Trigger any workflow
from anywhere, securely

The REST API exposes every standard operation a team integrating with Revo could need: triggering any workflow with a payload, listing all workflows, fetching run history, retrieving full execution logs, managing webhook destinations, querying the analytics metrics that drive the dashboard, and managing tokens and allowlists. Every endpoint follows REST conventions with predictable patterns and consistent error handling.

Scopes are picked from a clear list when the token is generated, and the token can only do what its scopes permit. Common scopes include reading specific workflows, triggering specific workflows, reading logs, managing webhooks, and full workspace access. The team composes narrow scopes by selecting only what the integration needs, so a token that should only trigger one workflow really can only trigger that one.

Each token has its own allowlist of IP address ranges and domains permitted to use it. When a request arrives, the platform checks both the source address and domain against the allowlist before checking the token itself. Requests from outside are rejected with a clear error and logged. The production integration gets allowlisted to its ranges, and a token that ends up somewhere it should not be is useless.

When a webhook source sends an event, it attaches a signed signature computed from the payload and a shared secret known to both sides. The platform recomputes the signature and rejects the request if the values do not match. Fake events from a guessed address get rejected before any workflow runs, and the rejected events are captured in the trigger log. Verification happens automatically with native providers.

Rate limits apply at two layers and both are configurable. API layer limits protect the platform from a misbehaving client and can be set per token for calls per second, minute, and day. Workflow layer limits protect downstream systems from a workflow that suddenly fires thousands of times a minute. When a limit is hit, the platform returns a clear response so the caller can back off.

Every variable, secret, credential, and piece of sensitive data the workspace stores is encrypted at rest using industry standard encryption with workspace specific keys. The encryption applies to data on disk, in backups, and being replicated, so protection is consistent everywhere. Workspace specific keys isolate workspaces cryptographically, and the keys are managed through a service that handles rotation.