Webhooks and API triggers
A Trigger Hub deployment can accept a signed inbound event, and any hosted deployment can send signed terminal results to an HTTPS endpoint. Inbound and outbound signatures intentionally use different header contracts.
Trigger a deployed team
Publish a Signed webhook from Trigger Hub, then copy the POST URL and one-time signing secret. The URL token is one credential; the HMAC secret is a second credential stored only as encrypted ciphertext by Codelit.
- Store the full URL and signing secret server-side.
- Choose a unique X-Codelit-Delivery-Id for each event.
- Compute X-Codelit-Signature as sha256=HMAC-SHA256(secret, exact_raw_body).
- POST the same raw body used to compute the signature and retain the returned run ID.
Receive terminal results
Configure a per-workflow result webhook while publishing, or manage it beside the deployed automation in Projects. Completed, halted, and failed terminal events include a stable delivery ID, workflow and run metadata, bounded output, duration, and approximate cost without exposing stored provider credentials.
- Return a 2xx response only after the event is accepted.
- Deduplicate with X-Codelit-Delivery because transient and manual retries reuse the same ID.
- Keep handlers idempotent so a retry cannot repeat a downstream write.
- Use Projects to send a signed test through the stored encrypted endpoint and secret. Codelit never accepts a test destination from the browser.
- A delivery retry sends only the existing bounded event through the currently configured destination and secret. It never reruns models, connectors, browser actions, or approvals.
Verify outbound results
For terminal result webhooks, verify X-Codelit-Signature as v1=HMAC-SHA256(secret, timestamp.raw_body) using X-Codelit-Timestamp before parsing or acting on the payload. Compare signatures in constant time and reject stale timestamps according to your receiver's replay window. Each durable attempt receives a fresh signature timestamp while retaining the same X-Codelit-Delivery id.
Rotate or remove safely
Projects reveals a replacement signing secret only once. Rotation invalidates the old receiver secret immediately. Replacing an endpoint also creates a new secret. Disabling delivery requires confirmation, removes the encrypted endpoint and pending retries, and does not affect the completed run receipt.
- Deployment deletion attempts one authorized terminal halt before destroying the destination, then removes queued result records.
- Workspace and account deletion pause owned automations first and remove result ciphertext, signing secrets, queues, and receipts before identity cleanup.
- Result delivery failure never changes the run's completed, halted, or failed status.