Technical Architecture

How StarX-Flow operates.
From inbound message to calendar lock.

Discover the technical pipeline that transforms conversational messaging on WhatsApp and Instagram into confirmed appointments with zero double-bookings.

Key Takeaway: The 5-Stage Automated Booking Lifecycle

StarX-Flow operates an event-driven automation lifecycle: (1) Inbound Ingestion validates Meta HMAC-SHA256 signatures and checks idempotency; (2) CRM Resolution identifies client history and tenant working hours; (3) AI Orchestration references private RAG knowledge documents to answer FAQs and check live provider availability; (4) Concurrency Locking writes atomic PostgreSQL exclusion locks and creates two-way calendar events in Google Calendar or Outlook; and (5) Post-Booking Lifecycle dispatches digital intake forms, confirmations, and automated Google Review requests.

01Ingestion Gateway

Multi-Channel Ingestion & Cryptographic Authentication

When a prospective client sends a message via WhatsApp, Instagram Direct, or your website chat, the webhook hits StarX-Flow's Ingestion Gateway (/api/whatsapp/webhook).

  • Cryptographic HMAC-SHA256 signature validation against Meta App Secret
  • Sliding-window idempotency cache (15-min TTL) eliminates duplicate delivery replays
  • Payload normalized into a canonical event object with E.164 phone formatting
Pipeline Execution Trace
Stage 01 Active
POST /api/whatsapp/webhook HTTP/1.1
Header: x-hub-signature-256: sha256=4f3a...
Payload: { "object": "whatsapp_business_account", "entry": [...] }
=> Ingestion Gateway: HMAC Validated -> Normalized to CanonicalInboundEvent
02Tenant Resolution

Context & Identity Resolution in Private CRM

The gateway resolves the merchant's isolated organization tenant and maps the sender's identifier to a unified customer record in the database.

  • Resolves existing customer history across phone, email, and social handle
  • Loads active conversation thread and previous appointment context
  • Retrieves merchant working hours, staff rosters, and cancellation policies
Pipeline Execution Trace
Stage 02 Active
SELECT * FROM channel_identities WHERE external_user_id = '+15550199'
=> Customer Lead ID #8492 resolved: "Alex Chen" (2 previous visits, no flags)
03AI Orchestrator

Retrieval-Augmented Intelligence & Tool Execution

The AI Receptionist references your private business knowledge base to formulate natural-language responses and calls structured server-side tools.

  • RAG retrieves verified service durations, prices, and prep requirements
  • Strict prompt sandboxing prevents prompt injection or role modification
  • Executes checkCalendarAvailability tool against Google Calendar or Microsoft Outlook
Pipeline Execution Trace
Stage 03 Active
AI Orchestrator Call: checkCalendarAvailability({
  organizationId: "org_7721",
  serviceName: "Initial Dental Exam & Cleaning",
  date: "2026-11-12"
})
=> Returns available slots: [09:30, 11:00, 14:30] with Dr. Martinez
04Double-Booking Defense

Atomic Concurrency Locking & 2-Way Calendar Sync

Once the client confirms their desired time slot, StarX-Flow locks the appointment simultaneously into your connected calendar and your private database.

  • PostgreSQL btree_gist exclusion constraint on timestamp ranges blocks slot collisions
  • Creates confirmed event via Google Calendar v3 API or Microsoft Graph API
  • Dispatches instant WhatsApp confirmation and optional Stripe deposit checkout link
Pipeline Execution Trace
Stage 04 Active
BEGIN TRANSACTION;
INSERT INTO appointments (org_id, provider_id, time_range) VALUES (...);
-- PostgreSQL exclusion constraint verifies zero overlap across staff rosters
COMMIT;
=> Google Calendar Event Created: Event ID #gcal_99182 locked.
05Operational Follow-Up

Automated Post-Booking Lifecycle & Review Engine

StarX-Flow automates pre-arrival forms, sends timely appointment reminders, and follows up post-service to drive Google Business Profile reviews.

  • Dispatches digital intake waiver link 24 hours prior to visit
  • Sends interactive WhatsApp confirmation prompt 2 hours prior
  • Triggers Google Review Booster message 2 hours post-checkout to capture 5-star ratings
Pipeline Execution Trace
Stage 05 Active
[Cron Trigger: +2 Hours Post-Appointment]
"Hey Alex! Thanks for visiting today. If you loved your treatment, 
sharing feedback on Google helps our local staff immensely: [Review-Link]"

The Intelligent Human Handoff Safeguard

Automation should never trap your customers in an endless loop. If a client expresses frustration, asks for a human manager, or mentions clinical urgency, StarX-Flow immediately pauses automated AI responses, alerts your desktop and staff dashboard with an audible chime, and transitions the thread to manual human control.

Technical Prerequisites & API Constraints

We believe in total transparency regarding third-party platform rules.

Meta 24-Hour Window

Under Meta business policies, free-form customer service messages can only be sent within 24 hours of the user's last inbound message. Beyond 24 hours, pre-approved Meta message templates are required.

Calendar Permission Scopes

StarX-Flow requires Calendars.ReadWrite permission on Google Calendar or Microsoft Outlook to read availability and insert event blocks.

Meta Phone Number Rules

To connect a phone number to the WhatsApp Cloud API, that number must not be currently registered on the personal or standard WhatsApp Business mobile app.