Roadmap | Facebook — BizFirstAI

Not implemented yet: Everything on this page describes infrastructure that already exists in the codebase but is not yet exposed as a runnable node operation or trigger. Every operation documented elsewhere in this guide (see Overview) works today.

Webhook Trigger Support (Partially Built)

The Domain and Services layers already contain the building blocks for receiving Facebook Page/Messenger webhooks as a workflow trigger, but they aren't yet connected to an HTTP endpoint or a resource/operation pair on the executor:

Piece	Location	Status
`FacebookWebhookValidator`	`BizFirst.Integration.Facebook.Services.Webhook`	Implemented — HMAC-SHA256 verification of `X-Hub-Signature-256` against an app secret. Registered in DI.
`FacebookWebhookPayload`	`BizFirst.Integration.Facebook.Domain.Trigger`	Implemented — typed model for the Graph API webhook envelope (`entry[].messaging[]` and `entry[].changes[]`).
`FacebookTriggerWebhookResult`	`BizFirst.Integration.Facebook.Domain.Trigger`	Implemented — result record shape for a received event.
Webhook HTTP endpoint / controller	—	Not built.
`trigger` resource on the executor	—	Not routed — `FacebookNodeExecutor`'s operation switch has no `trigger` case, and `FacebookOperationInfoFactory` has no matching entry.

What's Needed to Finish It

A public webhook receiver endpoint (comparable to the process-webhooks/{processId}/{nodeId} pattern used elsewhere in ProcessEngine) that accepts Facebook's subscription verification handshake (hub.challenge) and forwards signed POST payloads.
Wiring that endpoint's raw body + X-Hub-Signature-256 header into the already-implemented FacebookWebhookValidator.ValidateSignature, using the Facebook App's App Secret.
A new trigger resource/operation on FacebookNodeExecutor (or a dedicated trigger node) that deserializes FacebookWebhookPayload and starts/resumes a workflow run per event — mirroring how message/comment events already map onto the message/post resources for outbound calls.
A config field for the App Secret (distinct from the Page access token) — needed only for webhook signature verification, not for any operation documented elsewhere in this guide.

Open Questions Noted by the Original Implementation

The node's own internal engineering notes (Docs/Certificates.md) flag two points still under discussion as of this writing:

Video/file upload handling: today's media.uploadImage/uploadVideo only support fetch-by-URL (see Media Operations) — direct binary/multipart upload from a workflow (rather than requiring a publicly reachable source URL) is an open design discussion.
Webhook mechanics: the exact end-to-end flow described above (subscription verification, endpoint shape, and how a received event maps onto a running or newly-started workflow) is still being worked out, beyond the signature-verification and payload-parsing pieces already built.

Want this sooner? Track progress via the BizFirst.Ai team — the webhook receiver endpoint and the trigger-routing wiring are the two blocking pieces of work before inbound Facebook events can drive a workflow.