Platform Reference

Events Reference

All platform event types emitted by FlowOS. Events trigger webhooks, workflow nodes, and notification rules.

Overview

Every state change in FlowOS emits a typed event. Events are the universal trigger mechanism — webhooks subscribe to event types, workflow triggers listen for them, and notification rules fire on them. All events share a common envelope:

json

{
  "id":          "evt_01...",
  "type":        "incident.created",
  "tenantId":    "t_acme",
  "workspaceId": "ws_prod",
  "environment": "production",
  "timestamp":   "2026-06-02T10:00:00.000Z",
  "actorId":     "usr_01...",
  "actorType":   "user",
  "entityType":  "incident",
  "entityId":    "inc_01...",
  "data":        { /* full record snapshot */ },
  "changes":     [ { "field": "status", "from": "open", "to": "resolved" } ]
}

The data field contains the record state after the change. For *.deleted events, data is the final state before deletion. The changes array is only present on *.updated events.

Incident Events

Event	Description	Key payload fields
incident.created	New incident record created.	id, number, title, status, priority, assignedTo
incident.updated	Any field on an incident changed.	id, changes[]
incident.status_changed	Status field specifically changed.	id, from, to, changedBy
incident.assigned	Assigned-to user changed.	id, assignedTo, previousAssignedTo
incident.escalated	Incident was escalated.	id, escalatedTo, tier, reason
incident.resolved	Status changed to resolved.	id, resolvedAt, resolvedBy, resolution
incident.closed	Status changed to closed.	id, closedAt, closedBy
incident.reopened	Status moved back to open from resolved/closed.	id, reopenCount, reopenedBy
incident.sla_breached	SLA target missed.	id, slaType, targetMinutes, elapsedMinutes
incident.sla_warning	SLA warning threshold reached.	id, slaType, percentUsed
incident.deleted	Incident soft-deleted.	id, deletedBy
incident.comment_added	Comment posted on an incident.	incidentId, commentId, authorId, body
incident.task_created	Task created on an incident.	incidentId, taskId
incident.war_room_opened	War room started for a major incident.	incidentId, warRoomId

Problem Events

Event	Description	Key payload fields
problem.created	New problem created.	id, number, title, status
problem.updated	Any field changed.	id, changes[]
problem.status_changed	Status field changed.	id, from, to
problem.root_cause_found	Root cause documented.	id, rootCause, identifiedBy
problem.known_error_created	Problem promoted to known error.	id, knownErrorId, workaround
problem.resolved	Problem resolved.	id, resolvedAt, permanentFix
problem.closed	Problem closed.	id, closedAt
problem.deleted	Problem soft-deleted.	id, deletedBy

Change Events

Event	Description	Key payload fields
change.created	New change request created.	id, number, title, type, status
change.updated	Any field changed.	id, changes[]
change.submitted	Change submitted for review.	id, submittedBy
change.approved	All approvers approved.	id, approvedBy[], approvedAt
change.rejected	Change rejected by an approver.	id, rejectedBy, reason
change.cab_reviewed	CAB review completed.	id, outcome, cabReviewers[]
change.scheduled	Implementation window set.	id, scheduledStart, scheduledEnd
change.implementation_started	Implementation began.	id, startedAt, startedBy
change.completed	Change implemented successfully.	id, completedAt, completedBy
change.rolled_back	Change rolled back.	id, rolledBackAt, rolledBackBy, reason
change.cancelled	Change cancelled.	id, cancelledBy, reason
change.deleted	Change soft-deleted.	id, deletedBy
change.blackout_violated	Change attempted during a blackout window.	id, blackoutWindowId

