Dispatch Execution

POST /v2/workflow/executions/dispatch

Dispatch Execution

cURL

curl --request POST \
  --url https://api.velt.dev/v2/workflow/executions/dispatch \
  --header 'Content-Type: application/json' \
  --header 'x-velt-api-key: <x-velt-api-key>' \
  --header 'x-velt-auth-token: <x-velt-auth-token>' \
  --data '
{
  "data": {
    "definitionId": "<string>",
    "idempotencyKey": "<string>",
    "correlationId": "<string>",
    "triggerContext": {},
    "organizationId": "<string>",
    "documentId": "<string>",
    "folderId": "<string>",
    "webhookUrl": "<string>",
    "webhookSecret": "<string>"
  }
}
'

{
  "result": {
    "executionId": "exec_1777374504255_xzy43k9q",
    "correlationId": "corr_campaign_42",
    "deduplicated": false
  }
}

Use this API to start a new execution of a workflow definition. Dispatch pins the current definition version, stamps a correlation ID and idempotency key, and enqueues the first step(s).

Endpoint

POST https://api.velt.dev/v2/workflow/executions/dispatch

Headers

x-velt-api-key · string · required

Your API key.

x-velt-auth-token · string · required

Your Auth Token.

Body

Params

data · object · required

Show properties

definitionId · string · required

Must exist with status: "active".

idempotencyKey · string

^[A-Za-z0-9:_\-.]{1,200}$. Replaying with the same key returns the prior executionId.

correlationId · string

^[A-Za-z0-9:_\-.]{1,200}$. Server-generated if omitted.

triggerContext · object

Free-form payload exposed as execution.input.* in edge expressions.

organizationId · string

Required when the definition is scoped to an organization or document.

documentId · string

Required when the definition is scoped to a document.

folderId · string

Optional folder association.

webhookUrl · string

HTTPS-only per-execution receiver. Must be paired with webhookSecret.

webhookSecret · string

16–512 chars. Used to sign webhook deliveries with HMAC-SHA256.

webhookUrl is validated at the schema boundary and re-checked at delivery time. Scheme must be https://. Literal IP hosts in loopback, private (RFC 1918), link-local, or IPv4-mapped-private ranges are rejected. Forbidden hostnames include localhost, metadata.google.internal, metadata, and any *.internal. At delivery, DNS resolution is repeated; if any resolved address is private, the request is not sent. Redirects are never followed.

Example Requests

Dispatch with idempotency and webhook

{
  "data": {
    "definitionId": "marketing-copy-approval",
    "idempotencyKey": "campaign-42-dispatch",
    "correlationId": "corr_campaign_42",
    "triggerContext": { "assetId": "asset_8f3", "campaign": "Q2 launch" },
    "webhookUrl": "https://hooks.acme.com/velt/approvals",
    "webhookSecret": "whsec_9a8fS2l..."
  }
}

Response

Success Response

{
  "result": {
    "executionId": "exec_1777374504255_xzy43k9q",
    "correlationId": "corr_campaign_42",
    "deduplicated": false
  }
}

deduplicated: true indicates a replay (including in-tx contention) — the returned executionId is the original execution’s id.

Failure Response

{
  "error": {
    "message": "ERROR_MESSAGE",
    "status": "NOT_FOUND"
  }
}

Errors: NOT_FOUND (no definition or tombstoned) / FAILED_PRECONDITION (tombstoned) / INVALID_ARGUMENT (schema validation).

{
  "result": {
    "executionId": "exec_1777374504255_xzy43k9q",
    "correlationId": "corr_campaign_42",
    "deduplicated": false
  }
}