Integration

flow-ref

Invokes another flow by name. The target must be a flow with no source: (a source-less flow gets an implicit source and becomes callable by name). The called flow receives a fresh sub-message — a clone of the body and variables under a new event ID — so the sub-invocation correlates independently of the caller's own terminal event.

Semantics:

• Synchronous (default): the caller waits; the called flow's body replaces the caller's body and its variables are merged over the caller's variables key-by-key. If the called flow drops the message, the caller's message continues unchanged.
• One-way (oneWay: true): the message is dispatched and the caller continues immediately, ignoring the result. Useful for audit trails and side effects.

Errors: a synchronous call propagates the called flow's error to the caller; a one-way call errors only if dispatch itself fails.

# Fire-and-forget audit; the request keeps moving immediately.
- type: flow-ref
  name: audit-async
  settings:
    flow: audit
    oneWay: true

# Synchronous delegation; enrich-order's body + variables fold back in.
- type: flow-ref
  name: enrich-sync
  settings:
    flow: enrich-order

See Composing flows for patterns.

jwt-validate

A filter block that authenticates HTTP requests: it verifies a bearer JWT against an OIDC provider and, on failure, stops the flow with a configurable response (401 by default) so the rest of the chain never runs. On success it injects the verified claims into a variable (default vars.jwt) and the token subject into vars.sub.

Behavior notes:

• Key material for discover/jwks is resolved lazily on the first request, so a briefly unreachable provider does not fail deployment; inline needs no network and fails fast on a bad key.
• A rejection sets the body to {"error": "unauthorized"}, sets vars.httpStatus to rejectStatus, and requests the flow stop. A missing token yields a bare challenge; a present-but-invalid token adds error="invalid_token" (per RFC 6750).
• A key-resolution failure (provider unreachable) is an operational error — it aborts the flow rather than rejecting the request.

flows:
  - name: me
    source:
      connector: api
      type: http
      settings:
        path: /me
        headers: [Authorization]            # forward the token into vars
        responseHeaders: [WWW-Authenticate] # emit the challenge on rejection
    process:
      - type: jwt-validate
        name: require-auth
        settings:
          mode: discover
          issuer: ${OIDC_ISSUER}
          audience: ${OIDC_AUDIENCE}
          algorithms: [RS256]
      # Only reached with a valid token.
      - type: set-payload
        settings:
          value: '{"sub": vars.sub, "email": vars.jwt.email}'

See Validation and auth and MCP auth for full walkthroughs.

template-resource

Renders a declared template resource against the current message. The template is declared under resources.templates in the flow file and embeds {{ CEL }} expressions over body, vars, env, and now. The rendered text replaces the message body by default, or is stored in a variable when target is set.

Errors: an unknown template id or a render failure (a failing embedded expression) errors the block. Declared resources are loaded when the config loads, so a missing template file fails at deployment.

resources:
  templates:
    - resource: templates/welcome.tmpl
      as: welcome

flows:
  - name: greet
    process:
      - type: template-resource
        settings:
          id: welcome
          target: rendered
      - type: set-payload
        settings:
          value: '{"viaBlock": vars.rendered, "viaCel": templateResource("welcome")}'

The templateResource(alias) CEL function renders the same template inline in an expression. See Resources for how templates are declared, and Serving HTML for the raw-body pattern.