13.2 API Triggers: Starting Jobs from External Systems over HTTP
Key Takeaways
API triggers wrap a process in a custom endpoint with a verb (DELETE, GET, POST, PUT) and a tenant-unique slug that defaults to the process name and cannot contain slashes.
Calls are authorized with a personal access token or OAuth; invoking needs Jobs Create and following the result needs Jobs View.
Async polling returns 202 with a status URI, then 303 to the output URI when the job completes.
Fire and forget returns 200 OK only; sync long-polling returns the output in the response and allows jobs of up to 15 minutes.
POST and PUT carry input arguments in a JSON body, GET uses the query string, and a tenant can have at most 1,000 API triggers.
13.2 API Triggers: Starting Jobs from External Systems over HTTP
Core Concept: An API trigger wraps an existing process in a custom HTTP endpoint. An external application calls that URL to start a job and, depending on the call mode, receives the job's output arguments. API triggers are listed explicitly in the exam description.
Creating an API Trigger
In a folder, go to Automations > Triggers > API Triggers and select Add a new trigger. The form includes:
| Field | What to know |
|---|---|
| Process Name | The underlying process that each call starts |
| Name | A name to identify the trigger |
| Job Priority | Defaults to Inherited (the process priority) |
| Runtime type | The runtime used for the jobs the trigger launches |
| Arguments | Default values for the process input arguments |
| Verb | DELETE, GET, POST, or PUT |
| Slug | Appended to the base URL to form the endpoint. Default ${Process_Name}; must be unique in the tenant; slashes are not supported |
| Default call mode | Async polling (default), Async fire & forget, or Sync (long-polling) |
Further options match other triggers: Schedule ending of job execution (stop, kill, or stop then kill), Generate an alert if the job started and has not completed, and the Execution Target account. A tenant can have at most 1,000 API triggers.
The resulting endpoint has this form:
{AutomationCloudURL}/{organizationName}/{tenantName}/orchestrator_/t/<INVOKE_URL>
Authentication and Permissions
- Calls are authorized with a personal access token in the bearer header, or with OAuth.
- Triggers permissions (View, Edit, Create, Delete) at folder level govern managing API triggers.
- Jobs Create is needed to invoke a trigger, and Jobs View to follow the job until its result is available.
Passing Input Arguments
- With POST or PUT, send a JSON body whose keys are the input argument names, for example
{"argument1": 123, "argument2": "my string"}. - With GET, place the parameters in the query string and omit the Content-Type header.
- The optional
$callModekey overrides the default call mode for one call:AsyncRequestReply,FireAndForget, orLongPolling.
The Three Call Modes
1. Async polling (default)
- The call creates the job and returns 202 Accepted with a status URI in the
Locationheader. - The client polls the status URI.
- When the job completes, the status call returns 303 See Other, redirecting to the output URI.
- The client follows the output URI to read the job result: its output arguments, or the error.
2. Async fire & forget
The call creates the job and returns 200 OK without further information. Use it when the caller does not need the result, such as a nightly refresh started by a scheduler.
3. Sync (long-polling)
- The call creates the job and blocks while the job runs.
- If the job completes in time, the same response carries the output arguments.
- If a timeout passes first, the response is 303 See Other to the status URI, which blocks again. This can repeat as a redirect loop until the job completes.
- The maximum job duration for this mode is 15 minutes.
| Need | Best call mode |
|---|---|
| A web form waits briefly for a short automation's answer | Sync (long-polling) |
| A long job whose result must be collected later | Async polling |
| Start a job and move on | Async fire & forget |
Designing the Process Behind an API Trigger
- Arguments are the contract. Keep input and output argument names stable, because callers depend on them. Output arguments are what the caller receives.
- Validate inputs early. Throw a clear exception when required arguments are missing, so the caller gets a meaningful error instead of a half-run job.
- Choose the runtime deliberately. Short background processes suit serverless robots, while UI automation needs a foreground-capable machine.
- Plan for concurrency. Each call creates a new job, so bursts of calls queue as Pending jobs until runtimes are free.
Worked Example
An intranet page lets employees check their remaining leave. The team:
- Builds a background process
GetLeaveBalancewith inputin_EmployeeIdand outputout_Balance. - Creates an API trigger with verb GET, slug
leave-balance, and call mode Sync (long-polling). - The page calls the endpoint with
?in_EmployeeId=E1024, and the response containsout_Balance.
If the process sometimes needs more than a few seconds, the page switches to Async polling, shows a spinner, and follows the status URI until the 303 redirect provides the output URI.
API Triggers Versus Other Ways to Start Jobs
| Mechanism | Started by | Typical use |
|---|---|---|
| Time trigger | A schedule | Daily or hourly batches |
| Queue trigger | New items in a queue | Transactional workloads |
| Event trigger | An Integration Service connector event | A file added, a record created in a SaaS app |
| API trigger | An HTTP call to a custom URL | External apps that need to start a job and often read its result |
| Orchestrator API StartJobs | A general Orchestrator API call | Full control, with more setup (folder header, release key) |
An API trigger uses the default call mode. A client sends a POST request to the trigger URL. What does the first response contain?
200 OK with the job output arguments in the body.
200 OK with no further information.
A redirect to the Orchestrator login page.
202 Accepted with a status URI in the Location header, which the client polls until a 303 redirect points to the output URI.
Which permissions does a service account need to invoke an API trigger and follow the job until its result is available?
Triggers Create and Processes Edit.
Jobs Create to start the call and Jobs View to see the status, at the folder level.
Assets View and Queues View.
Only a valid personal access token; permissions are not checked.
A web page needs an answer from a short background automation within the same HTTP call. Which configuration fits best?
Verb GET with the Sync (long-polling) call mode, passing inputs in the query string.
Async fire and forget, because it returns the output immediately.
A time trigger that runs every minute.
A queue trigger with a minimum of one item.
Sections you finish are checked off in the contents.