defineLogicFunction
Define logic functions and their triggers
defineLogicFunction
Define logic functions and their triggers
Each function file uses Available trigger types:The
In your handler, access the forwarded headers like this:For security reasons, response headers are restricted to an allow-list. Any header that is not on the list (e.g. The function is reachable at:Both identifiers are the
The resolved value must be a valid workspace UUID and your app must be installed in that workspace, otherwise the request is rejected before the function runs.Most providers sign with HMAC-SHA256; the parts that differ are the header name, the digest encoding, and the signed-payload string. A few examples:
The payload includes:
For soft deletes, Created event example:Updated event example:Trigger only on email updates:Destroyed event example:Key points:To declare your parameters once and serve both surfaces, define a single JSON Schema (
defineLogicFunction() to export a configuration with a handler and optional triggers.src/logic-functions/createPostCard.logic-function.ts
- httpRoute: Exposes your function on an HTTP path and method under the
/s/endpoint:
e.g.path: '/post-card/create'is callable athttps://your-twenty-server.com/s/post-card/create
To invoke a route-triggered logic function from a (headless) front component, see Calling a logic function.
- cron: Runs your function on a schedule using a CRON expression.
- databaseEvent: Runs on workspace object lifecycle events. When the event operation is
updated, specific fields to listen to can be specified in theupdatedFieldsarray. If left undefined or empty, any update will trigger the function.
e.g.person.updated,*.created,company.*
- serverWebhook: Receives inbound webhooks from a third-party service (Stripe, GitHub, Svix, …) at a single registration-scoped endpoint and resolves the target workspace from the payload. See Server webhook trigger.
You can also manually execute a function using the CLI:You can watch logs with:
Route trigger payload
When a route trigger invokes your logic function, it receives aRoutePayload object that follows the
AWS HTTP API v2 format.
Import the RoutePayload type from twenty-sdk/logic-function:RoutePayload type has the following structure:| Property | Type | Description | Example |
|---|---|---|---|
headers | Record<string, string | undefined> | HTTP headers (only those listed in forwardedRequestHeaders) | see section below |
queryStringParameters | Record<string, string | undefined> | Query string parameters (multiple values joined with commas) | /users?ids=1&ids=2&ids=3&name=Alice -> { ids: '1,2,3', name: 'Alice' } |
pathParameters | Record<string, string | undefined> | Path parameters extracted from the route pattern | /users/:id, /users/123 -> { id: '123' } |
body | object | null | Parsed request body (JSON) | { id: 1 } -> { id: 1 } |
rawBody | string | undefined | Original UTF-8 request body, before JSON parsing. Useful for verifying HMAC-style webhook signatures (e.g. GitHub’s X-Hub-Signature-256, Stripe). undefined when the runtime did not preserve it. | |
isBase64Encoded | boolean | Whether the body is base64 encoded | |
requestContext.http.method | string | HTTP method (GET, POST, PUT, PATCH, DELETE) | |
requestContext.http.path | string | Raw request path |
forwardedRequestHeaders
By default, HTTP headers from incoming requests are not passed to your logic function for security reasons. To access specific headers, list them in theforwardedRequestHeaders array:Header names are normalized to lowercase. Access them using lowercase keys (e.g.,
event.headers['content-type']).Custom HTTP response
By default, returning a plain value from your handler sends it back as a200 response (JSON for objects, text/plain for strings). To control the status code and response headers, return a Response from twenty-sdk/logic-function:Set-Cookie, CORS headers such as Access-Control-Allow-Origin, or custom X-* headers) is silently dropped before the response is sent. The allowed response headers are:content-typecontent-languagecontent-dispositioncache-controlretry-after
The status code must be a valid HTTP status code (between 100 and 599). Response header names are matched case-insensitively.
Server webhook trigger
httpRouteTriggerSettings exposes a function under /s/ and resolves the workspace from the request host — which works when each workspace has its own domain. Third-party providers, however, deliver every tenant’s events to one webhook URL. For that case, use serverWebhookTriggerSettings: the function is reachable at a registration-scoped endpoint and the workspace is resolved from the payload.src/logic-functions/handle-provider-webhook.logic-function.ts
universalIdentifiers from your manifest — the application registration’s and this logic function’s. Register that URL with the provider.Workspace resolution. Because one endpoint serves every workspace, your integration must put the target workspaceId somewhere in the delivery, and workspaceIdResolver.{ source, path } tells the platform where to read it:| Field | Values | Notes |
|---|---|---|
source | body | query | header | body reads the parsed JSON. query is the most universal — you usually control the callback URL you register, so append ?twentyWorkspaceId=…. |
path | dot-path, e.g. metadata.twentyWorkspaceId | Restricted to alphanumeric / _ / - segments; prototype keys are rejected. |
| Provider | Headers to forward | Signed string | Digest |
|---|---|---|---|
| Svix (Recall, Resend, Clerk) | webhook-id, webhook-timestamp, webhook-signature | {id}.{timestamp}.{rawBody} | base64 (secret is base64 after stripping whsec_) |
| Stripe | stripe-signature | {timestamp}.{rawBody} | hex |
| GitHub | x-hub-signature-256 | {rawBody} | hex (prefixed sha256=) |
| Shopify | x-shopify-hmac-sha256 | {rawBody} | base64 |
| Slack | x-slack-signature, x-slack-request-timestamp | v0:{timestamp}:{rawBody} | hex (prefixed v0=) |
The function runs synchronously and your returned value becomes the HTTP response, so providers see your status code and can retry on non-2xx. Keep handlers fast — some providers (e.g. Slack) time out in a few seconds. Because the function runs before the signature is checked, protect this endpoint with rate limiting at your edge.
