BPM webhooks¶
BPM calls DMS through the /bpm endpoints. These endpoints are exempt from CSRF
and use an HMAC signature instead of a browser session.
Signature¶
BPM sends:
X-BPM-Signature: t=<unix_timestamp>,v1=<hmac_sha256_hex>
The HMAC uses the shared BPM_API_KEY and a time window of about five minutes.
Requests outside the window are rejected.
Endpoints¶
| Endpoint | Purpose |
|---|---|
POST /bpm/ingest |
Ingest one case document |
POST /bpm/bulk-ingest |
Ingest a batch of case documents |
POST /bpm/delete |
Delete a case's documents |
POST /bpm/reclassify |
Update type, group, repository, path, or metadata |
PUT /bpm/refresh-case/{app_number} |
Refresh a case's documents |
PUT /bpm/sync-case-metadata |
Sync case metadata |
POST /bpm/sync-error |
Notify superadmins about a failed sync |
POST /bpm/attachments/discard |
Discard orphan attachments |
DMS stores the case as luranaBPM-{APP_NUMBER} and keeps the BPM APP_UID as the
process reference.
Protect the webhook namespace
The BPM webhook namespace must not be exposed to untrusted clients. Keep the shared key secret, use TLS, and restrict access at the gateway. Some legacy BPM import endpoints are internal and are not part of this guide.