Replay-Safe Gmail Drafts from Webhook Batches (n8n)

Replay-safe Gmail drafts generated from webhook batches—without ever sending

This n8n workflow validates an authenticated multi-client report batch, renders deterministic tenant-branded HTML, and creates replay-suppressed Gmail drafts (no sending) for each confirmed report—designed to prevent duplicates and content drift.

What this workflow does

• Receives a single authenticated webhook batch containing 1–20 client reports from your upstream system.
• Verifies CLIENT_REPORT_INTAKE_TOKEN before any Data Table or Gmail work, and removes authorization data from the normalized payload.
• Validates exact batch/per-report keys and strict scalar bounds (including locale, a six-digit brand color, explicit-offset source time, narrative arrays, nonnegative integer metrics, and funnel ordering). Invalid siblings are rejected with bounded errors without blocking valid reports, and invalid scalar values are never reflected.
• Renders deterministic, HTML-escaped tenant-branded email for complete reports, or an explicit no-data statement when complete_no_data contains an empty metrics object. The workflow uses no AI and never fetches CRM, analytics, finance, or other source systems.
• Prevents Gmail draft replay by computing deterministic SHA-256 scope, recipient, content, and fingerprint identities, then reading every physical Data Table row in the exact tenant-period-template scope.
• Creates drafts only after privacy-minimal “Draft Intent” metadata is persisted and exactly one matching acknowledgement is received. Gmail creates a draft—it never sends.

Use cases

• Batch-generating tenant-branded report emails from your webhook source while ensuring reruns don’t create duplicate drafts.
• Safely handling mixed-validity batches: some reports fail validation while others still receive drafts.
• Operating SaaS workflows where deterministic HTML and replay protection are required for auditability.

Technical details

• n8n nodes: webhook, if, code, data table, gmail, sticky note.
• Deterministic hashing: SHA-256 for scope/recipient/content/fingerprint.
• Strict schema validation (locale, brand color, explicit-offset time, narrative arrays, integer metrics, funnel ordering).