Wyldcards Automation API

Use Wyldcards with Zapier, n8n, Make, Pipedream, Power Automate, or any HTTP client through the authenticated API at /api. It is a HAL API: response data is ordinary JSON, while _links tells a client which URL to use next.

Connect an automation tool

Open this guide from the app: choose Automations & API in the account menu. It is available anywhere you are signed in.

Choose API tokens in the account menu, name a token after the tool that will use it (for example, Zapier), and choose Create token.
Copy the token straight away. It starts with wyld_ and is shown only once.
In the tool, enter your Wyldcards site URL and the token. For a generic HTTP step, send Authorization: Bearer <token> and Accept: application/hal+json, plus Content-Type: application/json for writes.

A token can do anything your account can. Store it in the tool's encrypted credential store, never in a workflow field, request body, or URL. Give each tool its own token so you can revoke one without disconnecting the others. A token that has been revoked, or cleared by a password reset, stops working at once. HTTP Basic Auth with a username and password still works, but a token is safer and is the only option for an account that signs in with a passkey.

Use an account dedicated to automation when practical. It keeps a workflow's access separate from a person's account and can be disabled without disrupting their sign-in.

Zapier

With the Wyldcards app in your Zapier account, choose it as a trigger or action and connect it with your site URL and an API token.

Triggers (instant): New Card, Updated Card, Deleted Card, and New Form Submission, each for a stack you choose.
Actions: Create Card and Update Card. After you choose a stack, each of its fields appears as its own input.
Search: Find Card by a field's value or the card name, with an option to create the card if none is found.

Turning a Zap on registers a webhook with Wyldcards, and turning it off removes that webhook. Choose API tokens in the account menu to see every connected webhook.

n8n

Install the community node: in n8n, open Settings → Community Nodes, choose Install, and enter n8n-nodes-wyldcards. Create a Wyldcards API credential with your site URL and an API token.

The Wyldcards node creates, reads, lists, updates, and deletes cards, and lists stacks and their fields. Choose each field from a list; you don't need to look up part IDs.
The Wyldcards Trigger node starts a workflow when cards in a stack are created, updated, or deleted, or when a public form is submitted. When you activate the workflow, it registers the webhook for you and verifies each delivery's signature.

n8n must be reachable over HTTPS from your Wyldcards site for the trigger to work. Wyldcards won't deliver to localhost or private network addresses, so use n8n Cloud or a public HTTPS tunnel. An HTTP Request node with a Header Auth credential (Authorization = Bearer <token>) works for anything the node doesn't cover.

Make, Power Automate, Pipedream, and custom code

Use their generic HTTP module or action with an Authorization: Bearer <token> header. Set the response type to JSON. Map IDs from the prior response into the next URL, and use a raw JSON body for POST, PATCH, and PUT requests. The standard fetch, Axios, Python requests, Ruby Faraday, and curl clients all work; no SDK or OAuth flow is required. For instant triggers, subscribe a webhook as described under REST hooks.

curl --header "Authorization: Bearer $WYLDCARDS_TOKEN" \
  --header 'Accept: application/hal+json' \
  'https://wyldcards.example/api/stacks'

Common workflow

To add a submission or row to an existing stack:

The shortest route is a single request: POST /api/stacks/{uid}/cards with {"name":"Ada","fields":{"Email":"[email protected]"}}. Every value is validated first; if one is invalid, the answer is 400 and no card is created. GET /api/stacks/{uid}/fields lists the fields a new card gets, with each field's id, name, style, and whether it is required. Date fields accept 2026-09-14 or a full ISO date-time, and checkbox fields accept true/false, yes/no, or 1/0.

To fill in an existing card step by step:

GET /api/stacks and select the stack's uid from _embedded.wyldcards:stacks.
POST /api/stacks/{uid}/cards with {}. Save the returned card id.
GET /api/cards/{id}/parts. Find each field by its stable part id or its name.
Use one PUT /api/cards/{cardId}/fields request to write all values together. Use an exact field name or, preferably, its stable part ID as each key.

A field added to a background appears on every card. Its part ID remains the same, so it is the best value to store in an automation workflow. Before the first write, retrieve the parts from any card in the stack, find the field by its name, and save its id in the workflow configuration. Do not use a card-specific field ID for a background field. The batch request validates every supplied value before saving any of them, which makes it the safest option for AI-generated records. Field validation, including required and unique fields, applies to API writes just as it does in the editor.

POST https://wyldcards.example/api/stacks/STACK_UID/cards
Accept: application/hal+json
Content-Type: application/json

{}

PUT https://wyldcards.example/api/cards/CARD_ID/fields
Accept: application/hal+json
Content-Type: application/json

{"fields":{"PART_ID":"{{$json.customerEmail}}","Company":"{{$json.company}}"}}

For a single field, PUT /api/cards/{cardId}/fields/{partId} with {"text":"value"} remains available. The batch response contains the card's current parts and field text.

