Brex

Overview

The Brex connector registers a webhook subscription for the event types your workflows use. Tessel verifies the signature headers on each delivery, fetches the related expense, transfer or user, and starts the run with the full record attached.

Finance teams use it to flag a failed vendor transfer in Slack, to lock cards when Workday marks an employee as terminated and to sync user changes from Okta into Brex.

Event coverage

• EXPENSE_PAYMENT_UPDATED for card expense status changes

• TRANSFER_PROCESSED and TRANSFER_FAILED for payments out

• USER_UPDATED for status, role and manager changes

How webhooks work

Tessel creates one subscription per connection and stores its signing secret in your workspace region. Each delivery is checked against the secret and a timestamp window, then validated against the schema before any workflow starts.

POST https://platform.brexapis.com/v1/webhooks
{
  "url": "https://hooks.us.tessel.app/brex/ws_3k9d",
  "event_types": [
    "EXPENSE_PAYMENT_UPDATED",
    "TRANSFER_FAILED"
  ]
}

POST https://platform.brexapis.com/v1/webhooks
{
  "url": "https://hooks.us.tessel.app/brex/ws_3k9d",
  "event_types": [
    "EXPENSE_PAYMENT_UPDATED",
    "TRANSFER_FAILED"
  ]
}

POST https://platform.brexapis.com/v1/webhooks
{
  "url": "https://hooks.us.tessel.app/brex/ws_3k9d",
  "event_types": [
    "EXPENSE_PAYMENT_UPDATED",
    "TRANSFER_FAILED"
  ]
}

Signature checks

Brex sends a webhook ID, timestamp and signature with each delivery. Tessel rejects deliveries older than five minutes and drops repeats by webhook ID, so a retried event never starts a second run.

Permissions needed

Create a user token in the Brex dashboard for Tessel. It needs read scopes for expenses, transfers and users. Card and user write scopes are only required for those actions.

• expenses.card.readonly and transfers.readonly

• users.readonly for lookups, or users to create users

• cards only if you lock cards or change limits