Actions · Coordinate docs

A trigger's then is one action or a list; every action runs.

Webhook

json

{"webhook": {"url": "https://example.com/hooks/coordinate", "signing_secret": "secret:HOOK"}}

For a receiver built for Coordinate. The body is the firing as JSON: {version: "coordinate.webhook.v1", delivery_id, trigger, firing, event, rows, row, about}. With a signing secret, Coordinate-Signature: t=<unix>,v1=<hex HMAC-SHA256 of "<t>.<body>">.

API request

json

{"request": {"method": "POST", "url": "https://api.linear.app/graphql",
   "auth": {"bearer": "secret:LINEAR"},
   "body": {"query": "mutation($t: String!) { issueCreate(input: {teamId: \"T\", title: $t}) { issue { id } } }", "variables": {"t": "{{event.payload.title}}"}}},
 "record": {"issue_id": "data.issueCreate.issue.id"}}

For any API, in its own shape. auth is {"bearer": "secret:X"}, {"headers": {"x-api-key": "secret:X"}}, or {"connection": "github" | "<source>"} to use a connected source's credential. The host can't be templated, and a secret is only ever sent to the host it was first used with. With {"connection": "github"}, Coordinate uses the GitHub App installation for the account the URL names (/repos/{owner}/…), for any endpoint the app's permissions cover: metadata (stars, releases, topics), contents, pull requests, checks, and Actions. Reads (GET) of public repositories the app isn't installed on use Coordinate's own GitHub credentials, so watching any public repository needs no token. Only a private repository the app can't reach needs {"bearer": "secret:NAME"} with a personal access token. record copies fields from the JSON response into action.succeeded.

Emit

json

{"emit": {"type": "deploys.flaky", "payload": {"repo": "{{event.payload.repo}}"}}}

Appends an event on source coordinate right away, for other triggers and agents to react to.

Messages

Send a message to wherever you'll see it. Email to yourself needs no setup; for the others, store the credential as a secret first (Settings → Secrets, or coordinate secret set NAME).

json

{"slack": {"webhook_url": "secret:SLACK_WEBHOOK", "message": "Deploy failed: {{event.payload.url}}"}}
{"discord": {"webhook_url": "secret:DISCORD_WEBHOOK", "message": "Deploy failed: {{event.payload.url}}"}}
{"email": {"subject": "{{trigger.name}}", "message": "Deploy failed: {{event.payload.url}}"}}
{"email": {"api_key": "secret:RESEND", "from": "Coordinate <alerts@your-domain.com>", "to": ["team@example.com"], "subject": "{{trigger.name}}", "message": "Deploy failed: {{event.payload.url}}"}}
{"poke": {"message": "Deploy failed: {{event.payload.url}}", "api_key": "secret:POKE"}}

Slack: in Slack, create an app with an incoming webhook for the channel (api.slack.com/apps → Incoming Webhooks) and store the https://hooks.slack.com/… URL as a secret. The URL is the credential, so it is never shown again.
Discord: channel settings → Integrations → Webhooks → New webhook → Copy URL, and store the https://discord.com/api/webhooks/… URL as a secret. Mentions in the message don't ping anyone.
Email: with just subject and message, Coordinate sends it from its own address to your workspace's email (Settings → Email), up to 50 a day. To email anyone else, or more, add your Resend API key as api_key, a sender on a domain verified in Resend as from, and the recipients as to.
Poke: a text through Poke, framed so Poke knows it came from an automation.
Anything else (ntfy, PagerDuty, Telegram, your own app): a webhook with the whole firing as JSON, or a request in the API's own shape.

Claude agent

{"claude_agent": {"api_key": "secret:ANTHROPIC", "agent_id": "...", "environment_id": "...", "vault_ids": [...], "repo": "owner/name", "repo_token": "secret:GH", "rubric": "...", "message": "..."}}: starts a Claude Managed Agents session with the task as an outcome, the firing as data, and instructions to report back with emit (agent.completed or agent.failed with the firing id as correlation_id). The session id is recorded.

Templates

{{event.payload.x}}, {{event.id}}, {{rows}}, {{row.x}}, {{trigger.name}}, {{firing.id}}, with |lower and |upper. A string that is exactly one placeholder keeps the value's type, so "{{event.payload}}" stays an object.

Delivery

Webhooks, requests, messages, and agent sessions are delivered at least once: up to 10 attempts over 24 hours, retrying network errors, 408, 429, and 5xx with backoff (honoring Retry-After). Redirects are not followed. A failure that won't recover becomes an alert. list_actions shows recent runs; retry_action sends a failed one again.