SendFlo

Zapier, Make and n8n

Start a workflow when files arrive, and request files or send them from the steps of one. SendFlo's apps for Zapier, Make and n8n are part of Pro, Team Pro and Team Enterprise. Steps pass links and ids, never the files: SendFlo keeps them, scanned and tracked.

Triggers

  • File received: inbox_item.ready — someone uploaded a file to you and it was scanned clean
  • Secure intake ready: intake.ready — what arrived (type, size, scan), never the files
  • Link downloaded: link.downloaded
  • Send completed: transfer.completed — a send finished uploading and its links are ready
  • File request closed: file_request.closed — it got what it asked for, or was cancelled

Each trigger adds a webhook endpoint marked with its app on your Webhooks page and removes it when you turn the automation off. Its secret stays with the app, so it can't be rotated there: turn the automation off and on to get a new one. Zapier and n8n check every delivery's signature.

Actions

  • Request files: POST /v1/file-requests
  • Open a secure intake: POST /v1/intakes
  • Send a file from a link: POST /v1/links/from-url
  • Revoke a send: POST /v1/links/{id}/transfer/revoke
  • Hand intake files to a teammate: POST /v1/intakes/{id}/handoff

Make adds Make an API call for anything else in the API reference. In n8n the action node works as an AI agent's tool too.

Signing in

Zapier signs in with your SendFlo account (OAuth, the consent page shows what it may do). Make and n8n use an API key from Settings → Developer. Give it the scopes the workflow needs: webhooks.read and webhooks.write for triggers, file_requests.write for requests and intakes, transfers.write and links.write to send from a link or revoke a send.

Send a file from a link

curl https://api.sendflo.app/v1/links/from-url \
  -H "Authorization: Bearer $SENDFLO_API_KEY" -H "Content-Type: application/json" \
  -d '{ "url": "https://files.example.com/contract.pdf", "note": "As discussed" }'

SendFlo fetches the file at a public https address, stores it in your workspace and answers with a share link, as POST /v1/links does. The address is checked before anything is fetched: never a private or local network, no redirects, up to 100 MB in 60 seconds. The name defaults to the address's last part.