Connect a Notify event source

Subscribe this workspace to one TopoloNotify event type from one app, so each matching platform event is recorded as a Nurture lifecycle event. For Nexus delivery events connect each nexus.email.* type from app_topolo_nexus: only events for Nurture's own sends (app_id and entity_ref_id) in this workspace are applied, and with all seven connected delivery polling stops. Creates a Notify webhook subscription as the caller and sets its signing secret to one Nurture derives; no secret is stored.

Outcome

Before you start

Verify identity and pin the intended organization and environment before discovering the action.
Discover a granted Nurture workspace. The application permission is workspace:write; required workspace access is admin. A permission alone does not supply a workspace grant.
Organization and workspace come from verified context. Select resourceType/resourceId separately from action input; body fields cannot grant a different organization or workspace. The first authorized product action can initialize an identity-only workspace mirror.
Obtain authorization for the documented effect or personal-data export before supplying CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_nurture.event_sources.connect --detail --json
topolo resources topolo-nurture --json
topolo workspaces list topolo-nurture --json
topolo actions get app_topolo_nurture.event_sources.catalog --detail --json

sourceAppId: Canonical application id for the selected available Notify adapter.
notifyEventType: Available adapter event type; unavailable catalog rows cannot be connected.

Request

POST /api/event-sources

Save action input as payload.json. The reviewed plan separates path identifiers, query fields and HTTP body. Set NURTURE_WORKSPACE_ID from granted resource discovery; it is separate from action input.

Inspect and test this action in the signed action console. A test response still requires the verification below.

Input fields

Field	Required	Type	Constraints
`sourceAppId`	Required	string	Canonical application id for the selected available Notify adapter. {"minLength":1,"maxLength":120,"pattern":"^app_[a-z0-9]+(?:_[a-z0-9]+)+$"}
`notifyEventType`	Required	string	Available adapter event type; unavailable catalog rows cannot be connected. {"minLength":1,"maxLength":120}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "sourceAppId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 120,
      "pattern": "^app_[a-z0-9]+(?:_[a-z0-9]+)+$"
    },
    "notifyEventType": {
      "type": "string",
      "minLength": 1,
      "maxLength": 120
    }
  },
  "required": [
    "sourceAppId",
    "notifyEventType"
  ],
  "additionalProperties": false
}

Effects

Creates one event source row, then creates a TopoloNotify webhook subscription (app_topolo_notify.webhooks.subscriptions.create) delivering to this source and sets its secret (webhooks.subscriptions.update).
On any Notify failure the source is left disconnected and a half-created subscription is deleted.

Interpret the response

The returned identifier path is $.source.id for event_source. Empty lists do not discover a target.

Call app_topolo_nurture.event_sources.list and confirm the source is active with a notifySubscriptionId.

Exact success schema:

{
  "type": "object",
  "required": [
    "source"
  ],
  "properties": {
    "source": {
      "type": "object",
      "required": [
        "id",
        "status"
      ],
      "properties": {
        "id": {
          "type": "string"
        },
        "sourceAppId": {
          "type": "string"
        },
        "notifyEventType": {
          "type": "string"
        },
        "lifecycleEventType": {
          "type": "string"
        },
        "notifySubscriptionId": {
          "type": [
            "string",
            "null"
          ]
        },
        "status": {
          "type": "string",
          "enum": [
            "pending",
            "active",
            "disconnected"
          ]
        },
        "createdAt": {
          "type": "string"
        },
        "updatedAt": {
          "type": "string"
        }
      }
    }
  }
}

Worked examples

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Replace synthetic identifiers using credential-scoped discovery. A local success is not evidence of a deployed effect, configured provider or delivered message.

Successful request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "sourceAppId": "app_topolo_auth",
  "notifyEventType": "platform.welcome"
}

CLI:

topolo actions validate app_topolo_nurture.event_sources.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.event_sources.connect",
    "input": {
      "sourceAppId": "app_topolo_auth",
      "notifyEventType": "platform.welcome"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "source": {
    "id": "src_d3a93a27d39f4b11a01854ab2b419c78",
    "organizationId": "org_a",
    "workspaceId": "ws_a",
    "sourceAppId": "app_topolo_auth",
    "notifyEventType": "platform.welcome",
    "lifecycleEventType": "signup",
    "notifySubscriptionId": "whs_3",
    "status": "active",
    "createdAt": "2026-10-04T00:32:37.562Z",
    "updatedAt": "2026-10-04T00:32:37.563Z"
  }
}

HTTP 201. Call app_topolo_nurture.event_sources.list and confirm the source is active with a notifySubscriptionId.

