Deploy and triggers

Ship a version with one call, give it a URL, and decide which senders may start it.

Deploy and trigger

The body of the deploy is the workflow's source, up to 512 KiB: TypeScript as sent, or Python with content-type: text/x-python. Workflow names are lowercase letters, digits and hyphens, up to 63 characters. Each deploy is scanned; blocked code is refused with the reason, and warnings come back in warnings. Python is loaded once at deploy, so a syntax error or an import that is not installed is refused with 400 and the traceback, not left for the first run. A Python deploy whose packages are new answers 202 with a deployId while they build.

shellcurl

# Deploy (developer or admin key). Answers {"versionHash", "sizeBytes", "warnings"}.
curl -X PUT https://api.shiftlabs.org/v1/workflows/refund-check \
  -H "authorization: Bearer $SHIFTLABS_API_KEY" \
  --data-binary @refund-check.ts

# The same for Python.
curl -X PUT https://api.shiftlabs.org/v1/workflows/refund-check \
  -H "authorization: Bearer $SHIFTLABS_API_KEY" -H "content-type: text/x-python" \
  --data-binary @refund_check.py

# Create a trigger. Answers 201 {"triggerId", "url", "signingScheme"}.
curl -X POST https://api.shiftlabs.org/v1/triggers \
  -H "authorization: Bearer $SHIFTLABS_API_KEY" -H "content-type: application/json" \
  -d '{"workflow": "refund-check"}'

# Start a run from any webhook sender. Answers 202 {"runId"}.
curl -X POST https://hooks.shiftlabs.org/t/<triggerId> \
  -H "content-type: application/json" -d '{"id": "ch_123"}'

# Follow it.
curl https://api.shiftlabs.org/v1/runs/<runId>/timeline \
  -H "authorization: Bearer $SHIFTLABS_API_KEY"

A trigger id is 128 random bits, and its URL alone is enough to start a run. Rotate it with POST /v1/triggers/:id/rotate or revoke it with DELETE. To require signed deliveries, create the trigger with "signing": {"scheme": …}. Timestamped signatures must be within 5 minutes, and a replayed delivery is dropped. A webhook body is capped at 256 KiB.

Revisions · refund-check

Rev	Hash	Deployed
B current	`f7e85236`	2026-10-20
A	`1d9a281e`	2026-10-20

Runs keep the hash they started on. Redeploying a known hash keeps its letter.

Signing schemes
Scheme	Secret	Header checked
`shiftlabs`	Generated and returned once, as `signingSecret`.	`Shiftlabs-Signature: t=<unix seconds>,v1=<hex>`, where `v1` is HMAC-SHA256 of `<t>.<body>`.
`stripe`	Your Stripe endpoint secret, 8–256 characters.	`Stripe-Signature`
`github`	Your GitHub webhook secret, 8–256 characters.	`X-Hub-Signature-256` and `X-GitHub-Delivery`