Webhook trigger URL

The URL an automation's Webhook trigger listens on: https://www.buni.ai/api/hooks/t/{endpointToken}. Your system calls it; it is listed here as a webhook because it lives outside the /api/v1/orgs/{orgId} base path and uses no API token. The token in the URL is the credential.

Each trigger has a test URL and a production URL (two different tokens). The test URL runs the draft workflow; the production URL returns 409 until the workflow is published.

POST is allowed by default. The trigger's Allowed methods can also permit GET, PUT, PATCH and DELETE; other methods return 405.

Signing (optional). After you select Generate signing secret, every request must carry x-buni-signature: sha256=<hex> (bare hex also works): the HMAC-SHA256 of the raw body, keyed with the secret. If you also send x-buni-timestamp (Unix seconds), the signature must cover <timestamp>.<raw body> and the timestamp must be within 5 minutes of the server's clock. Without a secret, requests are accepted unsigned and the trigger shows as Unverified.

De-duplication. Send x-idempotency-key; a repeated key returns 200 {"deduplicated": true} and does not start another run.

Response. In Async (202) mode the reply is 202 {"accepted": true, "invocationId"}. In Sync (wait for result) mode the request waits for the run and returns 200 (or 500 on failure) with {invocationId, status, error?}. A Custom status code replaces the default status.

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

JSON, form-encoded or plain text, up to 1 MB. The parsed body becomes the run's input.

Response BodyCopy Anchor Link