Another supported request

Input · payload.json:

{
  "sourceAppId": "app_topolo_auth",
  "notifyEventType": "platform.welcome"
}

CLI:

topolo actions validate app_topolo_nurture.event_sources.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.event_sources.connect",
    "input": {
      "sourceAppId": "app_topolo_auth",
      "notifyEventType": "platform.welcome"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "source": {
    "id": "src_a67150dba09c441c9ad40e93d596cc44",
    "organizationId": "org_b",
    "workspaceId": "ws_b",
    "sourceAppId": "app_topolo_auth",
    "notifyEventType": "platform.welcome",
    "lifecycleEventType": "signup",
    "notifySubscriptionId": "whs_2",
    "status": "active",
    "createdAt": "2026-10-04T00:32:37.518Z",
    "updatedAt": "2026-10-04T00:32:37.518Z"
  }
}

HTTP 201. Call app_topolo_nurture.event_sources.list and confirm the source is active with a notifySubscriptionId.

Refused request · root_key_unavailable

Input · payload.json:

{
  "sourceAppId": "app_topolo_auth",
  "notifyEventType": "platform.welcome"
}

CLI:

topolo actions validate app_topolo_nurture.event_sources.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 503:

{
  "error": {
    "code": "root_key_unavailable",
    "message": "The Nurture application root key is not available; provision it with root_key.provision."
  }
}

HTTP 503. Preserve the refusal details and do not claim success.

Refused request · notify_not_configured

Input · payload.json:

{
  "sourceAppId": "app_topolo_auth",
  "notifyEventType": "platform.welcome"
}

CLI:

topolo actions validate app_topolo_nurture.event_sources.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 503:

{
  "error": {
    "code": "notify_not_configured",
    "message": "TopoloNotify is not configured for this Nurture deployment."
  }
}

HTTP 503. Preserve the refusal details and do not claim success.

Refused request · notify_unavailable

Input · payload.json:

{
  "sourceAppId": "app_topolo_auth",
  "notifyEventType": "platform.welcome"
}

CLI:

topolo actions validate app_topolo_nurture.event_sources.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.event_sources.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 502:

{
  "error": {
    "code": "notify_unavailable",
    "message": "TopoloNotify refused the webhook subscription request (403).",
    "details": {
      "notifyStatus": 403
    }
  }
}

HTTP 502. Preserve the refusal details and do not claim success.

Verify the result

Call app_topolo_nurture.event_sources.list and confirm the source is active with a notifySubscriptionId.

Errors and recovery

organization_required (HTTP 403): Select an organization available to the verified caller before choosing a Nurture workspace.
permission_denied (HTTP 403): Grant the credential the required Nurture workspace permission.
workspace_required (HTTP 409): Create a Nurture workspace, or pass the workspace resource context.
invalid_input (HTTP 422): Correct the fields named in error.details using inputSchema, then retry.
unmapped_notify_event_type (HTTP 422): Pick an available notifyEventType from app_topolo_nurture.event_sources.catalog; for unavailable sources use app_topolo_nurture.events.ingest.
source_already_connected (HTTP 409): The pair is already connected; list sources, or disconnect the existing one first.
notify_unavailable (HTTP 502): TopoloNotify refused or failed the webhook request (see error.details.notifyStatus). Check the credential may manage Notify webhook subscriptions in this workspace, then retry.
notify_not_configured (HTTP 503): This deployment has no NOTIFY_BASE_URL or NURTURE_PUBLIC_URL; report it to the platform operator.
root_key_unavailable (HTTP 503): Check app_topolo_nurture.root_key.status; an operator must run app_topolo_nurture.root_key.provision where the master key is bound.

Auth or gateway failures may precede this handler. Preserve the exact response shape, error string/code, request id and credential context; no synthetic fixture establishes live credential access.

Recovery boundary

Disconnect the source to delete its Notify subscription.

List event sources: List the Notify event sources connected (or previously connected) in the caller's Nurture workspace, newest first.
List lifecycle events: List the newest lifecycle events in the workspace, optionally filtered by event type or contact, up to 200.
Disconnect an event source: Delete the source's TopoloNotify webhook subscription (app_topolo_notify.webhooks.subscriptions.delete) as the caller and mark the source disconnected. Events already recorded are kept. Repeating it on a disconnected source is harmless.

Evidence

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Test scenario and capture digests are retained with each fixture.

Connect a Notify event source

Outcome

Before you start

Discover the target

Request

Input fields

Effects

Interpret the response

Worked examples

Successful request

Another supported request

Refused request · root_key_unavailable

Refused request · notify_not_configured

Refused request · notify_unavailable

Verify the result

Errors and recovery

Recovery boundary

Related actions

Evidence