REST hooks (instant triggers)

A platform can subscribe its own URL to an event on a stack. Zapier and the n8n node do this for you. To subscribe from other tools, send:

POST /api/hooks
{"event":"card.created","targetUrl":"https://example.com/incoming","stack":"STACK_UID","label":"My tool"}

The events are card.created, card.updated, card.deleted, and public_form.submitted. The 201 response includes the hook's id and a signing secret, which is shown only once. DELETE /api/hooks/{id} unsubscribes, and GET /api/hooks lists your hooks. The target must be an HTTPS URL on the public internet. GET /api/hooks/samples?event=card.created&stack=STACK_UID returns example payloads built from the stack's newest cards.

Each delivery is a POST with the headers X-Wyldcards-Event, X-Wyldcards-Hook, X-Wyldcards-Delivery, and X-Wyldcards-Signature: sha256=<hex>, which is an HMAC-SHA-256 of the raw body keyed by the hook's secret. The card's field text is included by field name:

{
  "id": "5b0c…",
  "event": "card.created",
  "occurredAt": "2026-09-14T10:00:05Z",
  "hookId": 12,
  "stack": {"uid": "...", "name": "Leads"},
  "card": {"id": 42, "uid": "...", "number": 7, "name": "Ada Lovelace",
           "url": "https://wyldcards.example/stack/.../card/7",
           "updatedAt": "2026-09-14T10:00:04Z",
           "fields": {"Email": "[email protected]"}}
}

Deliveries are timed so each change arrives once, complete. A new card is sent about 5 seconds after it is created, so a card that is created and then filled in arrives with its fields. Edits are grouped: an update is sent 10 seconds after typing stops, and never more than a minute after the first change. Deleted cards and form submissions are sent right away. A delivery that fails is retried after 1 minute and again after 10 minutes. A 410 Gone response, or a 404 that persists through the last retry, removes the hook.

Public form webhook

A public form can start a workflow as soon as it receives a response. In the stack's Settings, add an HTTPS endpoint and a signing secret. Wyldcards sends a POST request after the response card commits, so a webhook never runs for a failed submission.

The endpoint must be an HTTPS URL on the public internet. Settings refuses a URL whose host is, or resolves to, a loopback, private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (including 169.254.169.254), carrier-grade NAT (100.64.0.0/10), or IPv6 unique local address. The address is checked again before every delivery, and a request to a host that has since moved onto such a network is skipped. Redirects are not followed, so give the endpoint's final URL. The same rules apply to Automations webhook rules.

The request includes Content-Type: application/json, X-Wyldcards-Event: public_form.submitted, and X-Wyldcards-Signature: sha256=<hex>. Verify the signature as an HMAC-SHA-256 of the raw request body using your signing secret before trusting it.

{
  "event": "public_form.submitted",
  "occurredAt": "2026-09-13T19:00:00Z",
  "stack": {"uid": "...", "name": "Contact form"},
  "card": {"id": 42, "name": ""},
  "values": {"field-15": "Ada Lovelace"}
}

Working with HAL responses

Collections place their items in _embedded. For example, the stack list is in _embedded.wyldcards:stacks and a card's fields are in _embedded.wyldcards:parts. In n8n, use a Split Out node or an expression to select that array before processing each item. Relation keys begin with wyldcards:; use bracket notation when a tool does not accept a colon in a property path.

Prefer the URL in _links over constructing a URL yourself. The API may return an absolute URL, which is ready to use in every supported tool. A successful create returns 201 Created; a field validation error returns 400 with a JSON object keyed by the invalid property. Configure a workflow's error branch to retain that response for troubleshooting.

Other useful requests

POST /api/stacks with {"name":"New stack"} creates a stack.
GET /api/stacks/{uid}/cards lists cards in stack order. Add include=fields for each card's field text by name, and field=Email&[email protected] or name=Ada to find matching cards.
GET /api/cards/{id}?include=fields reads one card with its field text.
PATCH /api/cards/{id} with {"name":"New title"} renames a card.
To retry a create safely, choose the card's uid yourself: POST /api/stacks/{uid}/cards with {"uid":"<lowercase UUID>"}. Sending it again answers 200 with the card already made instead of making a second one. Cards can then be read, changed and deleted at /api/stacks/{uid}/cards/{cardUid}.
GET /api/stacks/{uid}/export downloads a complete JSON backup.
POST /api/stacks/import imports a previously exported stack bundle.
GET /api/search?q=words searches stacks owned by the connected account.

The full relation reference is at API link relations.