A webhook trigger lets an external system start a run of one of your published workflows. Publishing a webhook-triggered workflow generates a token, which goes in the URL, and a signing secret, which you reveal or rotate with POST /workflows/{definition_id}/trigger-secret.
Signing a trigger call
POST /workflow-triggers/{token} expects two headers:
| Header | Value |
|---|---|
X-Webhook-Timestamp | The current unix timestamp. Accepted within +/- 5 minutes, which is what stops a captured request being replayed later. |
X-Webhook-Signature | HMAC-SHA256 hex digest over the exact string {X-Webhook-Timestamp}.{body}, keyed with the workflow's signing secret. |
The request body becomes the run's input data.
Retries of the same body without an Idempotency-Key collapse onto the first run for a short window, so a network-level retry will not start a second run. Send an explicit Idempotency-Key when you want control over that.
In this section
| Endpoint | What it does |
|---|---|
POST /workflow-triggers/{token} | Start a run from an external system, signed |