Automations (native mini-n8n)

Triggers (3 types)

1. event — triggered by platform events via emitAutomationEvent() in after(). The 21 events are: lesson_completed, module_completed, course_completed, quiz_submitted, assignment_submitted, enrollment_created, enrollment_completed, forum_post_created, forum_reply_created, grade_posted, announcement_created, live_class_scheduled, live_class_started, student_inactive, tag_added_to_user, tag_removed_from_user, webhook_received, scheduled_trigger, and gamification events badge_earned, level_up, contest_ended.
2. scheduled — cron-based (interval, daily, weekly, cron). Processed by GET /api/cron/automations.
3. webhook — public endpoint authenticated by 64-char hex token. URL: /api/automations/webhook/[token].

Conditions

{
  "logic": "and",
  "rules": [
    { "field": "user.role", "operator": "eq", "value": "student" },
    { "field": "event.score", "operator": "gte", "value": 80 }
  ]
}

Operators: eq, neq, gt, gte, lt, lte, contains, not_contains, in, not_in.

Actions (9 types)

send_notification, add_tag, remove_tag, create_announcement, send_webhook, send_web_request, enroll_user, trigger_automation, send_email.

send_email uses the institutional email service (SMTP/Resend/SendGrid) with a template slug or inline subject+HTML, targeting trigger_user, users_with_tag, course_students or a custom address.

Template interpolation: {{user.name}}, {{event.score}}, etc.

Security

• Tenant isolation
• SSRF prevention (url-validator.ts) — blocks private IPs, localhost, metadata endpoints (IPv4 + IPv6)
• HTTP timeout: 10s via AbortController
• Webhook token: 64-char hex, rotatable
• Chain depth max 5

See also

• Platform overview