Automations and connections

When someone sends a form on your site, Lentil can pass the details on to your CRM, booking system or any web address that takes JSON, on every message or only the ones that match a rule. This page also covers shared connections, signing, testing and the run history.

How automations work

An automation has three parts: When a form is sent, Only if a condition matches, and Then send an HTTP request. It runs in the background after the message is saved in your Inbox, so your visitor never waits for it.

1. A visitor sends a form on your site, like any other enquiry.
2. Lentil saves it in your Inbox. Spam is filtered out and never sent on.
3. Lentil checks Only if. With no condition, every message qualifies.
4. Your other system gets a POST request with the fields you chose, signed if you set a secret.

Each automation runs at most once per message. An automation only handles messages that arrive after it exists: it does not go back to older ones.

Before you start

• The address your CRM gives you for new leads or contacts. It has to start with https://.
• The secret or token your CRM asks for, if any. Your CRM's own help usually calls this an API key, a webhook secret or an incoming integration.
• A form on a published page, so the form appears in the Form list. See Forms and inbox.
• At least one real message in your Inbox, so you can test. Send your own form once if it is empty.

Create an automation

1. Open Inbox in the site's sidebar and press Settings, then choose the Automations tab.
2. Press New automation. The editor has five numbered sections.
3. 1. When: type a Name you will recognise later. The Trigger is A form is sent. Under Form, pick one form or Any form.
4. 2. Only if: add a condition, or leave it empty to run on every message (see Only run for some messages).
5. 3. Then: send an HTTP request: type the Endpoint address and choose what goes in the Body (JSON) (see Choose what is sent).
6. 4. Signing: choose a Method and paste the Secret so your CRM can check the request came from your site (see Signing and secrets).
7. 5. Delivery explains how your system's answers are counted and retried (see Delivery and retries). Press Create automation. It starts On.

The list under Automations shows each automation with its on/off switch, its form, its condition, where it sends (POST and the host name) and its last run. Use the switch to pause one without deleting it. Runs already waiting are skipped when you turn it off.

Only run for some messages

A condition is a list of rules. Each rule has a field, an operator and a value. Press Add a condition, then Add rule.

• All or Any above the rules decides whether every rule must match or just one. Add group adds a nested group with the other mode, for example Any of these inside All of these.
• The fields you can check are the Form, each field your forms have (for example Event type), the Page address, the Page path and the Language of the page the visitor used.
• Operators depend on the field: is, is not, contains, does not contain, starts with, ends with, is one of, is not one of, is empty, is not empty, and for email fields domain is and domain is not.
• Under the rules, a plain-English sentence shows what the condition means.

Example: send only event bookings

A restaurant gets many catering enquiries but wants only event bookings in its sales pipeline. Its Catering request form has an Event type drop-down. The automation uses that form and one rule, Event type is one of Wedding and Corporate. Other requests still arrive in the Inbox as usual, they just are not sent on.

On my Rosa's Bakery site, create an automation named "Event bookings to CRM". When the Catering request form is sent and the event type is Wedding or Corporate, POST the name, email, event date and guests to https://crm.example.com/api/leads. Check the rule against my recent messages first and show me the plan before saving.

Choose what is sent

Under Body (JSON), three modes decide what your other system receives.

The Body preview under the table shows exactly what will be sent, with placeholders such as [Email] where the visitor's answer goes. A required key that is empty, or longer than its max length, means the request is not sent and the Inbox shows why.

Under Headers you can add up to 20 extra headers, for example X-Source. Content-Type: application/json and an Idempotency-Key are always sent.

Signing and secrets

Under 4. Signing, the Method tells your other system how to trust the request.

A secret is stored encrypted and is never shown again after you save it. Later the field only shows Set on and a date, with two buttons:

• Replace: the new secret works at once and the old one stops.
• Rotate: the new secret is used, and the old one also keeps working for 24 hours (requests are signed with both), so you can switch your other system over without a gap.

Shared connections

When several automations call the same system, save its address and secret once as a shared connection. Change the secret there and every automation that uses it switches over.

