FlowBeacon Public API
Server-to-server HTTP/JSON API for submitting automation blueprints to FlowBeacon's governance engine and retrieving violations, remediation guidance, and compliance rollups.
Designed to be embedded in Make.com Custom Apps, internal admin tools, CI/CD pipelines, and observability dashboards.
Auth model: every authenticated request carries a Bearer API key and an
X-FB-Signature signature header. See the Authentication tag for full details.
Response envelope: all 2xx responses — including GET /governance/health —
are wrapped:
{ "ok": true, "data": { /* ... */ }, "meta": { "watermark": "wm_a1b2c3d4" } }
Errors use a parallel envelope with ok: false:
{ "ok": false, "error": "Scenario not found", "detail": "Scenario not found" }
error is a short, stable, human-readable string. detail is always present:
for simple errors it is identical to error; for 422 validation errors
it is instead the array of field-level problems. Prefer reading error for
branching and detail for field-level diagnostics.
Authentication
- HTTP: Bearer Auth
- API Key: requestSignature
- API Key: sessionAuth
Authorization: Bearer fb_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Keys are 56 characters total,
encrypted at rest, and shown to the operator exactly once on creation.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | fb_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (48 hex chars) |
Encrypted signature header in the format:
t=<unix>,v1=<lowercase hex>.
Canonical signing string:
message = "{timestamp}.{HTTP_METHOD}.{request_path}.{raw_request_body}"
Signing key is the raw API key. Tolerance window: 300 seconds.
Missing header → 403 Missing request signature.
Mismatch / stale → 403 Invalid request signature.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-FB-Signature |
Browser session cookie (NextAuth). Only used by /keys/* admin endpoints,
which live at /api/v1/keys — outside /api/public/v1/*.
Security Scheme Type: | apiKey |
|---|---|
Cookie parameter name: | __Secure-next-auth.session-token |
License