Developer changelog: API, webhooks, OAuth and MCP

​

Flow lifecycle

• GET /v1/flows/{id} returns the Flow’s status in Meta (metaStatus), its screens, fields and submit action.
• POST /v1/flows/{id}/publish?dry_run=true checks a Flow without publishing it.
• POST /v1/flows/{id}/deprecate retires a Flow in Meta. Meta cannot undo this. Flowella blocks it while templates still use the Flow, unless you send force.
• DELETE /v1/flows/{id} returns 409 HUBSPOT_FLOW_MANAGED for a Flow built from a HubSpot form, and 409 FLOW_REFERENCED_BY_TEMPLATES while a template draft still uses the Flow. Deleting a Flow never deletes it in Meta: deprecate it first to retire it there. Publishing a deprecated Flow returns 409 FLOW_DEPRECATED.
• When you create a template, a Flow button can point to a Flowella Flow with flowellaFlowId instead of a Meta Flow ID.
• Flows you create through the API publish with the entry screen MAIN_FORM. Flows you published earlier keep working. Republish them before you use them with flowellaFlowId.

​

Webhooks

• New flow.status_updated event when a Flow’s status in Meta changes, for example when it is deprecated. Subscribe to it in Settings → Webhooks. Event types

​

Credentials

• GET /v1/ping returns how you are signed in, your scopes and, for apps, the client ID. Check your credentials
• Replayed idempotent responses include the Idempotent-Replayed: true header. Idempotency

​

MCP server

• AI assistants can connect to the Flowella MCP server by signing in, without an API key. The user chooses an organisation and selects Allow access on the Flowella consent screen. Connections from members who are not an Owner or Admin are read-only. Developer apps
• Installed apps is now AI assistants, with a Last token column. Review and revoke installed apps

• Flowella MCP server. AI assistants that support the Model Context Protocol can read your channels, templates and Flows. The server is read-only and uses an organisation API key. API keys
• GET /v1/flows/{id} accepts the Flowella form ID. Editing the schema of a Flow built from a HubSpot form returns 409: make the change in HubSpot and sync again. Flowella REST API
• Flows built in Flowella can send each submission to one of your webhook endpoints, set on the Flow’s Settings tab. Webhooks
• Registering a developer app with an invalid redirect URI returns a plain-language error. Register an app

​

Breaking changes

• API-Version accepts only 2026-08-11. Any other value returns 400. Leave the header out, or send 2026-08-11. Versioning
• Webhook endpoints need a public HTTPS URL. Private, loopback and cloud metadata addresses are not accepted. Check every endpoint before you upgrade. Adding a webhook endpoint
• OAuth apps. Review these requirements before you upgrade an app built on Flowella OAuth:
  • Requests without a scope get read-only access, and unknown scopes are rejected.
  • The token, introspect and revoke endpoints require client authentication.
  • The authorise request requires state.
  • Client credentials grants do not return a refresh token.
  • Revoking a token revokes only that token’s family.
  Developer apps

​

API

• Error responses include a requestId inside error, which you can quote to support. Errors
• Creating a contact returns 201 and updating one returns 200. A duplicate externalId returns 409, and a deleted contact returns 404.

​

Webhooks

• New contact.created, contact.updated and contact.deleted events. Event types
• Give each endpoint a name with Name (optional). The name appears above the URL in the list.
• For 24 hours after you rotate a signing secret, Flowella also signs each delivery with the old secret and sends it in X-Flowella-Signature-Previous, so you can switch secrets without dropping events. Rotate a signing secret
• A redelivered event keeps its original event ID and timestamp. API delivery records include the correlation ID, response headers and next retry time. Deduplicate events
• Organisation owners get a single notification when Flowella pauses a failing endpoint. Retries and back-off

• Use https://api.flowella.io. Requests to https://api.flowella.io/v1/... return JSON. Old https://app.flowella.io/api/v1/... URLs, including the OpenAPI document, permanently redirect to the API host. Update your base URL so you do not rely on the redirect. Base URL
• The first server in the OpenAPI document is https://api.flowella.io, so imported collections call the right base URL. OpenAPI spec
• The API rejects invalid template components, and templates over Meta’s submission limits, before they reach Meta.
• You can create and send carousel templates through the API. If you do not pass media for a card, Flowella uses that card’s approved sample. Carousel templates
• Fallback values for template variables apply to API sends. Fallback values
• The Developer hub includes complete guides and a Postman collection. Developer hub

• Repeat sends of the same template through the API go out faster.
• When Meta throttles a template management call, Flowella reports it as a rate limit, so your retries back off correctly. Rate limits

• POST /v1/templates/send returns 202. Flowella accepts the request, returns a job ID straight away and delivers the messages in the background, retrying temporary WhatsApp errors. If your integration checks for a 200 response, update it to expect 202 with "status": "accepted". Follow delivery on the template’s Statistics tab. Bulk template sends
• Idempotency-Key. Send an Idempotency-Key header with POST /v1/templates/send and Flowella recognises repeats of the same request for seven days, returning the original job ID instead of sending again. Idempotency

• REST v1 is documented and served on the dedicated API host at /v1/.... Flowella REST API