Recipe: no-code automations with Streamflow

Why automate without code

Detection events are only useful if something happens next. Streamflow is the "next": a visual, in-core workflow engine that reacts to StreamHub events and chains boxes together — capture a snapshot, ask an AI to confirm it, branch on the answer, notify a human. No worker to deploy, no glue service, no code.

Architecture in words

Streamflow is a Studio App backed by an in-core engine that taps the same event funnel that feeds signed callbacks. A workflow is a DAG of boxes in three families: triggers (what starts a run), actions (what it does), and logic (how it branches). It persists every run and per-box step to a per-app streamflow.db, and it is rate-limited and budget-guarded so a runaway camera cannot run up an AI bill.

The canonical flow

The classic security automation is five boxes:

trigger.event (perimeter intrusion)
  → action.snapshot
  → action.ai ("is this a real intrusion?")
  → logic.condition (confidence > 0.7)
  → action.notify

An intrusion fires; a snapshot is captured to your S3; an AI model looks at it and returns a confidence; if it clears the threshold, a human gets pinged — and false positives are filtered out before anyone is woken up.

1. Install and set the AI budget

export BASE="https://your-server.example.com/api/v1"
export TOKEN="sk_...."

curl -X POST $BASE/apps/security/plugins/streamflow/install -H "Authorization: Bearer $TOKEN"

curl -X PATCH $BASE/apps/security/plugins/streamflow -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"enabled": true, "config": {"ai_provider": "openai", "ai_model": "gpt-4o-mini", "ai_api_key": "sk-...", "ai_budget_monthly_usd": 20, "max_runs_per_min": 60}}'

ai_budget_monthly_usd is a hard cap — the action.ai box fails closed when it is reached, so a stuck camera cannot bankrupt you.

2. Know the boxes you can wire

Triggers: trigger.event (any StreamHub event, exact name or a plate.* wildcard, filterable by room/tags/predicate), trigger.schedule (cron or interval), trigger.mqtt (an inbound MQTT/IoT topic), trigger.manual (the Run button).

Actions: action.snapshot (capture a room to S3), action.s3, action.http (POST anywhere, SSRF-guarded), action.ai (prompt OpenAI/DeepSeek, optionally with an image, budget-guarded), action.emit, action.mqtt (publish to a topic), action.notify (fan out via the notifier), action.plugin (post an event to another plugin).

Logic: logic.condition (typed comparison, true/false ports), logic.delay (wait, capped at 60s), logic.setvar, logic.switch.

The notifier reaches four channels: callback, email, Discord and Telegram.

3. Build and run the workflow

Use the visual editor in the app tab, or the API. The box catalogue is at GET /apps/security/plugins/streamflow/boxes; workflows live under .../workflows; enable one with POST .../workflows/:id/enable; test it by hand with:

curl -s -X POST $BASE/apps/security/plugins/streamflow/workflows/<id>/run \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"payload":{}}'

Inspect history at .../runs and drill into a single run's per-box steps at .../runs/:id.

What you should see

With the workflow enabled, a real perimeter intrusion triggers a run: runs shows the snapshot captured, the AI verdict, the condition branch taken, and — for the ones that clear 0.7 — a Telegram message delivered. Runs that fail the condition stop quietly.

Troubleshooting

• AI box does nothing — check the ai_api_key is set and you are under ai_budget_monthly_usd; over budget it fails closed until next month.
• Triggers dropped — a burst above max_runs_per_min is shed (and logged); raise it if you expect spikes.
• Notify never arrives — MQTT is not one of the notifier channels (use the separate action.mqtt box for that); the four notify channels are callback, email, Discord and Telegram.
• Delay ignored past a minute — logic.delay is bounded to 60 seconds by design.

Closing

Streamflow turns your detection plugins into automations without a line of code, all inside the server you already run. If you want bespoke boxes, a complex multi-branch workflow, or integration with your ticketing or SOC tooling, our team builds those on top of the open-source engine.