Ship AI Act controls in 60 seconds

Incoming webhook

POST <SLACK_WEBHOOK_URL>
content-type: application/json

{
  "text": "[Spurvik Art. 14 Gate] stripe.refunds.create: Refund €240 on order #4821 (gate=gate_7f3a, hmac=bec31a723e52)",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*[Spurvik Art. 14 Gate] stripe.refunds.create*\nRefund €240 on order #4821\n`gate=gate_7f3a` · `hmac=bec31a723e52`"
      }
    },
    {
      "type": "actions",
      "elements": [
        {
          "type": "button",
          "text": {
            "type": "plain_text",
            "text": "Approve Action"
          },
          "style": "primary",
          "url": "https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e",
          "action_id": "spurvik_approve_gate_7f3a"
        },
        {
          "type": "button",
          "text": {
            "type": "plain_text",
            "text": "Block Agent"
          },
          "style": "danger",
          "url": "https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208",
          "action_id": "spurvik_reject_gate_7f3a"
        }
      ]
    }
  ]
}

Bot API sendMessage

POST https://api.telegram.org/bot<BOT_TOKEN>/sendMessage
content-type: application/json

{
  "chat_id": "<CHAT_ID>",
  "text": "[Spurvik Art. 14 Gate] stripe.refunds.create\nRefund €240 on order #4821\ngate=gate_7f3a · hmac=bec31a723e52",
  "reply_markup": {
    "inline_keyboard": [
      [
        {
          "text": "Approve Action",
          "url": "https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e"
        },
        {
          "text": "Block Agent",
          "url": "https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208"
        }
      ]
    ]
  }
}

Resend API

POST https://api.resend.com/emails
authorization: Bearer <RESEND_API_KEY>
content-type: application/json

{
  "from": "<FROM_ADDRESS>",
  "to": [
    "<REVIEWER_ADDRESS>"
  ],
  "subject": "[Spurvik Art. 14 Gate] stripe.refunds.create — Human approval required",
  "text": "[Spurvik Art. 14 Gate] stripe.refunds.create\n\nRefund €240 on order #4821\nGate ID: gate_7f3a\nHMAC-SHA256: bec31a72…b930\n\nApprove: https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e\nBlock: https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208",
  "html": "<div style=\"font-family:sans-serif;background:#05080F;color:#F8FAFC;padding:24px;border-radius:12px;\">\n  <h2 style=\"margin:0 0 8px;color:#10B981;\">[Spurvik Art. 14 Gate] stripe.refunds.create</h2>\n  <p style=\"margin:0 0 16px;color:#CBD5E1;\">Refund €240 on order #4821</p>\n  <p style=\"font-family:monospace;font-size:12px;color:#94A3B8;\">gate=gate_7f3a · hmac=bec31a723e52</p>\n  <div style=\"margin-top:20px;\">\n    <a href=\"https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&amp;ts=1762250400&amp;hmac=bec31a72…b930&amp;nonce=bde29b74…f032&amp;decision=approved&amp;sig=f1071099…fe5e\" style=\"background:#10B981;color:#05080F;padding:10px 18px;border-radius:8px;text-decoration:none;font-weight:600;margin-right:12px;\">Approve Action</a>\n    <a href=\"https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&amp;ts=1762250400&amp;hmac=bec31a72…b930&amp;nonce=bde29b74…f032&amp;decision=rejected&amp;sig=13893a60…a208\" style=\"background:#EF4444;color:#FFFFFF;padding:10px 18px;border-radius:8px;text-decoration:none;font-weight:600;\">Block Agent</a>\n  </div>\n</div>"
}

Channel webhook

POST <DISCORD_WEBHOOK_URL>
content-type: application/json

{
  "content": "**[Spurvik Art. 14 Gate] stripe.refunds.create**\nRefund €240 on order #4821\n`gate=gate_7f3a` · `hmac=bec31a723e52`\nApprove: <https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e> | Block: <https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208>"
}

Incoming webhook, Adaptive Card 1.4

POST <TEAMS_WEBHOOK_URL>
content-type: application/json

{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "content": {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.4",
        "body": [
          {
            "type": "TextBlock",
            "text": "[Spurvik Art. 14 Gate] stripe.refunds.create",
            "weight": "Bolder",
            "size": "Medium"
          },
          {
            "type": "TextBlock",
            "text": "Refund €240 on order #4821",
            "wrap": true
          },
          {
            "type": "TextBlock",
            "text": "gate=gate_7f3a · hmac=bec31a723e52",
            "isSubtle": true,
            "wrap": true
          }
        ],
        "actions": [
          {
            "type": "Action.OpenUrl",
            "title": "Approve Action",
            "url": "https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e"
          },
          {
            "type": "Action.OpenUrl",
            "title": "Block Agent",
            "url": "https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208"
          }
        ]
      }
    }
  ]
}

GraphQL issueCreate

POST https://api.linear.app/graphql
authorization: <LINEAR_API_KEY>
content-type: application/json

