Build an AI approval workflow with ASP.NET Core, SQL Server & n8n.

Can you add AI to an existing business application?

You do not necessarily need to replace a working ERP, CRM, accounting tool or operations portal to test a useful AI feature. A small, well-bounded workflow can help a team review invoices or documents faster while maintaining traceability.

This article shows an illustrative invoice-processing scenario: an invoice enters an existing application, n8n orchestrates extraction and review, an AI model proposes structured fields, and SQL Server stores a pending review rather than posting a payment automatically.

Reference architecture: five accountable stages

Keep the boundaries explicit. ASP.NET Core owns authentication and user interaction. n8n coordinates integrations. The AI service proposes data, not permissions. SQL Server holds durable state, and a person makes the final decision.

For confidential documents, first agree on data retention, provider settings, redaction and regional processing requirements. Send only the fields needed for the task. In this illustration, the sample payload uses fictitious values.

1. Start from a controlled ASP.NET Core endpoint

ASP.NET Core should authorize the user, validate the invoice ID and amount, and enqueue a review request. An HTTP 202 response means queued for processing, not approved. For resilience, record an idempotency key and durable job state before forwarding work to n8n.

// Inside an authenticated ASP.NET Core endpoint or service.
// Register: builder.Services.AddHttpClient("workflow");

public record InvoiceReviewRequest(string InvoiceId, decimal Total, string Currency);

app.MapPost("/api/invoices/queue-review", async (
    InvoiceReviewRequest input,
    IHttpClientFactory clients,
    IConfiguration configuration,
    CancellationToken cancellationToken) =>
{
    if (string.IsNullOrWhiteSpace(input.InvoiceId) || input.Total <= 0)
        return Results.BadRequest(new { error = "Invalid invoice" });

    var url = configuration["Workflow:WebhookUrl"]
        ?? throw new InvalidOperationException("Webhook URL missing");
    var secret = configuration["Workflow:WebhookSecret"]
        ?? throw new InvalidOperationException("Webhook secret missing");

    using var request = new HttpRequestMessage(HttpMethod.Post, url)
    {
        Content = JsonContent.Create(new {
            reviewId = Guid.NewGuid(),
            invoiceId = input.InvoiceId,
            total = input.Total,
            currency = input.Currency
        })
    };
    request.Headers.Add("X-Workflow-Secret", secret);

    var client = clients.CreateClient("workflow");
    using var response = await client.SendAsync(request, cancellationToken);
    if (!response.IsSuccessStatusCode)
        return Results.StatusCode(502); // Queueing failed: retry safely

    return Results.Accepted(); // Accepted for processing, not approved
}).RequireAuthorization();

2. Store proposals and decisions in SQL Server

Do not let a model directly update the accounting ledger. Save the proposal as Pending, record the reason it was flagged, and make the reviewer’s decision an explicit, authorized action.

CREATE TABLE dbo.InvoiceReview (
    ReviewId uniqueidentifier NOT NULL PRIMARY KEY,
    InvoiceId nvarchar(64) NOT NULL,
    ProposedData nvarchar(max) NULL,
    Status nvarchar(16) NOT NULL DEFAULT 'Pending',
    ReviewedBy nvarchar(128) NULL,
    CreatedUtc datetime2 NOT NULL DEFAULT sysutcdatetime(),
    ReviewedUtc datetime2 NULL,
    RowVer rowversion NOT NULL,
    CONSTRAINT CK_InvoiceReview_Status
      CHECK (Status IN ('Pending', 'Approved', 'Rejected'))
);
-- Add suitable indexes, tenant boundaries and authorization in production.
-- Use unique external event IDs to prevent duplicate processing.

In a multi-tenant product, include organization identifiers and row-level access controls. A rowversion column can help detect concurrent updates when two reviewers open the same item.

3. Orchestrate the steps in n8n

A typical workflow can use these n8n nodes. The webhook can be protected with header authentication, and the production URL should be used only after the workflow is published.

1. Webhook: receive the authenticated, minimal invoice event from ASP.NET Core.
2. HTTP Request or application API: retrieve only the approved invoice fields; avoid passing credentials to model prompts.
3. Model API call: request schema-constrained JSON for supplier, amount, currency, purchase-order match and review reasons.
4. IF / validation: check schema, amount bounds, required fields, duplicates and deterministic business rules independently of the model.
5. SQL Server / internal API: store the proposed result with Status = Pending and its correlation ID.
6. Notification: alert an authorized reviewer; the actual approval happens in your protected application UI, not through an untrusted AI answer.

Example output from the model

{
  "invoiceId": "INV-DEMO-1042",
  "supplierName": "Example Supplier",
  "currency": "USD",
  "amount": 1250.00,
  "purchaseOrderMatched": false,
  "reviewReasons": ["No matching purchase order"],
  "suggestedAction": "Review"
}

Use the model output as a proposal. If the order is missing, the amount differs, or a document looks suspicious, keep the item in manual review. Use structured output schemas where supported, then validate the returned data again on your server. See the model API reference.

4. Security and reliability checks before production

Automation becomes valuable when exceptions are visible and the system fails safely. For a real deployment, plan these controls before connecting the workflow to purchasing or finance systems.

• Secrets: keep model keys, n8n webhook credentials and database passwords in server-side secret storage—not in browser JavaScript or GitHub.
• Authentication: require application authorization, signed or authenticated callbacks and least-privilege service accounts.
• Prompt injection: treat document text and model replies as untrusted input; never allow extracted text to override permissions or execute actions.
• Traceability: connect each invoice event, model proposal, reviewer decision and downstream change to a correlation ID.
• Idempotency: ensure retries and repeated webhooks cannot duplicate invoices or purchase orders.
• Evaluation: measure field-level accuracy, false negatives, escalation rate, review time and per-document costs with representative test documents.

Questions project owners ask before building

Further reading and implementation references

These are authoritative product references for the concepts shown above. Exact implementation details depend on your framework and provider versions.