​
Overview

A webhook trigger gives an external system a URL that wakes one of your bots. Each verified delivery is recorded and becomes a Rails ticket assigned to the bot. Connector events create the same ticket for MCP Events from a connected app.

​
Manage triggers (Clerk session)

Create body (snake_case):
execution_mode is one of PLAN_ONLY, REQUIRE_APPROVAL (default; the ticket is labelled approval-required), ACCEPT_EDITS, BYPASS_PERMISSIONS. Only a hash of secret is stored.

​
Deliver: POST /webhooks/inbound/:id

The event name is the body’s event (or type) field. Both headers are required: the secret must be the trigger’s own and the signature must match the body. Anything else is recorded as rejected (signature required or signature invalid) and creates no ticket. The answer is 200 with {"status": "accepted", "delivery_id", "ticket_id"}, {"status": "rejected" | "ignored" | "failed", "reason"}. Unsigned deliveries used to be accepted for local testing; since October 2026 they are rejected.