Webhook Trigger
Description
Use the Webhook Trigger activity to automatically start a workflow when an HTTP request is received on the configured webhook endpoint.
The Webhook Trigger exposes a unique endpoint URL that external systems, applications, or services can invoke to trigger workflow execution.
This activity is commonly used for:
- API integrations
- Event-driven automation
- Third-party application callbacks
- Real-time process execution
- External system notifications
- Custom integration scenarios
Webhook endpoint registration is updated when the workflow is saved. Use the appropriate designer/debug or deployed endpoint for the workflow version you are testing.
After publishing, the webhook can be managed from the Webhook Management Page.
Configuration
The Webhook Trigger configuration is organized into the following sections:
- Inputs
- Advanced
- Outputs
Inputs
Endpoint URL
Represents the unique webhook endpoint URL generated for the activity.
The generated endpoint URL can be used by external systems to invoke the workflow.
Each webhook endpoint URL is unique and remains associated with the workflow trigger configuration.
The endpoint URL is generated automatically by the activity.
Authentication
Select the configured HTTP authentication connection required by the endpoint. External callers must send the credentials expected by that connection. Authentication is separate from IP restrictions and browser CORS settings.
HTTP Method
Specify the HTTP method supported by the webhook endpoint.
The webhook trigger supports standard HTTP methods, including:
- GET
- POST
- PUT
- PATCH
- DELETE
- HEAD
The selected method determines the type of incoming HTTP requests that can trigger the workflow.
Response Mode
| Option | Response behavior |
|---|---|
| Immediately | Default. Returns HTTP 200 with a start acknowledgement and process instance ID. This does not mean business processing has completed. |
| When Process Execution Finishes | Waits for a published workflow result. The response is a completion acknowledgement unless the published result is a custom WebhookResponse. |
| Using 'Respond to Webhook' Activity | Waits for Respond To Webhook to publish the chosen status, headers, and body. |
| Streaming | Uses server-sent events for progressive output; the caller must support streaming. |
The waiting modes use a 30-minute server wait. A timeout produces HTTP 504; client or proxy timeouts can end the connection sooner. Do not choose a waiting mode for a long-running human task when the caller expects an immediate response.
Body parameters
Declare expected JSON body parameters in the configuration when the request has a known shape. Use Generate from JSON with a representative sample to create fields, then review names, types, required flags, defaults, and nested objects or collections. Declared parameters expose expandable Body fields for data binding and are validated for incoming requests. Leave the declaration empty for a dynamic body.
For example, a sample {"orderId": "1001", "amount": 125} lets the designer configure the two fields and then bind them from the trigger's Body output.
Advanced
IP(s) Whitelist
Use this section to restrict which IP addresses can invoke the webhook endpoint.
Supported address formats include:
- IPv4 addresses
- IPv6 addresses
- CIDR notation ranges
- Requests originating from IP addresses outside the configured whitelist are rejected with a 403 Forbidden response.
- If no IP addresses are configured, the webhook endpoint can be accessed from any IP address.
Allowed Origins (CORS)
Specify the origins allowed to access the webhook endpoint from browser-based applications.
This setting controls cross-origin browser access to the webhook endpoint.
You can configure:
- Individual origins
- Multiple origins
- Wildcard origin (
*)
Max Payload Size
Specify the maximum allowed request payload size, in bytes, accepted by the webhook endpoint.
The default value is:
16777216
Requests exceeding the configured payload size are rejected.
Ignore Bots
Enable this option to detect and ignore requests originating from automated bots.
When enabled, known bot requests are restricted from triggering the workflow.
This option is disabled by default.
Outputs
The Webhook Trigger activity provides access to incoming HTTP request information through the following outputs.
Source URL
Represents the source URL from which the webhook request originated.
Headers
Represents the HTTP headers included in the incoming request.
Query Parameters
Represents the query string parameters associated with the request URL.
Method
Represents the HTTP method used for the incoming request.
Examples include:
- GET
- POST
- PUT
- DELETE
Body
Represents the request payload body received by the webhook endpoint.
Route Parameters
Represents the route parameters extracted from the webhook URL pattern.
Client IP
Represents the IP address of the client that initiated the webhook request.
User Agent
Represents the user-agent information associated with the incoming request.
Content Type
Represents the content type of the incoming request payload.
Examples include:
- application/json
- multipart/form-data
- text/plain
Content Length
Represents the size of the incoming request payload.
Is Binary
Indicates whether the incoming request payload contains binary data.
Binary Data
Represents the binary request payload when binary content is received.
Authentication Status
Represents the authentication validation status of the incoming request.
CORS Origin
Represents the origin associated with the incoming cross-origin request.
Request Timestamp
Represents the UTC date and time when the webhook request was received.
Notes
- The Webhook Trigger activity is a trigger activity and must be placed at the beginning of the workflow.
- Webhook endpoint registration is updated on workflow save.
- Verify the endpoint for the intended version after saving or deploying changes.
- Webhook endpoint accessibility depends on network configuration and server availability.
- Proper authentication and IP restrictions are recommended for production webhook endpoints.
Related
- Webhook Management – Manage and monitor webhook triggers in the AI Command Center.
Example: Return an order acknowledgement
Configure POST, the required authentication, and response mode Using 'Respond to Webhook' Activity. Connect the workflow to Respond To Webhook, set Status to 200, Content-Type to application/json, and Body to {"accepted": true}.
Save the workflow, copy its endpoint, and send a POST using a test API client and the configured authentication. Verify that the caller receives the chosen status and JSON body. Configure every reachable request path to publish the appropriate response.