Service Request Events

Event	Description	Key payload fields
request.created	New service request submitted.	id, number, catalogItemId, requestedBy
request.updated	Any field changed.	id, changes[]
request.approval_requested	Approval gate triggered.	id, approvalId, approvers[]
request.approved	Request approved.	id, approvedBy
request.rejected	Request rejected.	id, rejectedBy, reason
request.fulfillment_started	Fulfillment workflow started.	id, workflowRunId
request.fulfilled	Request fully fulfilled.	id, fulfilledAt, fulfilledBy
request.cancelled	Request cancelled.	id, cancelledBy
request.sla_breached	Fulfillment SLA missed.	id, targetHours, elapsedHours
request.deleted	Request soft-deleted.	id, deletedBy

Workflow Events

Event	Description	Key payload fields
workflow.created	New workflow definition created.	id, name
workflow.published	New version published.	id, version, publishedBy
workflow.activated	Workflow set to active.	id, activatedBy
workflow.deactivated	Workflow set to inactive.	id, deactivatedBy
workflow.run_started	Execution started.	id, runId, triggerType, input
workflow.run_completed	Execution finished successfully.	id, runId, durationMs, output
workflow.run_failed	Execution failed.	id, runId, error.code, error.message, error.nodeId
workflow.run_cancelled	Execution manually cancelled.	id, runId, cancelledBy
workflow.run_paused	Execution paused (waiting for input/approval).	id, runId, waitToken
workflow.approval_requested	Approval node waiting for response.	id, runId, approvalId, approvers[]
workflow.deleted	Workflow soft-deleted.	id, deletedBy

User & Auth Events

Event	Description	Key payload fields
user.created	New user account created.	id, email, name
user.invited	User invited to a workspace.	id, email, invitedBy, workspaceId
user.activated	User accepted invite and activated account.	id, activatedAt
user.deactivated	User account deactivated.	id, deactivatedBy
user.role_assigned	Role assigned to user.	userId, roleKey, assignedBy
user.role_removed	Role removed from user.	userId, roleKey, removedBy
user.login_succeeded	Successful login.	userId, ip, userAgent, method
user.login_failed	Failed login attempt.	email, ip, reason
user.mfa_enrolled	MFA method enrolled.	userId, method
user.password_changed	Password changed.	userId, changedBy
api_key.created	API key created.	keyId, name, scopes, createdBy
api_key.rotated	API key rotated.	keyId, rotatedBy
api_key.revoked	API key revoked.	keyId, revokedBy

Alert & Monitoring Events

Event	Description	Key payload fields
alert.created	New alert received from a monitoring source.	id, source, ciId, priority
alert.acknowledged	Alert acknowledged by an on-call engineer.	id, acknowledgedBy, acknowledgedAt
alert.resolved	Alert condition cleared.	id, resolvedAt, resolvedBy
alert.incident_created	Incident auto-created from this alert.	alertId, incidentId
alert.escalated	Alert escalated to next on-call tier.	id, tier, escalatedTo
monitoring.check_passed	Monitoring check returned healthy.	checkId, ciId
monitoring.check_failed	Monitoring check returned unhealthy.	checkId, ciId, error

Release & Deployment Events

Event	Description	Key payload fields
release.created	Release record created.	id, name, linkedChangeIds[]
release.approved	Release approved for deployment.	id, approvedBy
release.deployment_started	Release deployment began.	id, deployedBy, environment
release.deployment_succeeded	Deployment completed successfully.	id, environment, completedAt
release.deployment_failed	Deployment failed.	id, environment, error
release.rolled_back	Release rolled back.	id, rolledBackBy, reason

Subscribing to Events

Via Webhook

bash

POST /api/events/subscriptions
{
  "name": "Incident alerts to Slack",
  "eventName": "incident.created",
  "action": "webhook",
  "webhookUrl": "https://hooks.slack.com/services/...",
  "filter": "priority == 'critical' || priority == 'high'"
}

Via Workflow Trigger

In the Workflow Studio, select Event trigger and choose one or more event types from the dropdown. The full event envelope is available as trigger.payload in expressions.

javascript

// In a workflow expression
trigger.payload.data.number       // INC-0042
trigger.payload.data.priority     // critical
trigger.payload.changes[0].from   // open
trigger.payload.changes[0].to     // resolved