1. Open Settings in the workspace part of the sidebar (not a site's settings) and find the Connections section.
2. Press New connection. Fill in Name, Base address (HTTPS only, each automation adds its own path), Auth, a Header name if the method needs one, and the Secret. You can also set the secret later with Set secret.
3. Press Add connection.
4. In an automation, under 3. Then, switch Endpoint from Web address to Shared connection, pick the Connection and type a Path such as /leads. Signing then comes from the connection.

The table shows each connection's auth, which automations use it (Used by) and when its secret was set. Edit changes the name, address or auth (changing the auth clears the secret, so set a new one or the automations using it will fail). Secret replaces or rotates the secret. Delete is refused while an automation still uses the connection: point those at something else first.

Test it

Save first, then open the automation and press Send test. In Send a test, pick a message from your Inbox and press Send test. Lentil sends it to your other system for real, then shows the exact request (secrets hidden) and your system's answer. This is a real request, so the other system acts on it. A test uses its own request id starting with test_, so it never blocks the real one. If that message would not have matched the form or condition, the dialog says so and still sends.

Send a test of my "Event bookings to CRM" automation using the latest catering request and show me what my CRM answered. Do not change anything else.

Delivery and retries

Every attempt for one message carries the same request id (the Idempotency-Key header), so your system can ignore a repeat. Redirects are never followed.

Check what ran

In the Inbox list, a small badge under a message shows each automation that ran for it and its result. Open the message and look at the Automations card: it lists every automation with its status (Sending, Sent, Failed, Skipped, Gave up), the time, the number of attempts and the HTTP code. Press Details to see why it ran, how each rule matched and the first part of your system's answer.

For an automation that did not run, the card says why, for example It is off., Spam is never sent., It only runs for another form., or which rule did not match.

When a run failed or gave up, fix the cause and press Retry now. It is sent again with the same request id.

Privacy and security

• Endpoints must be https:// and on a public address. Lentil refuses private network addresses and does not follow redirects.
• Secrets are stored encrypted and are never shown again after you save them. Only people who manage automations see the first 1 KB of your system's answer.
• Creating, changing and deleting automations and connections is recorded in your account's security activity. See Account and security.

Who can use it

• Automations (create, change, test, retry): owners, admins and members. Clients cannot, because automations send visitors' details outside Lentil. See Team and roles.
• Shared connections: owners and admins create and manage them in workspace Settings. Members and clients cannot create or edit them.
• Plan: no plan is required for automations. They depend on forms, and Free sites have a limit on contact forms. See Plans, billing and credits.

Limits and edge cases

• Up to 10 automations per site, and up to 50 shared connections per workspace.
• Up to 500 requests per site per hour. A run over the limit shows a Held back reason and goes out when the next hour starts.
• Your system has 10 seconds to answer. A request body is at most 16 KB, and a template at most 16 KB.
• Up to 50 keys in Choose fields, up to 20 rules in a condition, up to 20 extra headers.
• A name is up to 80 characters. An endpoint address is up to 2,000 characters.
• Run history is kept for 90 days.
• Spam is never sent. A message you move out of spam with Not spam runs its automations then, once.
• Deleting an automation stops it and deletes its run history and its own endpoint and secret. Deleting a shared connection is refused while it is in use.

From an AI assistant

An assistant connected to Lentil works as you, with your role. See AI assistants to connect one.

• list_automations and get_automation: read a site's automations, their conditions in plain English and their last run.
• preview_automation_condition: check a draft condition against the last 50 non-spam messages. Nothing is saved or sent.
• create_automation and update_automation: create or change one. enabled: false pauses it.
• test_automation: sends one real request for a message you choose and returns the request and the response.
• list_automation_runs and retry_automation_run: read the run history and send a failed run again.
• list_connections, create_connection, update_connection and set_connection_secret: manage shared connections. Secrets are never returned.
• delete_automation and delete_connection: without confirmed: true they only return a preview. An assistant only deletes after you agree.

An assistant cannot read the Inbox itself, so to test with a particular message it finds one through list_automation_runs or you give it the message to use in the app.

Updated 9 November 2026