Block Reference
Every block available in Confluye, grouped by category, and how to configure it.
Blocks are the building units of a workflow. Each block has a kind, a set of configuration
fields, and a downstream output that later blocks can reference with expressions like
{{input.field}} or {{lastOutput}}. This reference groups blocks by category and calls out the
durable and AI blocks in detail.
Triggers
Triggers start a run. A workflow has exactly one.
| Block | Starts when |
|---|---|
| Start (manual) | You run it from the canvas, with typed inputs |
| Webhook | An external system POSTs to the deployed URL |
| Schedule | A cron/recurring schedule fires |
| App triggers | A connected app emits an event (Slack message, GitHub PR, Gmail message, Stripe payment, and ~25 more) |
AI
The Agent block reasons over input, documents, tables, and retrieved context. Utility AI blocks
add single-purpose model operations. All AI blocks run through BYOK — they
reference a provider, model, and credential such as {{OPENAI_API_KEY}}.
| Block | Kind | What it does |
|---|---|---|
| Agent | aiAgent | Reason over context and tools |
| Gemini | aiAgent | Generate answers with a Google Gemini API key |
| Confluye Command | aiAgent | Delegate to the primary workspace agent runtime |
| Parallel AI | parallel | Run several instructions against the same context |
| Memory | aiAgent | Store and reuse short-term workflow context |
| Claude Code | claudeCode | Run a Claude Code agent from a workflow |
| Codex CLI | codexCli | Run a Codex CLI agent from a workflow |
Gemini
Search for Gemini or Google AI in the block catalog. The Gemini block uses the shared
Agent runtime with Google Gemini selected, gemini-3.8-flash as its initial model, and a
{{GOOGLE_AI_API_KEY}} credential reference. Connect a Gemini API key in Settings → BYOK,
then select that workspace credential in the node. You can edit the model and configure
prompts, tools, and the token budget in the same inspector as other Agent blocks.
Connecting Gmail or Google Drive does not provide a Gemini API key. Gemini itself requires no additional Workspace OAuth scopes. Before passing Workspace data to Gemini, verify the API project's billing tier and data-use settings against Google's Limited Use requirements; a connected key alone does not establish compliance.
Utility AI blocks
These are single-operation blocks on the aiAgent kind. Each picks a provider/model that supports
the capability; without a credential they fall back to a consistent simulated mode and block deploy.
| Block | Operation | Output |
|---|---|---|
| Embeddings | ai-embeddings | An embedding vector sized to the model |
| Vision | ai-vision | A description/analysis of an image |
| Image Generator | ai-image | A generated image from a prompt |
| Speech-to-Text | ai-stt | Transcribed text from audio |
| Text-to-Speech | ai-tts | Synthesized speech audio |
| Translate | ai-translate | Text translated into a target language |
| Web Search | ai-web-search | Web results via a search-capable provider or a Tavily/Serper credential |
Logic and control flow
| Block | Kind | What it does |
|---|---|---|
| Condition | condition | Route true/false on an expression |
| Router | router | Choose a downstream path from a value |
| Wait | wait | Pause the run durably (see below) |
| Human in the Loop | approval | Durable Human Task: park for a named outcome / approval (see below) |
| Guardrails | guardrails | Validate output against policy/schema |
| Evaluator | evaluator | Score a result against quality criteria |
| Loop | loop | Repeat until a condition or iteration limit. n8n Split In Batches / Loop Over Items import here |
| Call workflow | workflowCall | Run another workspace workflow (imported n8n Execute Workflow uses the original n8n id until the child is imported) |
Wait
The Wait block pauses a run durably — the run is parked with a waiting status and resumes
without a live process holding it open, so it can wait minutes or days.
| Field | Meaning |
|---|---|
mode | duration, until (a date), or event |
duration | How long to wait — 15m, 2s, 24h, 1d, or a bare number (seconds) |
until | A target date/time (until mode) |
eventTimeout | How long to wait for an event before timing out |
onTimeout | continue routes to a timeout branch; otherwise the run fails |
A duration/date wait resumes automatically when the timer elapses — driven by a delayed job
and backstopped by a scheduler sweep, so it still fires without Redis. An event wait resumes
when a caller POSTs to a single-use resume hook (/api/hooks/resume/{token}). The token is
crypto-random and single-use: a second POST, an expired token, or a cancelled run returns 410;
an unknown token returns 404. Event payloads are JSON-only (non-JSON content types return 415)
and size-capped (413 when exceeded).
