Send process signals to other systems: subscriptions, OData and the process API

Add a subscription

1. Open Settings › API and click New subscription under Signal subscriptions. Only the organization’s owners and admins see it.
2. Give a name and the address. It must be https, carry no user name or password, and not be a private or local address.
3. Tick the events: metric missed target, new process finding, new card, card decided.
4. Set the daily limit (1 to 100,000, 1,000 by default) and click Save.
5. Copy the signing secret shown: it is shown this once. An organization has at most 20 subscriptions.

What arrives

Each event is one POST with a JSON body and the headers x-duaer-event, x-duaer-delivery, x-duaer-sequence and x-duaer-signature. The body carries ids, names and numbers only, never a case’s own columns (customer names, amounts).

{
  "id": "b3f1…",
  "sequence": 42,
  "event": "card.decided",
  "occurredAt": "2026-10-19T08:15:02.000Z",
  "organizationId": "…",
  "data": {
    "projectId": "…",
    "cardId": 318,
    "ruleId": "r-…",
    "caseId": "INV-1024",
    "title": "Invoice INV-1024 is overdue",
    "choice": "o1",
    "choiceLabel": "Paid",
    "decidedBy": "ana@example.com"
  }
}

Check the signature

x-duaer-signature reads t=<timestamp>,v1=<signature>: the HMAC-SHA256 of “timestamp.raw body” with the subscription’s secret.

// Node.js: check the x-duaer-signature header with the subscription's secret.
import { createHmac, timingSafeEqual } from 'node:crypto';

function verified(secret, rawBody, header) {
  const t = /(?:^|,)t=(\d+)/.exec(header)?.[1];
  const v1 = /(?:^|,)v1=([0-9a-f]{64})/.exec(header)?.[1];
  if (!t || !v1) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(v1, 'hex');
  return given.length === expected.length && timingSafeEqual(given, expected);
}

Retries, pausing and sending again

• A receiver that answers other than 2xx, or cannot be reached, is tried again after 1, 5, 30 and 120 minutes, 5 tries in all; then the delivery is failed.
• Events while paused wait and go in order on resume; past the day’s limit, they wait for the next UTC day.
• Deliveries are kept 30 days. Send failed again, or Send again from this number. A retried event may arrive after later ones: order by x-duaer-sequence.
• Creating, changing, deleting and sending again are in the audit log, never the secret.

Read with Power BI or Excel (OData)

1. Copy the OData address (…/v1/odata) in Settings › API.
2. Power BI: Get data › OData feed; Excel: Data › Get Data › From OData Feed. Paste the address.
3. Choose Basic authentication: any user name, your API key as the password.
4. The tables are Cases, CaseSteps, Metrics and MetricMonths, with only what the key’s person sees on the employee portal: up to 50,000 cases, 1,000 rows a page.
5. Filter and sort in Power Query after reading: the feed does not support $filter or $orderby.

GET <DUAER_HOST>/v1/odata/Cases?$top=100&$count=true
Authorization: Basic base64("any:<your-api-key>")

The process API

• GET /v1/process/metrics: the metrics the person sees, each with a one-sentence meaning, its description, unit, value, latest month and target.
• POST /v1/process/sources/{id}/refresh: reads the source now, as Run now does, and answers 202. Only owners’ and admins’ keys may.
• Send the key in Authorization: Bearer or the X-DUAER-API-KEY header.