01
Pin a consumer profile
Commit a JSON Schema profile in Git or inline it in your automation request.
Why ingress validation matters
Automation platforms excel at moving data — but they rarely understand when an upstream vendor silently removes a field from a webhook payload. Your IF node still runs; the branch still fires; only downstream systems notice the gap hours later. DriftGuard validate closes that loop at the HTTP boundary with the same breaking, warning, and info semantics you already use in CI compare_json.
Pair runtime validate with contract watches on vendor OpenAPI or MCP catalogs: when the producer changes, you get alerted before your pinned consumer profile goes stale. That Watch + Validate bundle is the inbound complement to MCP catalog monitoring for agent teams.
Hosted validate is metered per plan (trial 500/mo; Pro 25k/mo) with burst limits. Payloads are not stored — only validation metadata for GDPR-safe automation analytics in Insights → Ingress gate.
IF nodes catch syntax — not contract drift
✕ Without ingress validate
- Missing fields slip into Salesforce or Postgres
- n8n branches on stale assumptions after vendor deploys
- No link between upstream watch alerts and runtime gates
- Validators in Function nodes diverge from CI schemas
✓ With DriftGuard validate
POST /api/validateblocks bad payloads at the edge- Same breaking / warning / info semantics as CI
compare_json - Importable n8n workflow — HTTP path, no custom node required
- Pair with contract watches for Watch + Validate bundle
Validate API vs watch vs FuseGuard ingress hook
Choose the primitive that matches where the contract breaks — producer drift, inbound payload shape, or agent runtime policy.
| Primitive | When to use | Entry point |
|---|---|---|
| Contract watch | Detect upstream OpenAPI / MCP catalog drift on a schedule | POST /api/watches · console wizard |
| Runtime validate | Block or warn on inbound webhook / n8n payloads before writes | POST /api/validate · OSS CLI |
| Profile registry | Pin consumer schemas server-side; reference profileId from automation |
PUT /api/ingress-profiles/:id (Pro+) |
| FuseGuard ingress hook | Trip agent runs when validate blocks at the Fuse edge (ingress_validate_blocked) |
FuseGuard env + quickstart |
FuseGuard trips surface in Agents → Fuse activity; pair with validate for defense in depth when agents call tools that depend on webhook-shaped contracts.
Profile registry starter packs
Pro+ accounts can seed the hosted registry from templates — payment webhooks, git-provider deliveries, and generic JSON envelopes — then wire profileId in n8n without copying 64KB schemas into every workflow.
GET /api/ingress-profiles/templates— browse catalogPUT /api/ingress-profiles/:idwithfromTemplate— pin to your accountPOST /api/validatewithprofileId— gate at runtime
Console: Insights → Ingress gate → Add from template applies the same flow without curl.
Quickstart
02
Import the n8n template
OSS template: driftguard-ingress-gate.json — or call the API from any HTTP client.
03
Register upstream watches
When the vendor changes their OpenAPI, get alerted before ingress profiles go stale.
01
Free locally —
driftguard validate CLI and MCP offline.02
Hosted metered — trial 500/mo; Pro 25k/mo with burst limits.
03
No payload storage — metadata only for GDPR-safe automation.
04
Upgrade on quota — 402/429 responses include pricing deep links.
Gate your first webhook in 15 minutes
Import the n8n template or curl the API — then add watches on the vendors you depend on.