Webhooks
Receive HTTP callbacks from external services and trigger workflows automatically. Supports secret-based authentication, payload storage, and A2A agent-to-agent messaging.
Webhook Types
Public Webhooks
External services POST to /webhook/:source. The platform looks up the webhook by source name and secret, then creates a task.
A2A Webhooks
External agents POST to /webhook/a2a/:teamId with an x-a2a-secret header to send messages into an agent team war room.
Creating a Webhook
Create a webhook configuration from the Webhooks page or via the API. Each webhook gets a unique secret. Link it to a workflow to automatically queue executions.
{
"name": "GitHub PR Opened",
"source": "github",
"workflowId": "wf_123",
"metadata": {
"events": ["pull_request.opened"]
}
}Public Webhook Endpoint
Once created, external services can call the public endpoint. The request body is stored as the task input payload.
# Authorization via query param or header
POST /webhook/github?secret=wh_secret_abc
# Or
POST /webhook/github
Header: x-webhook-secret: wh_secret_abc
Body: any JSON payload from the external serviceA2A Agent Webhook
External agents use the A2A webhook to inject messages into a team session. The request must include the team's A2A secret and a valid session ID.
Headers:
x-a2a-secret: <team_a2a_secret>
Body:
{
"sessionId": "session_abc",
"from": { "id": "external-agent", "type": "external" },
"to": { "id": "broadcast", "type": "internal" },
"type": "user_prompt",
"content": { "result": "Analysis complete" }
}Best Practices
- • Store webhook secrets securely. Do not expose them in client-side code.
- • Use descriptive
sourcenames to avoid collisions. - • Verify that the linked workflow is idempotent or handles duplicate triggers gracefully.
- • Public webhook routes are rate-limited to 20 requests per minute.