attempt includes stable X-AIFD-Delivery-Id and numbered X-AIFD-Attempt headers. The run history records HTTP status, duration, bounded response metadata, and every retry without recording request secrets or bodies. Use Test webhook for a controlled live delivery before publishing. API agents can perform the same lifecycle with the workflow_credentials and workflows scopes: create a write-only credential, attach its ID to a draft action, call the explicitly confirmed action-test endpoint, and publish only after reviewing the result.