fix(attio): automatic webhook lifecycle management and tool fixes

[waleedlatif1]

Summary

• Auto-create Attio webhooks on deploy and delete on undeploy via Attio API
• Replace manual webhook setup (URL copy-paste, signing secret) with OAuth credential flow
• Add HMAC-SHA256 signature verification for incoming Attio webhooks
• Fix various Attio tool issues: wand prompts, null param handling, pagination, placeholder text, API slug auto-generation, required field defaults

Type of Change

• Bug fix
• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Feb 25, 2026 1:28am

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[greptile-apps]

Greptile Summary

This PR replaces the manual Attio webhook setup flow (copy-paste URL + signing secret) with automatic webhook lifecycle management via the Attio API. Webhooks are created on deploy and deleted on undeploy using OAuth credentials, with HMAC-SHA256 signature verification for incoming requests.

• Automatic webhook lifecycle: createAttioWebhookSubscription and deleteAttioWebhook functions handle creation/deletion via Attio's v2 API, following established patterns from Airtable, Calendly, and Webflow providers
• Signature verification: New validateAttioSignature function in utils.server.ts uses HMAC-SHA256 with timing-safe comparison, integrated into processor.ts
• Trigger simplification: All 17 Attio trigger files refactored from buildTriggerSubBlocks + manual setup instructions to buildAttioTriggerSubBlocks with OAuth credential input, reducing boilerplate
• Tool fixes: !== undefined replaced with != null across 8 tool files to properly handle null values from JSON parsing; JSON input fields changed from long-input to code type; pagination offset parameter added; create_list now always sends api_slug (auto-generated from name); update_webhook makes targetUrl and subscriptions required
• TRIGGER_EVENT_MAP exported: Now used by provider-subscriptions.ts to map trigger IDs to Attio event types during webhook creation

Confidence Score: 4/5

• This PR is safe to merge — it follows established provider patterns, has proper error handling, and uses timing-safe signature verification.
• Score of 4 reflects that the changes are well-structured and follow existing patterns (Airtable, Calendly, Webflow), with proper OAuth credential flow, HMAC verification, and graceful error handling. The null-check fixes are correct improvements. Minor deduction for no automated tests and the silent signature bypass when Attio doesn't return a secret.
• apps/sim/lib/webhooks/provider-subscriptions.ts contains the core webhook lifecycle logic and should be reviewed most carefully. apps/sim/lib/webhooks/processor.ts handles the signature verification path.

Important Files Changed

Filename	Overview
apps/sim/lib/webhooks/provider-subscriptions.ts	Adds Attio webhook creation/deletion lifecycle functions and integrates them into the external subscription management flow. Well-structured, follows existing patterns for other providers.
apps/sim/lib/webhooks/processor.ts	Adds HMAC-SHA256 signature verification for Attio webhooks, following the same pattern as Linear, Circleback, and other providers.
apps/sim/lib/webhooks/utils.server.ts	Adds validateAttioSignature function using HMAC-SHA256 with timing-safe comparison via safeCompare. Follows existing validation patterns.
apps/sim/triggers/attio/utils.ts	Replaces manual webhook setup (URL copy-paste + secret input) with OAuth credential flow and auto-managed webhooks. Exports TRIGGER_EVENT_MAP for use by provider-subscriptions. attioSetupInstructions is now exported but only used internally.
apps/sim/triggers/attio/webhook.ts	Simplified to use buildAttioTriggerSubBlocks directly without dropdown (generic webhook catches all events). SubBlocks rely on selectedTriggerId condition which is infrastructure-managed.
apps/sim/triggers/attio/record_created.ts	Primary trigger now defines the dropdown inline and uses buildAttioTriggerSubBlocks for OAuth fields. Clean refactor from buildTriggerSubBlocks pattern.
apps/sim/blocks/blocks/attio.ts	Multiple UI improvements: long-input to code type for JSON fields, improved wand prompts, pagination offset support, placeholder text cleanup, and more accurate Attio attribute format examples.
apps/sim/tools/attio/create_list.ts	Always sends api_slug (auto-generated from name if not provided), workspace_access defaults to null, workspace_member_access defaults to empty array. Ensures required fields are always sent.
apps/sim/tools/attio/create_list_entry.ts	Restructured to always send entry_values (defaults to empty object), fixing potential API issues when the field was omitted.
apps/sim/tools/attio/update_webhook.ts	Makes targetUrl and subscriptions required fields (previously optional). Always sends both fields in the request body rather than conditionally including them.
apps/docs/content/docs/en/tools/attio.mdx	Documentation updated to reflect targetUrl and subscriptions being required fields for update_webhook, matching the tool definition changes.

Sequence Diagram

sequenceDiagram
participant User
participant Sim as Sim Platform
participant Attio as Attio API
Note over User, Attio: Deploy Workflow (Webhook Creation)
User->>Sim: Deploy workflow with Attio trigger
Sim->>Sim: Resolve OAuth credentials (credentialId)
Sim->>Sim: Refresh access token if needed
Sim->>Sim: Map triggerId → event types via TRIGGER_EVENT_MAP
Sim->>Attio: POST /v2/webhooks (target_url, subscriptions)
Attio-->>Sim: {webhook_id, secret}
Sim->>Sim: Store externalId + webhookSecret in providerConfig
Note over User, Attio: Incoming Webhook Event
Attio->>Sim: POST /api/webhooks/trigger/{path} + Attio-Signature header
Sim->>Sim: Retrieve webhookSecret from providerConfig
Sim->>Sim: HMAC-SHA256 verify (secret, signature, body)
alt Valid signature
Sim->>Sim: Process webhook event → trigger workflow
else Invalid signature
Sim-->>Attio: 401 Unauthorized
end
Note over User, Attio: Undeploy Workflow (Webhook Deletion)
User->>Sim: Undeploy workflow
Sim->>Sim: Resolve OAuth credentials
Sim->>Attio: DELETE /v2/webhooks/{externalId}
Attio-->>Sim: 200 OK

Loading

_{Last reviewed commit: 1df1933}

[greptile-apps]

_{37 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Silent signature bypass on empty secret

When Attio doesn't return a secret, this stores '' (empty string). Downstream in processor.ts:604, if (secret) evaluates to false for empty string, which silently skips all signature verification for that webhook. While this is consistent with how other providers handle it and there's a warning log during creation, it's worth noting this means an Attio webhook could operate without any request authentication if the API doesn't return a secret.

Consider logging a warning in the verification path as well (in processor.ts) when webhookSecret is present but empty, to make debugging easier if unauthenticated requests come through.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Offset field missing search_records operation condition

Medium Severity

The new offset sub-block's condition.value array omits search_records, while the limit sub-block includes it. The Attio search records API supports offset-based pagination, so users won't be able to paginate search results using offset, creating an inconsistency between the two pagination controls.

Additional Locations (1)

• apps/sim/blocks/blocks/attio.ts#L913-L931

[cursor]

Webhook creation throws instead of returning undefined on failure

High Severity

createAttioWebhookSubscription declares a return type of Promise<... | undefined> and the caller in handleExternalWebhookSubscriptions checks if (result) expecting undefined on failure. However, every error path in the function throws, and the catch block re-throws with throw error. Since handleExternalWebhookSubscriptions has no try/catch around the Attio call, the exception propagates unhandled — potentially crashing the deploy endpoint instead of gracefully skipping webhook creation like other providers do.

Additional Locations (1)

• apps/sim/lib/webhooks/provider-subscriptions.ts#L1881-L1891