Every action can reshape what it returns with an ordered post_transforms pipeline — extract, rename, filter, aggregate, hash, encrypt — declaratively, before the data reaches the next step or the client. No mapping layer, no function in the middle to maintain.
An ordered pipeline, not a mapping layer
post_transforms is an ordered list of functions that run in sequence on an action's result — each step's output feeds the next. Pull a nested value out, keep only the fields you want, filter rows on a condition, group and aggregate — all as readable config you can review in a pull request.
extract_value / extract_with_jq — pull out a path or reshape with jq
keep_attributes, rename_keys, remove_keys — shape the object
filter, group_by, math — select and aggregate rows
Enrich and secure inline
Transforms aren't only for shaping. The same pipeline can hash or encrypt a field, generate a password, or sign a JWT — so sensitive data is protected before it's ever stored or returned, without a separate service in the path.
encrypt_value / decrypt_value and hashing for sensitive fields
generate_password and add_jwt for auth flows
Runs server-side, in the same config as the endpoint
Composes with flow control
Transforms shape the data; flow control decides what runs. Branch on an assertion, gate a step on whether earlier ones succeeded, retry with backoff, and keep durable state between runs — the automation those transforms feed into. Together they're a full pipeline in one declarative config.
Reviewable, traced, no code
Because a transform is config rather than code, it's diffable in a pull request and it ships the same OpenTelemetry traces and Prometheus metrics as everything else — so you can see exactly what each step did to the data, rather than guessing inside a black-box mapping function.
Frequently asked questions
What is a post_transforms block? An ordered list of transform functions attached to an action. Each runs in sequence on the action's result — extract, rename, filter, aggregate, hash, encrypt — so you reshape data without writing mapping code, and the output of one step feeds the next.
Can I use jq to reshape data? Yes. extract_with_jq reshapes with a jq expression, and extract_value pulls a value out by path. Alongside them are keep_attributes, rename_keys, remove_keys, filter, group_by and math for the common cases, so you rarely need jq at all.
Can transforms encrypt or hash data? Yes. encrypt_value / decrypt_value, hashing, generate_password and add_jwt run inside the same pipeline, so a sensitive field can be protected before it's stored or returned — no separate step or service in the path.
How is this different from flow control? Transforms reshape the data an action returns; flow control — branching, retries, gating and durable state — decides which steps run and when. They're separate blocks in the same config and compose together. The Automation page covers the flow-control side.