Transform scripts — SuaveHooks

Overview

Transform scripts are configured on the endpoint edit page (or via the REST API). They require a Pro subscription.

Incoming webhook hits your capture URL.
JSON transform rules run first (no-code ops from the transform studio).
If a script is configured, it receives the post-rules body and returns a new body (or an error).
The final body is stored, forwarded, and exposed through the polling API.

Supported languages: javascript (recommended), csharp, and fsharp. Use the Test transforms panel on the edit page to preview output without saving.

ScriptInput

Every script receives a single input object describing the capture context and the request body after JSON rules have been applied.

Field	Type	Description
Body	string	Raw request body as UTF-8 text (often JSON after rules).
Method	string	HTTP method of the capture request (e.g. `POST`).
EndpointName	string	Your endpoint's display name.
QueryString	string	Query string from the capture URL, including leading `?` if present.

JavaScript property names are camelCase:

input.body
input.method
input.endpointName
input.queryString

ScriptResult

Return a result object indicating success or failure. On failure the original body is kept and the error is logged.

Field	Type	Description
Success	bool	`true` to use `Body`; `false` to abort with `Error`.
Body	string	Transformed body on success.
Error	string	Human-readable message when `Success` is `false`.

Helpers (F# and C#)

ScriptResult.ok body / ScriptResult.CreateOk(body)
ScriptResult.error message / ScriptResult.CreateError(message)
Json.tryGetString json "field" — parse JSON and read a string property
Json.tryGetInt json "field" — parse JSON and read an integer property

JavaScript returns a plain object: { success: true, body: "...", error: "" }

JavaScript (recommended)

Define a function named transform that accepts input and returns a result object. JavaScript runs in a hardened sandbox with no access to .NET or the host filesystem.

function transform(input) {
  // input.body is the post-rules payload (often JSON)
  const updated = input.body.replace(/invoice/g, "INVOICE");
  return { success: true, body: updated, error: "" };
}

C#

Define a method named Transform with signature ScriptResult Transform(ScriptInput input).

ScriptResult Transform(ScriptInput input) {
    var eventType = Json.tryGetString(input.Body, "type");
    if (eventType.IsNone) {
        return ScriptResult.CreateError("Missing type field");
    }
    return ScriptResult.CreateOk(
        input.Body.Replace("invoice", "INVOICE"));
}

F#

Define a value named transform with type ScriptInput -> ScriptResult.

let transform (input: ScriptInput) : ScriptResult =
    match Json.tryGetString input.Body "type" with
    | None -> ScriptResult.error "Missing type field"
    | Some _ ->
        ScriptResult.ok (input.Body.Replace("invoice", "INVOICE"))

Security & limits

Scripts run in isolated worker processes inside a sandbox with network and I/O isolation — not in the main web server.
JavaScript: hardened runtime with strict memory, statement, and recursion limits per run.
C# / F#: compile against a restricted API surface; dangerous namespaces and #r references are blocked.
Per-run wall-clock timeout of 10 seconds. Runaway workers are killed automatically.
Max script source size: 8,000 characters.

Memory & CPU

JavaScript — per run: 4 MB heap, up to 50,000 statements, recursion depth 256, plus the 10 second timeout above.
Scripts that exceed any limit are stopped and the worker is terminated.

Only authenticated endpoint owners (or team members with access) can save scripts. Webhook senders cannot inject code — they only supply data passed as input.body.

REST API

Set scripts when creating or updating an endpoint via REST API v1:

PUT /api/v1/endpoints/{id}
{
  "transformScript": "function transform(input) { ... }",
  "transformScriptLanguage": "javascript"
}

Scripts are validated on save. Invalid scripts return 400 with a compile/validation message. Transform scripts require an active Pro subscription or an admin override on your account.