Gravity Flow – Incoming Webhook Extension

Your form's rules do not watch what comes in through the webhook

You have a required dropdown with options A to E. A person cannot get around it. An external system updating that entry by webhook, however, can store the value "Banana" and the entry carries on its way.

Gravity Flow cleans what arrives, but it does not check that it is correct. Values are sanitized by field type, which blocks an injected script. What is not reviewed is whether the field is required or whether the format fits. If another application will write to your entries, data quality depends on that application, and it is worth checking there or extending validation on your side.

Incoming Webhook lets a Gravity Flow workflow wait for an external signal and lets other systems create form entries. It does not create workflows or send data out: for the latter Gravity Flow has a separate step, Outgoing Webhook.

Holding an entry or creating a new one

Workflow step. A person submits the form and, at the point you choose, the entry stops until an authenticated request arrives.

Create an entry. An external system sends a POST to an address defined in a feed, the entry is created and the workflow starts. It is set up in the form settings, and you can add several webhooks so that several systems feed the same form.

The choice is simple: if the workflow starts with a form submitted by a person, you need the step. If it starts outside, you need the feed.

The request that releases an entry

• Address: a POST to /wp-json/gf/v2/entries/[ID]/workflow-hooks, with the entry ID. Version 2 of the Gravity Forms API is the recommended one, and version 1 is still supported.
• Authentication: workflow-api-key and workflow-api-secret, in the body or as URL parameters.
• Without field mapping: on a valid request, the workflow moves to the next step.
• With mapping: the received values are stored in the chosen fields.

The API key should not change after you save it. If you change it with entries on that step, they can get stuck. The secret, on the other hand, is worth changing periodically.

The creation feed works differently. Its URL carries an ID and a key, and anyone who obtains it can create entries, so treat it like a password. For stronger verification, the gravityflowincomingwebhook_check_permissions filter accepts custom code, such as checking an HMAC signature.

How the data lands in the fields

The request can carry form-data or JSON. Fields with several parts, such as name or address, take the whole value or individual elements, and checkboxes accept a list of objects with id and value. To reach into a nested structure you use the backslash, with paths like people\0\name.

These types are left out of the mapping:

• Multiple file uploads: a single file upload does work.
• Post fields: title, content, excerpt, tags, category, images and custom field.
• Pricing fields: product, quantity, options, shipping and total.

If you want to validate values or their source, the route is to use version 2 of the API and extend the WordPress REST API, which means writing code.

Connecting the first external system

It needs Gravity Flow, which works on top of Gravity Forms, and an SSL certificate on the server. Then, for the workflow step:

1. Add an Incoming Webhook step at the point where it should wait.
2. Name it and set the key and the secret.
3. Choose whether the request only advances the workflow or also stores fields.
4. Submit a test entry and send the request with its ID, for example from Postman.
5. Check the result on the Workflow Status screen.

Nearby pieces for your automations

Gravity Flow PDF Generator adds PDF steps to the same workflow, for example after the external system has completed the data.

If you want to fire automations rather than approval workflows, AutomatorWP Webhooks connects external requests with actions in WordPress. To send WPForms submissions to another API, there is WPForms Webhooks.

Responses and errors for each request

What does it return when creating an entry?

A 200 code with the new entry's ID.

What do I check if I get a 400 or 500 error?

That the Content-Type header matches the body encoding, and that the JSON keys are the ones in the field mapping.