Send a notification is the step that tells people something happened. It can ring your team’s bell in ILLUMA, send an email, post signed JSON to a system you run, or post a card to a Microsoft Teams channel. This page covers each one, its settings and its limits.
Add it under Then with + Add step → Action → Send a notification, then pick a Channel: In-app (the bell), Email or Webhook. A new step starts as In-app to Owners and admins. The settings below change with the channel.
The text of the notification goes in the Message box. A flow written by hand with message: instead of body: is refused when you save it, because that text would never be sent.
ℹ️ Note: In Shadow, nothing is sent on any channel. The run records the step as shadow so you can check it first.
In-app (the bell)
| Setting | What to enter |
|---|---|
| Send to (required) | Owners and admins (the default), Owners only or Everyone on the team. An older flow may show Owners and admins (older setting): it reaches owners and admins too |
| Template | A saved template, or leave it blank and fill in Title and Message |
| Severity | Info, Warning or Critical |
| Title, Message | What the bell shows. Use + Field to add values such as the order number |
| Link | A dashboard path the notification opens when clicked |
ℹ️ Note: An in-app step needs a Send to and a Message (or a saved Template). A step missing either can’t be saved, because the bell would ring for nobody or show nothing to read.
| Setting | What to enter |
|---|---|
| Email your contact address | Yes sends to the contact email in your site settings |
| Email these addresses | Addresses typed in, comma-separated, up to 10. They must be typed: fields ({{ }}) are not allowed here |
| Email the address in this field | One field of the event that started the flow, for example a customer email. Skipped for marketplace orders |
| Template | A saved email template, or leave it blank and fill in Title (the subject) and Message |
| Title, Message | The subject and body when no email template is used |
Emails go out through your email settings. A few rules apply every time:
- Marketplace buyers are never emailed. An address taken from a marketplace order’s field is dropped, and any Amazon, eBay or Walmart relay address is dropped wherever it came from. A step whose only addresses were dropped this way completes without sending.
- Bad addresses are skipped. Anything that is not a plain email address is left out. If no usable address is left, the step fails.
- At most 10 addresses per step, counting all three sources together, after duplicates are removed.
- No double sends. Each address gets the email at most once per run and step, even if the step is retried.
- If Template names something that is not an email template, ILLUMA sends its standard message instead, using your Title and Message. To email an address taken from the event this way, fill in a Message.
Webhook
| Setting | What to enter |
|---|---|
| Webhook URL | Must start with https://. Fields ({{ }}) are not allowed in the address |
| Format | ILLUMA (signed JSON) for your own systems (also used when left blank), or Microsoft Teams |
| Webhook fields | A JSON object listing exactly what to send, for example {"order": "{{ trigger.payload.order_number }}"}. Nothing else from the run is sent |
| Title, Message, Severity, Link | Sent alongside the fields. A webhook step needs at least a Title, a Message or Webhook fields |
ILLUMA (signed JSON)
ILLUMA sends a POST with a JSON body:
{
"notification_id": "…",
"event": "flow.webhook",
"org_slug": "…",
"type": "flow.webhook",
"severity": "…",
"title": "…",
"body": "…",
"link": "…",
"data": { "the": "Webhook fields you listed" }
}
Every request is signed so you can check it came from ILLUMA:
X-Illuma-Timestamp: the time it was sent, in Unix seconds.X-Illuma-Signature:sha256=followed by the hex HMAC-SHA256 of{timestamp}.{raw body}, using your signing secret as the key (use the secret text exactly as shown).X-Illuma-Event:flow.webhook.
To verify, compute the same HMAC over the timestamp, a dot and the raw request body, and compare. Reject requests whose timestamp is too old to stop replays.
Your signing secret is on Notifications → Command Hub: click New notification, choose Webhook as the channel, and copy the Signing secret. You need permission to edit integrations to see it. Keep it private.
📸 Screenshot placeholder: Notifications → Command Hub → New notification with Channel set to Webhook, showing the POST to URL field and the Signing secret box with its Copy button. Blur the secret.
Microsoft Teams
- In Teams, create the webhook. In the channel, add a workflow from the template Post to a channel when a webhook request is received and copy the URL it gives you.
- Paste the URL into Webhook URL and set Format to Microsoft Teams.
- Fill in Title, Message and Webhook fields. Add a Link if you want a button.
ILLUMA posts a card with:
- the Title in bold (up to 200 characters; ILLUMA if blank),
- the Message (up to 4,000 characters),
- each of your Webhook fields as a name and value, sorted by name (up to 20 fields, 500 characters each),
- an Open in ILLUMA button when Link is a dashboard path. Links to any other site are dropped and the card has no button.
If a card would be too big for Teams, fields are dropped from the end and then the message is shortened until it fits. Text that would turn into a link in Teams is escaped.
⚠️ Warning: The Teams URL works like a password: anyone with it can post to your channel. Run history and errors show only the address’s host and a short code, never the full URL. “Sent” means Teams accepted the card; if no card appears, check the workflow in Teams.
Delivery rules for webhooks
- Only
https://addresses are accepted, and addresses on private or internal networks are refused. - ILLUMA waits up to 10 seconds for a reply. It follows up to 3 redirects, and only to other
https://addresses. - Any reply other than a 2xx status is a failure. The step is retried (up to 3 attempts in all); if every attempt fails, the run fails and your owners and admins get a Flow Failed bell.
- A webhook that was delivered is not sent again for the same run and step.
Sending limits
To stop a looping flow from flooding inboxes or systems, flows on each account share these limits:
| Channel | Per hour | Per day |
|---|---|---|
| Email (each address counts) | 100 | 500 |
| Webhook | 1,000 | 5,000 |
When a limit is reached, the step fails without sending, and your owners and admins get one bell alert per hour, Flow emails paused: limit reached (or Flow webhooks paused). Sending resumes on its own as the hour or day moves on. Check the flow named in the alert for a loop.
Email the pick ticket has its own extra limits, set under Picking → Printing & settings. See Pick ticket flows.
Next: Flow recipes.