Human in the Loop (Human Task)
The approval block is Confluye's Human Task. It pauses the run durably — the run parks with
a waiting status, releases its worker lease, and holds no live process, so a task can sit open
for minutes or days. A legacy approve/reject approval maps to a two-outcome Human Task; new tasks add
named outcomes, candidates, forms/drafts, and explicit escalation and timeout behavior.
| Field | Meaning |
|---|---|
approvers | Who may decide: member (member and up), a minimum role, or specific users |
approverUserIds | The specific users allowed to decide |
outcomes | Named outcomes; each becomes a labeled branch (approve/reject is the default pair) |
formFields | Typed form the human fills; drafts are saved and survive navigation/restart |
priority | Task priority in the inbox |
dueAt / followUpAt / escalateAt | Due, follow-up, and escalation timing |
timeout | Hard timeout — how long the task stays open (e.g. 24h) |
onTimeout | fail or a labeled timeout branch when it expires |
instructions | Context shown to the assignee |
Assignment is independent of lifecycle: a task can be claimed, reassigned, started, paused, drafted,
reminded, and escalated while it stays open. Only a terminal outcome consumes the linked wait token
exactly once. Reminders and escalations notify without resuming the run, and an expired task is
never treated as approval — it follows the timeout branch.
Humans work tasks from the Tasks inbox or the run detail's task card; the session routes are
POST /api/human-tasks/{id}/actions (claim, unassign, reassign, start, pause, save-draft,
complete, cancel). The legacy POST /api/runs/{id}/approval endpoint remains as a compatibility
adapter over the task service. Every read/write is reauthorized against current membership, so a
revoked user is rejected even on a task issued earlier; a concurrent second completion returns 409/
410. External agents can monitor tasks read-only (see the
Human Tasks API) but can never complete a human approval.
For detection, diagnosis, and safe recovery of parked, orphaned, or racing tasks, see the Human Task recovery runbook.
Data
| Block | Kind | What it does |
|---|---|---|
| Table Read / Database | tableRead | Read rows from a workspace table |
| Table Write | tableWrite | Insert or update rows |
| JSON Mapper / Function / Variables | function | Transform data or set named values |
| Array Filter Sort / Group / Join | function | Reshape array data |
| Record Diff / Validate Records | function | Compare or validate records |
| Note / Credential | function | Annotate, or reference a workspace credential |
| Sticky note | stickyNote | Canvas annotation from n8n Sticky Note; not executed |
| Output | output | Return a final structured result |
| Response | response | Reply to the webhook caller (see below) |
Response
The Response block sets the status, headers, and body of the reply to a webhook (or chat) caller — then the run continues (respond-and-continue). The first Response wins; any later Response is a no-op with a warning in the run log.
| Field | Meaning |
|---|---|
statusCode | HTTP status to return (200–599) |
contentType | Response content type (restricted to a safe set) |
headers | Extra response headers (whitelisted; hop-by-hop and Set-Cookie filtered) |
body | The response body (capped at ~1 MB) |
For same-origin safety, the content type is restricted to a safe set (JSON, plain text, CSV,
markdown, images, PDF, and similar). Executable types like HTML are only served as a non-executable
download (Content-Disposition: attachment), and X-Content-Type-Options: nosniff is always
applied. The status must be in the 200–599 range. If the run hasn't produced a Response within a
~30-second budget, the webhook returns 202 with a processing status and keeps running; if the
run enters a waiting state first, it returns 202 with status: "waiting" and the runId. On a
manual or scheduled run (no HTTP caller), the Response body simply becomes the block's output.
Knowledge
| Block | Kind | What it does |
|---|---|---|
| Knowledge | knowledgeSearch | Retrieve context from a knowledge base (RAG) |
| Knowledge Doc | knowledgeDocument | Create, update, trash, restore, link, unlink, re-index, or read status of a Knowledge Base document |
| Docs | docsSearch | Search uploaded workspace documents |
knowledgeSearch and knowledgeDocument are separate nodes: search only reads, and the document
node performs content lifecycle through the canonical document capabilities. A knowledgeDocument
create/update can optionally park on a generation-aware searchable wait and resume with the
terminal indexing state (indexed, keyword_only, or failed) as its output; a stale generation
cannot wake a newer mutation. "Delete" means reversible move-to-trash with immediate exclusion from
retrieval — permanent purge stays an administrator-only API operation. See the
Knowledge Base guide.
