Serverless Functions & Webhooks

Functions and webhooks let users automate work around their data. Functions run custom backend logic. Webhooks notify external systems when something important happens.

Functions

Functions are managed per cluster from:

/functions/{clusterId}

The page calls these backend routes:

Function Shape

A function should be written as small, predictable backend logic. Use it for validation, enrichment, notifications, data transformations, or controlled integrations.

Example:

export default async function handler(context) {
  const { db, input, user } = context;

  const customer = await db.collection("customers").findOne({
    email: input.email,
  });

  if (!customer) {
    return { ok: false, reason: "customer_not_found" };
  }

  return {
    ok: true,
    customerId: customer._id,
    plan: customer.plan,
    requestedBy: user.email,
  };
}

Test A Function

From the dashboard:

1. Open /cluster/{clusterId}
2. Click Functions
3. Create or edit a function
4. Use Test
5. Open Logs for the function

From the API explorer:

Open /api-docs
Authorize
Try POST /api/clusters/{clusterId}/functions/{functionId}/test

From curl:

curl -X POST https://credvault-production.up.railway.app/api/clusters/<clusterId>/functions/<functionId>/test \
  -H "Authorization: Bearer <your-session-token>" \
  -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com"}'

What you should see: the function result as JSON, plus a log entry for the test run. For the example above, a found customer returns ok: true; a missing customer returns ok: false with a reason.

Webhooks

Webhooks are managed from:

/webhooks/{clusterId}

The page calls:

Webhook Payload

A webhook delivery should be treated like an external API call. Verify the signature before trusting the body.

Example receiver:

import crypto from "node:crypto";
import express from "express";

const app = express();
app.use(express.raw({ type: "application/json" }));

app.post("/credvault/webhook", (req, res) => {
  const signature = req.header("X-CredVault-Signature");
  const expected = crypto
    .createHmac("sha256", process.env.CREDVAULT_WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");

  if (signature !== expected) {
    return res.status(401).json({ error: "invalid_signature" });
  }

  const event = JSON.parse(req.body.toString("utf8"));
  console.log("CredVault event:", event.type);
  res.json({ received: true });
});

Test A Webhook

Use the dashboard:

1. Open /webhooks/{clusterId}
2. Create a webhook with a public HTTPS URL
3. Select events
4. Press Test
5. Open Deliveries to inspect status and response time

Use the CLI:

cie webhooks list
cie webhooks create
cie webhooks test <webhook-id>

What you should see: the CLI should print the webhook ID, delivery status, HTTP response code, and response time. In the dashboard, the same delivery should appear under webhook deliveries.

When To Use Each

Security Rules

• Use HTTPS webhook URLs.
• Store webhook secrets in environment variables.
• Rotate webhook secrets after sharing or incident response.
• Keep functions small and idempotent.
• Do not log secrets or payment data.
• Use activity logs to audit creation, update, test, and delete actions.