Attio workflows: how CRM automation works in Attio
By Roman Zakharenko · Facts checked · 5 min read
Attio automates CRM work with workflows. A workflow starts from a trigger block and runs a chain of action blocks, such as updating a record, creating a task, sending a Slack message or making an HTTP request. Workflow runs use workspace credits, and everything else connects through Attio's REST API and webhooks.
At a glance
- An Attio workflow is built from a trigger block, which starts it, and action blocks, which do the work.
- Workflows use workspace credits. Most blocks use one credit, and a block that fails, plus every block after it, uses none.
- Attio's REST API allows 100 read requests and 25 write requests per second. Over the limit it returns HTTP 429 with a Retry-After header.
- Attio signs webhooks with an HMAC-SHA256 of the request body, sent in the Attio-Signature header.
How Attio workflows are built
You build a workflow on a canvas. The trigger block decides when it runs, and the action blocks after it decide what happens. Attio's block library groups triggers into four kinds:
- Record triggers, such as 'Record created'.
- List triggers, such as 'Record added to list'.
- Task triggers, such as 'Task created'.
- Utility triggers, such as 'Manual run', a schedule or an incoming webhook.
Attio's help center gives updating a record, creating a task, sending a Slack message, enrolling someone in a sequence and making an HTTP request as examples of action blocks. You can also describe a workflow in plain language and let Ask Attio build it. Apps built with the Attio SDK can add their own blocks, which then appear in the block picker next to the built-in ones.
By default, a workflow can't write to an object. An admin, or a member with full access to that object, has to grant the workflow access first. Check this before you test a workflow that updates records.
How workflows use credits
Workflow runs and AI features draw on the workspace's shared credits. Attio's billing docs describe how they are counted:
- Most workflow blocks use one credit each time they run.
- Credits are only charged for blocks that actually run. If a run fails partway, the failed block and every block after it use no credits.
- Recalculating AI attributes also uses credits.
- Admins can see credit usage per workflow in Workspace settings.
The number of credits included differs by plan, and Attio has changed its plans before. Check the current allowance on Attio's pricing page and estimate usage from the number of blocks per run times your expected runs per month.
The Attio API and webhooks
For anything a workflow can't do on its own, Attio has a REST API and outbound webhooks. Here is what the developer docs say about each.
| Topic | What Attio documents |
|---|---|
| Rate limits | 100 requests per second for reads and 25 per second for writes. Over the limit, HTTP 429 with a Retry-After header. |
| Listing endpoints | List records and List entries also have score-based limits, counted over a 10-second window across all apps and tokens. |
| Authentication | An API key for a single workspace, or OAuth 2.0 for apps used across several workspaces. Tokens are sent as Bearer tokens, and scopes are set per token. |
| Webhook events | Events include record.created, list-entry.created, note.created and task.created. |
| Webhook signature | An HMAC-SHA256 of the raw request body, made with the webhook's secret and hex-encoded, in the Attio-Signature header. |
| Retries | Each message carries an Idempotency-Key header that stays the same when Attio retries it. |
To check that a webhook came from Attio, recompute the HMAC-SHA256 of the raw body with the webhook secret and compare it with the Attio-Signature header. Attio also sends the same value as X-Attio-Signature for older middleware. Use the Idempotency-Key header to skip messages you have already processed, so a retry doesn't create a second task or Slack message.
Connecting Attio to your support tools
Attio has a Slack app for notifications and an official Zapier app. Zapier lists ready-made connections between Attio and helpdesks such as Zendesk and Intercom. For more control, connect a helpdesk to Attio's API and webhooks through n8n or Make. Here is a common pattern, described as steps. It shows how the pieces fit together. It isn't a TascaLab case study.
- Trigger: your helpdesk sends a webhook to n8n or Make when a ticket is created or escalated.
- Look up: the workflow finds the customer's company record in Attio through the API, staying within the 100 reads per second limit.
- Update: it writes the ticket's status or category to an attribute on the record, or creates a task for the account owner.
- React in Attio: an Attio workflow triggered by that record update sends a Slack message to the account owner.
- Handle errors: wait and retry on HTTP 429, and use the Idempotency-Key header to drop duplicate webhook deliveries.
Getting this built
TascaLab connects tools like Attio to the helpdesk and chat tools you already use, through APIs, webhooks, n8n and Make, with no platform switch. Custom Automation projects cost from $1,200. Most setups take 1 to 3 weeks, and every project includes basic documentation and 30 days of post-launch support. You can start with a free 30-minute Health Check call.
Frequently asked questions
What are Attio workflows?
Attio's automation tool. A workflow starts from a trigger block, such as a record being created or a manual run, and then runs action blocks, such as updating a record, creating a task, sending a Slack message or making an HTTP request.
Do Attio workflows cost credits?
Yes. Workflow runs use the workspace's shared credits. Most blocks use one credit per run, and blocks that fail or never run use none. The number of credits included depends on your plan.
What are the Attio API rate limits?
100 requests per second for reads and 25 per second for writes. Over the limit, Attio returns HTTP 429 with a Retry-After header. The List records and List entries endpoints also have score-based limits.
How do I verify an Attio webhook?
Compute an HMAC-SHA256 of the raw request body with the webhook's secret, hex-encode it and compare it with the Attio-Signature header.
Want this set up for your team?
Book a free Health Check: a 30-minute call and a written report with 2–3 concrete recommendations, a fixed price and estimated running costs. No pitch.
Sources
- Attio Help — Overview of workflows
- Attio Help — Workflows block library
- Attio Help — Create a workflow
- Attio Help — Automations billing
- Attio Docs — Rate limiting
- Attio Docs — Authentication
- Attio Docs — Webhooks
- Attio Docs — Workflow blocks (SDK)
- Attio Help — Communication apps (Slack)
- Attio Help — Zapier app
- Zapier — Attio and Zendesk integrations