Database event trigger payload
When a database event trigger invokes your logic function, it receives oneDatabaseEventPayload per changed record. The payload combines metadata about the source workspace and object with the record-level event.| Property | Description |
|---|---|
name | Event name, such as person.updated. |
workspaceId | Workspace where the event happened. |
objectMetadata | Metadata for the object that changed. |
recordId | Id of the changed record. |
userId, userWorkspaceId, workspaceMemberId | Actor fields when the event was caused by a workspace user. |
properties | Record data for the event, with before, after, diff, and updatedFields depending on the operation. |
| Event | Record data |
|---|---|
person.created | event.properties.after |
person.updated | event.properties.before, event.properties.after, event.properties.diff, event.properties.updatedFields |
person.destroyed | event.properties.before |
.deleted follows the update-style shape because the record’s deletedAt field changes.
For permanent deletes, use .destroyed.databaseEventTriggerSettings.updatedFields filters which update events trigger the function.
event.properties.updatedFields tells you which fields actually changed on the current event.Exposing a function as an AI tool or workflow action
Logic functions can be exposed on two surfaces, each with its own trigger:toolTriggerSettings— makes the function discoverable by Twenty’s AI features (chat, MCP, function calling). Uses standard JSON Schema, the format LLMs natively understand.workflowActionTriggerSettings— makes the function appear as a step in the visual workflow builder. Uses Twenty’s richInputSchemaso the builder can render proper field editors, variable pickers, and labels.
cronTriggerSettings, databaseEventTriggerSettings, and httpRouteTriggerSettings — same pattern, same shape.src/logic-functions/enrich-company.logic-function.ts
- A function can mix surfaces — declare both
toolTriggerSettingsandworkflowActionTriggerSettingsto expose it in chat AND in the workflow builder. toolTriggerSettings.inputSchemaandworkflowActionTriggerSettings.inputSchemaare both optional. When omitted, the manifest builder infers them from the handler source code (JSON Schema for the AI tool, Twenty’sInputSchemafor the workflow action). Provide one explicitly when you want richer typing — for example, withFieldMetadataType-aware fields likeCURRENCYorRELATIONfor the workflow builder, or withdescriptionfields the AI agent can read:
InputJsonSchema) and convert it for the workflow action with jsonSchemaToInputSchema from twenty-sdk/logic-function. toolTriggerSettings.inputSchema takes the JSON Schema directly, while workflowActionTriggerSettings.inputSchema expects Twenty’s InputSchema:Write a good
description. AI agents rely on the function’s description field to decide when to use the tool. Be specific about what the tool does and when it should be called.Runtime helpers.
twenty-sdk/utils re-exports small runtime helpers so handlers never import from twenty-shared directly. For example, isDefined(value) returns false for both null and undefined — use it to safely narrow optional handler inputs, which can arrive as null at runtime even when typed T | undefined:Install hooks — pre-install and post-install handlers — share this runtime but are declared with their own define functions and don’t take trigger settings. See Install Hooks for
definePreInstallLogicFunction and definePostInstallLogicFunction.Typed API clients (twenty-client-sdk)
Thetwenty-client-sdk package provides two typed GraphQL clients for interacting with the Twenty API from your logic functions and front components.
| Client | Import | Endpoint | Generated? |
|---|---|---|---|
CoreApiClient | twenty-client-sdk/core | /graphql — workspace data (records, objects) | Yes, at dev/build time |
MetadataApiClient | twenty-client-sdk/metadata | /metadata — workspace config, file uploads | No, ships pre-built |
CoreApiClient
Query and mutate workspace data (records, objects)
CoreApiClient
Query and mutate workspace data (records, objects)
CoreApiClient is the main client for querying and mutating workspace data. It is generated from your workspace schema during yarn twenty dev or yarn twenty dev:build, so it is fully typed to match your objects and fields.true to include a field, use __args for arguments, and nest objects for relations. You get full autocompletion and type checking based on your workspace schema.CoreApiClient is generated at dev/build time. If you use it without running
yarn twenty dev or yarn twenty dev:build first, it throws an error. The generation happens automatically — the CLI introspects your workspace’s GraphQL schema and generates a typed client using @genql/cli.Using CoreSchema for type annotations
CoreSchema provides TypeScript types matching your workspace objects — useful for typing component state or function parameters:MetadataApiClient
Workspace config, applications, and file uploads
MetadataApiClient
Workspace config, applications, and file uploads
MetadataApiClient ships pre-built with the SDK (no generation required). It queries the /metadata endpoint for workspace configuration, applications, and file uploads.Uploading files
MetadataApiClient includes an uploadFile method for attaching files to file-type fields:| Parameter | Type | Description |
|---|---|---|
fileBuffer | Buffer | The raw file contents |
filename | string | The name of the file (used for storage and display) |
contentType | string | MIME type (defaults to application/octet-stream if omitted) |
fieldMetadataUniversalIdentifier | string | The universalIdentifier of the file-type field on your object |
- Uses the field’s
universalIdentifier(not its workspace-specific ID), so your upload code works across any workspace where your app is installed. - The returned
urlis a signed URL you can use to access the uploaded file.
When your code runs on Twenty (logic functions or front components), the platform injects credentials as environment variables:
TWENTY_API_URL— Base URL of the Twenty APITWENTY_APP_ACCESS_TOKEN— Short-lived key scoped to your application’s default function role
process.env automatically. The API key’s permissions are determined by the role declared with defineApplicationRole() (or referenced via defaultRoleUniversalIdentifier in application-config.ts).