Provision tenant subdomains from Airtable in Cloudflare

Build an agent workflow that provisions a tenant subdomain in Cloudflare every time a new customer record appears in our Airtable Tenants base, then writes the result back to Airtable and posts a confirmation in Slack.

Trigger: an Airtable poll trigger on the Tenants table, event type new_record. The poll should pass the new row's record ID and field values into the agent.

On each new row, the agent should:

1. Read the new Airtable record using Airtable Get Record so it has the canonical, latest version of these fields: company name, requested subdomain (may be empty), target origin (either an IP address for a proxied A record or a hostname for a CNAME target), and tenant tier or notes.

2. Decide the subdomain. If the requested subdomain field is filled, normalize it (lowercase, strip whitespace and punctuation, hyphenate spaces). If it is empty, derive a candidate from the company name using the same rules. Reserve a short list of forbidden labels (www, api, admin, app, mail, staging) and pick an alternative if one of those is requested.

3. Find the Cloudflare zone for our product domain by calling Cloudflare List Zones and matching on the configured product domain (the user should configure this when they set the workflow up, for example tenants.example.com or example.com).

4. Check for collisions by calling Cloudflare List DNS Records filtered to the chosen full hostname inside that zone. If a record already exists, the agent should reason through a safe alternative, for example appending -2, -3, or a short slug from the tenant tier, and re-check until it finds a free name. Cap the retry loop at 5 attempts and surface the failure to Slack if none are free.

5. Create the DNS record by calling Cloudflare Create DNS Record. If the target origin looks like an IPv4 address, create a proxied A record. If it looks like a hostname, create a proxied CNAME pointing at it. Default proxied to true, TTL to 1 (auto). Capture the returned record ID.

6. Update the Airtable row using Airtable Update Record. Write back: the final chosen subdomain, the full provisioned URL (https://chosen-subdomain.product-domain), the Cloudflare record ID, the DNS record type used (A or CNAME), and a Provisioned At timestamp. Also set a status field like Provisioned or Ready.

7. Post a confirmation in Slack using Slack Send a Message to a customer success channel (configurable). Include the company name, the new URL as a clickable link, the record type, and the Airtable record link so the team can jump back to it. If the agent had to deviate from the requested subdomain or hit any retries, call that out clearly in the message.

If the Cloudflare API returns an error (zone not found, permission denied, validation error), do not update Airtable to Provisioned. Instead update a Status field to something like Failed, write the error message into a notes field, and post a failure message into the same Slack channel asking the team to take a look.

Configurable inputs the workflow should ask the user for when they set it up: Airtable base and table for tenants, the Cloudflare product domain to provision under, the default subdomain pattern (for example {slug}.product-domain), the Slack channel for confirmations, and the optional list of reserved subdomain labels.