{
  "query": "mutation SpurvikCreateHitlIssue($input: IssueCreateInput!) { issueCreate(input: $input) { success issue { id identifier url } } }",
  "variables": {
    "input": {
      "teamId": "<TEAM_ID>",
      "title": "[Spurvik Art. 14 Gate] stripe.refunds.create",
      "description": "Refund €240 on order #4821\n\n- **Gate ID**: `gate_7f3a`\n- **Art. 12 HMAC-SHA256**: `bec31a72…b930`\n- [Approve Action](https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e)\n- [Block Agent](https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208)"
    }
  }
}

REST API v3 issue

POST https://<your-site>.atlassian.net/rest/api/3/issue
authorization: Basic <base64(EMAIL:API_TOKEN)>
content-type: application/json

{
  "fields": {
    "project": {
      "key": "<PROJECT_KEY>"
    },
    "summary": "[Spurvik Art. 14 Gate] stripe.refunds.create",
    "issuetype": {
      "name": "Task"
    },
    "description": {
      "type": "doc",
      "version": 1,
      "content": [
        {
          "type": "paragraph",
          "content": [
            {
              "type": "text",
              "text": "Refund €240 on order #4821 (gate=gate_7f3a, hmac=bec31a723e52)\nApprove: https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e\nBlock: https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208"
            }
          ]
        }
      ]
    }
  }
}

GraphQL create_item. The item carries the gate ID, not the Approve/Block links.

POST https://api.monday.com/v2
authorization: <MONDAY_API_TOKEN>
content-type: application/json

{
  "query": "mutation ($boardId: ID!, $groupId: String, $itemName: String!) { create_item (board_id: $boardId, group_id: $groupId, item_name: $itemName) { id } }",
  "variables": {
    "boardId": "<BOARD_ID>",
    "groupId": "<GROUP_ID>",
    "itemName": "[Spurvik Art. 14 Gate] stripe.refunds.create — Refund €240 on order #4821 [gate=gate_7f3a]"
  }
}

REST tasks

POST https://app.asana.com/api/1.0/tasks
authorization: Bearer <ASANA_ACCESS_TOKEN>
content-type: application/json

{
  "data": {
    "name": "[Spurvik Art. 14 Gate] stripe.refunds.create",
    "projects": [
      "<PROJECT_GID>"
    ],
    "notes": "Refund €240 on order #4821\n\nGate ID: gate_7f3a\nHMAC-SHA256: bec31a72…b930\nApprove: https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=approved&sig=f1071099…fe5e\nBlock: https://your-app.example/api/spurvik/callback?gateId=gate_7f3a&ts=1762250400&hmac=bec31a72…b930&nonce=bde29b74…f032&decision=rejected&sig=13893a60…a208"
  }
}

n8n-nodes-spurvik 1.0.4 is on npm as a community node. It can add an AI interaction notice, record an HMAC SHA256 digest instead of the raw prompt text, and send an approval request. Prompt field names and the configured input field are not copied onto the node output. The HTTP Request path below remains an alternative.

// 1. Your service sends the request (spurvik-sdk@1.0.8 or spurvik@1.0.8)
import { createMultiChannelApprovalRouter } from "spurvik-sdk/channels"; // or "spurvik/channels"
const router = createMultiChannelApprovalRouter({ signingSecret, channels });
await router.requestApproval({
  gateId, actionName, summary,
  callbackBaseUrl: "https://<your-n8n-host>/webhook/spurvik-gate",
});

// 2. n8n Webhook node receives the Approve / Block link:
GET /webhook/spurvik-gate?gateId=…&ts=…&hmac=…&nonce=…&decision=approved&sig=…

// 3. n8n HTTP Request node posts it back to your service:
POST https://<your-service>/spurvik/verify
content-type: application/json

{
  "gateId": "{{$json.query.gateId}}",
  "actionHmac": "{{$json.query.hmac}}",
  "decision": "{{$json.query.decision}}",
  "issuedAtUnix": {{$json.query.ts}},
  "nonce": "{{$json.query.nonce}}",
  "signature": "{{$json.query.sig}}"
}

// 4. Your service answers with router.verifyCallback(body)
//    (or verifyChannelApprovalToken), and the workflow continues only on true.

Blueprint: custom webhook, then HTTP

Source: github.com/spurvik/spurvik, packages/n8n-nodes-spurvik/make-com-blueprint.json
Import it in Make.com as a scenario blueprint. "flow":
  1. gateway:CustomWebHook   "Incoming AI Agent Action or Chat Turn"
  2. http:ActionSendData     POST https://console.spurvik.com/api/v1/hitl
                             authorization: Bearer {{var.organization.spurvikApiKey}}

The token is stored as plain text in the Make.com scenario. The organization variable is available on Make.com Pro, Team and Enterprise; if organization custom variables are unavailable, the fallback is {{var.input.spurvikApiKey}}