Wavelength REST API

GET /flows flows:read

Lists the organization's flows, newest change first.

curl "https://lnzcwfswvljbijqszxxn.supabase.co/functions/v1/api/v1/flows?limit=50&updated_since=2026-10-01T00:00:00Z" \
  -H "Authorization: Bearer $WAVELENGTH_API_KEY"

{
  "flows": [
    {
      "id": "b946f68b-2d04-4832-abc4-26b476a3202f",
      "title": "Order to cash",
      "created_at": "2026-10-11T21:31:00Z",
      "updated_at": "2026-10-11T21:40:12Z",
      "team_id": null, "folder_id": null, "is_public": false,
      "owner": "admin@acme.com"
    }
  ],
  "total": 1, "limit": 50, "offset": 0, "next_offset": null
}

GET /flows/{id} flows:read

Returns one flow with its graph, transcript, and Mermaid code if it has one. A flow that is not in the organization returns 404.

{
  "flow": {
    "id": "b946f68b-2d04-4832-abc4-26b476a3202f",
    "title": "Order to cash",
    "graph_nodes": [
      { "id": "s", "type": "start", "label": "Start", "x": 0, "y": 0 },
      { "id": "a", "type": "step", "label": "Check order", "owner": "Sales ops", "x": 0, "y": 150 }
    ],
    "graph_edges": [ { "id": "e1", "source": "s", "target": "a", "label": "" } ],
    "transcript": "...", "diagram_code": null, "annotations": null, "pages": null,
    "team_id": null, "folder_id": null, "is_public": false,
    "created_at": "2026-10-11T21:31:00Z", "updated_at": "2026-10-11T21:40:12Z",
    "owner": "admin@acme.com"
  }
}

POST /flows flows:write

Makes a new organization flow. Returns 201 and the saved flow.

curl -X POST https://lnzcwfswvljbijqszxxn.supabase.co/functions/v1/api/v1/flows \
  -H "Authorization: Bearer $WAVELENGTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Order to cash",
    "graph_nodes": [
      { "id": "s", "type": "start", "label": "Start" },
      { "id": "a", "label": "Check order", "owner": "Sales ops" },
      { "id": "d", "type": "decision", "label": "In stock?" },
      { "id": "b", "label": "Ship" },
      { "id": "c", "label": "Back order" },
      { "id": "e", "type": "end", "label": "Done" }
    ],
    "graph_edges": [
      { "source": "s", "target": "a" },
      { "source": "a", "target": "d" },
      { "source": "d", "target": "b", "label": "Yes" },
      { "source": "d", "target": "c", "label": "No" },
      { "source": "b", "target": "e" },
      { "source": "c", "target": "e" }
    ]
  }'

PATCH /flows/{id} flows:write

Changes the fields that you send. Send graph_nodes and graph_edges together, because they replace the whole graph. Set snapshot to true to keep a version in the flow's history. version_label names that version.

curl -X PATCH https://lnzcwfswvljbijqszxxn.supabase.co/functions/v1/api/v1/flows/b946f68b-2d04-4832-abc4-26b476a3202f \
  -H "Authorization: Bearer $WAVELENGTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "title": "Order to cash v2", "snapshot": true, "version_label": "Q4 review" }'

GET /audit audit:read

Returns audit events, newest first. Events include membership and role changes, settings, sharing, exports, public links, flow views, API key use, SCIM changes, and billing changes.

curl "https://lnzcwfswvljbijqszxxn.supabase.co/functions/v1/api/v1/audit?limit=100&action=flow_shared&from=2026-10-01" \
  -H "Authorization: Bearer $WAVELENGTH_API_KEY"

{
  "events": [
    {
      "id": 55, "created_at": "2026-10-11T21:31:54Z",
      "actor": "admin@acme.com", "actor_via": "session",
      "action": "flow_shared", "target_type": "flow", "target_id": "b946f68b-...",
      "detail": { "with": "pat@acme.com", "role": "editor", "title": "Order to cash" }
    }
  ],
  "next_before_id": null
}

To push events to your security tool as they happen, set up the audit stream in Settings, Organization, Security. Each POST is signed with HMAC-SHA256.