Automation

Automation rules act after something happens in Depotex. A rule watches one kind of event (a repository being created, a job failing), optionally checks a condition, and then runs its steps: send an alert, call a webhook in another system, or send an email.

License: Pro or higher to create and change rules; built-in rules run on every license. Permissions: automation:read to view, automation:write to create and change your organization's rules, automation:platform for platform rules. Organization admins can view and write rules; platform rules need a super admin.

Rules never slow down or block the action itself: they run in the background a few seconds later. To stop an action, use a policy instead.

1. Create a rule

This example alerts the platform team whenever someone creates a Docker repository. Every rule is built the same way: an event (When), an optional condition (Only if) and one or more steps (Then).

Screenshot needed

automation-create.gif

Creating a rule: New rule, the event, a condition, an alert step, Try it, then Create rule

1. Open automation — Go to Settings → Automation and select New rule. You need the automation:write permission (organization admins and super admins have it).
2. Name it — Give the rule a Name, such as New Docker repository, and an optional Description. Leave Platform rule off: an organization rule sees your organization's events. A super admin can turn it on to see every organization's events and system events such as failing jobs.
3. Choose the event — Under When, open Choose an event and type to search, then pick depot.repository.create. Fields you can use now lists the event's fields (payload.name, payload.format, payload.space_key, …). The Events page lists every event and its fields.
4. Add a condition — Under Only if, write payload.format == "docker". Click a field chip to insert it. Leave the box empty to run on every event. See Conditions.
5. Add a step — Under Then, select Add alert. Pick a Severity (Info, Warning or Critical), who it goes to under Send to (for example Specific users and their user IDs), a Title such as New repository {{name}} and a Message such as {{name}} ({{format}}) was created in space {{space_key}}. Insert a field adds a field for you. Add webhook calls another system instead; an email step is offered once email is set up.
6. Test it — In Try it, edit the Sample event (for example set format to docker) and select Run test. When the condition matches, it says the steps would run. Nothing is sent.
7. Create it — Keep Rule is on switched on and select Create rule. From now on, each matching event runs the steps a few seconds later; the rule's Runs tab shows each run and any error.

Screenshot needed

automation-new-rule.png

A new rule: When a repository is created, Only if it is a Docker repository, Then send an alert; Try it shows the condition matches

Screenshot needed

automation-alert.png

The alert the rule sent, in the notifications panel

2. Managing rules

Go to Settings → Automation. The list shows each rule with a switch to turn it on or off, its event and condition (When), what it does (Then: alerts, webhooks, emails) and its last run, with the status when that run didn't finish cleanly (Failed · 3 days ago). Click a rule to open it.

Screenshot needed

automation-rules.png

Settings → Automation: the rules with their on/off switch, event and condition, steps and last run

A rule's page has two tabs: Settings (the editor) and Runs.

Screenshot needed

automation-rule.png

A rule's settings: When, Only if and Then, with Try it beside them

• When: choose the event from the list, grouped by area, or type to search it. Events only platform rules can use are shown but can't be picked in an organization rule. Under the event, Fields you can use lists its fields: click one to add it to the condition.
• Only if: an optional condition (see Conditions).
• Then: the steps, run in order. Move a step up or down with its arrows, or remove it. In an alert or email message, Insert a field adds an event field such as {{name}}.
• Try it: check the condition against a sample event before saving. When it matches, it lists the steps that would run.
• Rule is on, Discard and Save changes stay at the bottom of the form while you scroll. Save is available once something changed.
• Runs: each time the rule ran, whether it succeeded, how many steps finished, how many attempts it took, and the error if one failed.
• Switch a rule off (in the list or with Rule is on) instead of deleting it. Delete rule asks first and also deletes its run history; built-in rules can't be deleted.

3. Steps

A rule can have up to 10 steps, run in order. If a step fails (for example the webhook is down), Depotex retries the rule later, starting at the step that failed, so earlier steps aren't repeated.

