n8n Workflow: Detect Subscription Revenue Anomalies with Postgres & Claude

Spot subscription revenue anomalies automatically—with Postgres + Claude

This n8n workflow detects unusual subscription revenue drops or surges by analyzing daily metrics in Postgres, investigating likely causes (including an Anthropic Claude root-cause analysis), and alerting you via Slack and PagerDuty when it matters.

What this workflow does

• Runs on schedule, webhook, or manual trigger: executes daily via cron, a POST webhook (optionally accepting a targetDate override), or manually.
• Sets up and uses Postgres for baselines: creates/ensures tables for metric history, anomaly records, and run tracking; loads recent history and prior anomalies for deduplication.
• Pulls subscription and payment data from external HTTP APIs: normalizes subscription events, payment records, and optional business context; fails fast with a logged failed run if required billing feeds are unavailable.
• Builds weekday-aware daily metrics: calculates series overall and segmented by plan/country/channel; performs data-quality gap checks before analysis.
• Detects statistically unusual points and sustained shifts: uses robust, weekday-aware baselines to flag revenue anomalies.
• Investigates likely causes: drills into contributing segments, correlates with business events, analyzes payment failure codes, and checks for single-customer concentration.
• Generates a root-cause narrative with Anthropic Claude: for medium-or-higher investigated anomalies, sends an evidence pack to Claude with guard rails that only allow severity downgrades.
• Alerts the right teams: sends notifications via Slack and PagerDuty for actionable visibility.

Use cases

• Detecting sudden MRR/ARR changes driven by subscription events, billing failures, or regional/plan-specific behavior.
• Preventing alert fatigue by deduplicating anomaly runs using Postgres history.
• Providing faster incident triage for SaaS operators when revenue metrics deviate from expected weekday patterns.

Technical details

• n8n nodes / patterns: if, code, no op, merge, webhook, postgres
• Core systems: Postgres for metric history + anomaly persistence; Anthropic Claude for root-cause generation; Slack and PagerDuty for alerts
• Data pipeline: scheduled/triggered runs, external HTTP API fetch + normalization, anomaly storage and run tracking