Integrations

Webhooks

Receive HTTP callbacks from external services and trigger workflows automatically. Supports secret-based authentication, payload storage, and A2A agent-to-agent messaging.

Webhook Types

Public Webhooks

External services POST to /webhook/:source. The platform looks up the webhook by source name and secret, then creates a task.

A2A Webhooks

External agents POST to /webhook/a2a/:teamId with an x-a2a-secret header to send messages into an agent team war room.

Creating a Webhook

Create a webhook configuration from the Webhooks page or via the API. Each webhook gets a unique secret. Link it to a workflow to automatically queue executions.

POST /api/webhooks
{
  "name": "GitHub PR Opened",
  "source": "github",
  "workflowId": "wf_123",
  "metadata": {
    "events": ["pull_request.opened"]
  }
}

Public Webhook Endpoint

Once created, external services can call the public endpoint. The request body is stored as the task input payload.

POST /webhook/:source
# Authorization via query param or header
POST /webhook/github?secret=wh_secret_abc

# Or
POST /webhook/github
Header: x-webhook-secret: wh_secret_abc

Body: any JSON payload from the external service

A2A Agent Webhook

External agents use the A2A webhook to inject messages into a team session. The request must include the team's A2A secret and a valid session ID.

POST /webhook/a2a/:teamId
Headers:
  x-a2a-secret: <team_a2a_secret>

Body:
{
  "sessionId": "session_abc",
  "from": { "id": "external-agent", "type": "external" },
  "to": { "id": "broadcast", "type": "internal" },
  "type": "user_prompt",
  "content": { "result": "Analysis complete" }
}

Best Practices

  • Store webhook secrets securely. Do not expose them in client-side code.
  • Use descriptive source names to avoid collisions.
  • Verify that the linked workflow is idempotent or handles duplicate triggers gracefully.
  • Public webhook routes are rate-limited to 20 requests per minute.