4. Conditions

Conditions use the same language as policies (CEL). They see the event's result as payload (never passwords or secrets), actor.id and now. Leave the condition empty to run for every event.

payload.format == "docker"                  // only Docker repositories
payload.consecutive_failures >= 5            // on scheduler.job.unhealthy (platform rule)

5. Organization and platform rules

6. Built-in rules

Depotex ships two platform rules: an alert when a scheduled job keeps failing, and one when it recovers. Super admins can change their recipients or wording, or switch them off, under Settings → Automation; they can't be deleted.

7. Webhooks

When you save a rule with a webhook step, Depotex shows its signing secret once. Copy it into the receiving system. Each webhook step then shows A signing secret is set; Rotate secret there replaces it (after you confirm) and shows the new one once.

{
  "id": "1042-7",
  "event": "depot.repository.create",
  "occurredAt": "2026-09-30T12:00:00Z",
  "orgId": 1,
  "actor": "user:12",
  "payload": {"id": 55, "name": "images", "format": "docker"},
  "rule": {"id": 7, "name": "Tell ops about Docker repositories"}
}

8. Webhook headers

A webhook step can send up to 20 extra headers, for example an Authorization header or an API key your receiver checks. Under the step's URL, choose Add header and enter a name and a value.

Screenshot needed

automation-webhook-headers.png

A webhook step with two extra headers; values are hidden as you type

• Values are write-only. They are stored encrypted and never shown again, in the editor, the API or the audit log. A saved value shows Saved (leave empty to keep): leave it empty to keep it, or type a new one to replace it.
• A saved value stays with its receiver. If you change the URL to a different host (or from https to http), every header needs its value again, so a saved credential can't be sent somewhere new.
• Names Depotex sets itself can't be used: Host, Content-Length, Content-Type, Transfer-Encoding, connection headers (Connection, Keep-Alive, Upgrade, TE, Trailer, Proxy-*), Expect and any name starting with Depotex-. Depotex's own headers are always set last, so the signature can't be replaced.
• Names use the characters allowed in HTTP header names (letters, digits and the symbols HTTP allows), up to 100 characters. Values are up to 4096 characters, without line breaks or other control characters. Each name may appear once.

Any response other than 2xx counts as a failure and is retried with increasing delays (up to EVENT_MAX_ATTEMPTS, 8 by default); redirects aren't followed. Check the signature and reject old timestamps in your receiver.

9. Email steps

An email step sends a message to a list of addresses when the rule runs, through the mail server set up under Settings → Email. The step is offered only while email is set up and turned on there; until then the editor explains why it's missing.

Screenshot needed

automation-email-step.png

An email step with two addresses, a subject and a message using event fields

Each address gets its own email, with the rule's name, the event and a link to the rule. All of a step's emails are queued together; they are then sent and retried like every other Depotex email.

10. Loops

A rule's steps can cause new events, for example an alert step raises alert.create. Depotex counts how many rules led to an event and stops after AUTOMATION_MAX_DEPTH (3 by default); the run shows Stopped (loop).

11. Performance

• An event with no rules for its organization costs nothing extra.
• Each matching event writes one run and runs the steps in the background; the action itself isn't slowed down.
• Broad rules on busy events add up. A rule without a condition on a frequent event runs for every one of them, and every webhook call waits up to AUTOMATION_WEBHOOK_TIMEOUT. Keep conditions specific.
• Changes to rules take effect immediately on all servers with Redis, and within AUTOMATION_CACHE_TTL (10 s) without it.

12. API

curl -X POST /api/automation/rules -H "Content-Type: application/json" -d '{
  "name": "Tell ops about Docker repositories",
  "event": "depot.repository.create",
  "condition": "payload.format == \"docker\"",
  "steps": [
    {"type": "alert", "alert": {"severity": "info", "targetType": "user", "targetValue": ["12"], "title": "New Docker repository {{name}}", "message": "Created in your organization."}},
    {"type": "webhook", "webhook": {"url": "https://hooks.example.com/depotex", "headers": [{"name": "Authorization", "value": "Bearer <token>"}]}},
    {"type": "email", "email": {"to": ["ops@example.com"], "subject": "New Docker repository {{name}}", "message": "Created in your organization."}}
  ]
}'

13. Settings