Three importable n8n workflows for learning and read-only PipSync integrations. Every export ships inactive, credential-free, synthetic, and with all remote request and notification nodes disabled.
These templates do not place, modify, or close orders. They are not trading signals, investment advice, or a promise of performance. Trading can result in loss.
| Workflow | Purpose | Remote behavior as shipped |
|---|---|---|
| TradingView paper validator | Validate a small synthetic paper/sandbox JSON payload and return a bounded result |
None |
| Read-only signals to chat | Summarize GET /signals without sending identifiers, prices, channel names, or provider names to chat |
GET and chat nodes disabled |
| Usage, health, and report alert | Check documented read-only health, account usage, and report catalog responses against a usage threshold | All GET and chat nodes disabled |
- Download one JSON file from
workflows/. - In n8n, choose Import from File and select the JSON file.
- Inspect the sticky note and every disabled node before changing anything.
- Run the built-in synthetic path first.
- Follow Import and setup before enabling a read-only API or notification node.
The exports use only standard n8n nodes. They are designed for n8n 2.x and include no community package dependency.
- broker credentials or broker adapters
- live-order, trade-update, trade-close, or withdrawal actions
- PipSync write endpoints
- reusable tokens, route keys, or notification webhook URLs
- customer payloads, account identifiers, or production screenshots
- a claim of webhook authenticity or persistent duplicate protection
The first workflow is a local validation demonstration. Its Webhook node has no authentication, and it has no durable receipt store. Do not expose it as a production ingress endpoint. See Security boundaries.
The read-only paths are sourced from the versioned
pipsync-spec OpenAPI document:
GET /signalsGET /healthGET /account/usageGET /reports
The published API contract is authoritative. The API currently describes authenticated account reads as an Enterprise feature. A credential should be created in n8n's credential store and selected in the Header Auth field; never paste a key into a workflow parameter or exported JSON file.
No package installation is required. Node.js 20 or newer is enough:
npm run validate
npm run scan:secrets
npm testThe deterministic validator fails if a workflow becomes active, gains an embedded credential reference, uses a non-allowlisted node, adds a write request, drifts to an undocumented URL, or enables an external request or chat node. The secret scanner checks the entire source tree except its own detector definitions.
For an optional end-to-end import against the pinned official n8n container,
run ./scripts/smoke-import.sh. The image is intentionally not downloaded by
the fast default CI job. See Verification for the exact
evidence boundary and the manual GitHub Actions smoke job.
Use these templates to evaluate the integration shape, then continue with the PipSync integrations guide for the managed product. Bugs and template ideas belong in GitHub issues; suspected security problems belong in the private reporting route described in SECURITY.md.