Integrations
Integration blocks call third-party APIs. Confluye ships a broad catalog (GitHub, Slack, Gmail, Google Sheets/Slides/Drive/Calendar, Jira, Confluence, HubSpot, Salesforce, Notion, Linear, and many more), grouped in the canvas under Developer Tools, Communication, and Integrations.
Connectors are increasingly backed by integration manifests: each provider declares typed
operations (input/output schemas), credential requirements, and dynamic option loaders, so the
block exposes a real operation selector instead of a raw HTTP facade. Each provider/operation
carries a status — unavailable, preview, or stable — and deploy is blocked for unavailable
operations. An operator kill-switch env var can additionally disable a provider. Credential
material is redacted from run logs.
Real integration operations
These operations are declared in the integration manifests and are the provider-specific operations the block selector exposes.
| Provider | Operations |
|---|---|
| Gmail | Send message, list messages, get message, modify labels, copy attachment to GitHub |
| Slack | Send message, list channels, update message, delete message |
| Google Calendar | List calendars, list events, create event, update event, delete event |
| Google Sheets | Create spreadsheet, read range, append row, update row |
| Google Slides | Create presentation, get presentation, atomic batch update |
| Google Drive | List files, get file metadata, download text file, upload file, copy file, move file |
| Jira | Create issue, list issue transitions, transition issue, comment on issue, search issues |
| Confluence | Create page, get page, search pages |
| GitHub | Create issue, comment on issue, list repositories, create or update file, create pull request |
Write operations carry side-effect metadata and may require confirmation. Some read/list/search
operations are still marked preview in the manifest when they are backed by declarative HTTP
rather than a dedicated runtime executor.
API Batch
A apiBatch block fans out one HTTP request per item in an input list, with limited concurrency,
then aggregates the results.
| Field | Meaning |
|---|---|
itemsField | The input field holding the list of requests (e.g. requests) |
method | HTTP method for each request |
headers / body | Per-request headers and body template |
concurrency | Max requests in flight (default 5) |
perItemTimeoutMs | Timeout per request (default 10000) |
continueOnItemError | Keep going when an item fails (default true) |
Results are aggregated as { results[], errors[], stats } in input order. All request URLs pass
through the SSRF egress guard (see below).
A2A (agent-to-agent)
The a2aCall block invokes an external agent over the A2A protocol and uses its response
downstream.
| Field | Meaning |
|---|---|
endpoint | The agent's invoke URL |
apiKey | API key for the target (e.g. {{A2A_API_KEY}}) |
skillId | Which advertised skill to invoke |
mode | sync or async with polling |
input | The payload to send (e.g. {{lastOutput}}) |
timeoutMs | Request or polling timeout (default 30000) |
Confluye also publishes an agent card and an invoke endpoint for your own deployed workflows, so
another Confluye (or any A2A client) can call them. The agent card lists deployed workflows as
skills; invocation authenticates with a workspace API key and is opt-in per workspace. Sync
invocation maps to a run plus its Response and is limited to workflows without waits. Async
invocation returns 202 with a task id and supports workflows that pause on Wait or approval
blocks.
See A2A for async tasks, polling, callbacks, signatures, and task expiry.
Call workflow (workflowCall)
Runs another Confluye workflow in the same workspace. Config: workflowId (target id or imported n8n id), optional workflowName, input (default {{lastOutput}} on n8n import). Deploy stays blocked while the target is still a placeholder or missing. Runtime resolves imported n8n ids after the child bundle is upserted.
Imported n8n Code nodes are function nodes with n8nType ending in code. When FLUXUS_ENABLE_WORKFLOW_CODE=true, Code and general JavaScript expressions run in a fresh, one-use Linux child with the installed seccomp policy, bounded serialized data, and no application credentials, filesystem, network, or subprocess access. The legacy FLUXUS_ALLOW_UNSAFE_WORKFLOW_CODE variable does not select a backend and is ignored. If the operator flag is off, or Linux and the policy are unavailable, deployment and execution stay blocked with a recovery diagnostic; there is no in-process fallback. See Importing n8n.
Egress protection (SSRF)
Any user-supplied URL — the a2aCall endpoint, apiBatch targets, and local provider base URLs —
passes through a single egress guard that blocks private, link-local, and loopback ranges and
*.railway.internal (except an explicit allow-list), and re-validates redirects against the same
rules. Local providers (Ollama/vLLM) are the one case where loopback is intentionally allowed, via
their host allow-list.