---
title: Workflow actions
description: The things a workflow can do, and the ones that need permission.
domain: workflow
status: shipped
visibility: public
last_verified: 2026-07-13
order: 15
---
An action is a step that does something. When a workflow reaches an action, it carries it out on the record the workflow is about. These are the actions a workflow can take.

## The actions

| Action | What it does |
|---|---|
| Send email | Email the customer, composed inline or from a template. |
| Send internal email | Email your own team, not the customer. |
| Update a field | Set a field on the record. |
| Add a tag | Put a tag on the record. |
| Remove a tag | Take a tag off the record. |
| Send a payment request | Ask the customer to pay, with a link. |
| Apply a credit | Credit the customer's account. |
| Apply a discount | Put a discount on the subscription. |
| Pause a subscription | Pause the subscription. |
| Cancel a subscription | Cancel the subscription. |
| Send a webhook | Post a message about the record to a web address you choose. |
| Notify Slack | Post a message to a Slack channel through a connected workspace. |

## Sending a webhook

The "Send a webhook" action posts a message to a web address you run, so an event in your billing account can drive something in your own systems. You give it the address and the JSON message to send. The message starts from a small template you can edit, and it can include merge fields like the customer's name or email, filled in when the workflow runs.

You can add request headers, one per line as "Name: Value", for example an Authorization header your endpoint expects. The address has to be https and point at a public server, not a private or internal one.

If you set a signing secret, we add a signature header so your endpoint can check the message really came from us. It works the same way as the signature on [outbound webhooks](/guide/automation/outbound-webhooks), and that guide shows how to verify it.

We send the message once, when the workflow reaches the step. If your endpoint is down or answers with an error, the step fails and you can retry the run from its history. Every attempt and its response is recorded on the run.

## Posting to Slack

The "Notify Slack" action posts a message to one of your connected Slack workspaces. You pick the workspace and, if you want, a specific channel, then write the message. Merge fields fill in customer and billing details when the workflow runs, and Slack formatting like bold and emoji comes through.

It uses the same Slack connection you set up in [Integrations](/guide/integrations/slack), so there is nothing extra to configure here. If the connection is paused or removed, the step fails loudly rather than dropping the message, so you always know a message did not go out.

## Sensitive actions need permission

Some actions move money or change a customer's service: applying a credit or a discount, pausing or cancelling a subscription. These are marked sensitive, and the person who builds a workflow that uses them has to hold the right permission. This keeps a workflow from doing something its author could not do by hand. See [roles and permissions](/guide/team/roles-and-permissions).

## Merge fields

An email or a message in a workflow can include details from the record, like the customer's name or the invoice amount, through merge fields. The workflow fills them in when it runs, so each customer gets a message about their own account.

## Edge cases

- **An action runs on the workflow's record.** A subscription workflow's "pause" pauses that subscription.
- **Sensitive actions are gated on the author's permission,** not the customer's. If you cannot apply a credit by hand, you cannot build a workflow that does.
- **Pair a sensitive action with an approval step** when you want a human to confirm before it runs. See [workflows](/guide/automation/workflows).