Webhook Trigger

The Webhook Trigger gives your workflow two URLs, one for testing and one for production. Any system that can send an HTTP request, such as a payment provider, a form tool or your own backend, can start a run by calling it.

When to use itCopy Anchor Link

• Another product can call a webhook URL when something happens.
• Your own backend should start a workflow and optionally wait for its result.
• For a product Buni.ai connects to directly, such as Stripe or GitHub, an app trigger is simpler: it registers the webhook for you.

SettingsCopy Anchor Link

The panel header has an Enabled / Paused switch. New triggers start Enabled; a paused trigger shows Paused on its canvas card and starts no runs.

EndpointCopy Anchor Link

• Test runs your draft workflow straight away.
• Prod runs the published workflow, and answers 409 until you publish.

Both URLs stay the same across publishes. Copy them with the button beside each one.

Until you add a secret the trigger shows Unverified and accepts any request to its URL. Select Generate signing secret and copy the secret; it is shown once. The trigger then shows Signed and rejects requests without a valid signature. See Signing requests.

RequestCopy Anchor Link

ResponseCopy Anchor Link

A Respond Webhook node in the workflow sets the reply for sync mode exactly: its status, headers and body win.

Send test event takes a Sample payload and shows what the trigger would pass to the workflow, without running the workflow's nodes. Recent deliveries lists the latest runs this trigger started, newest first, with their status and duration.

Signing requestsCopy Anchor Link

Sign each request with HMAC-SHA256 over the raw request body and send it in the x-buni-signature header, as sha256=<hex>:

import crypto from 'node:crypto';

const body = JSON.stringify({ orderId: 'ord_12345' });
const timestamp = Math.floor(Date.now() / 1000).toString();
const signature = crypto
  .createHmac('sha256', process.env.BUNI_TRIGGER_SECRET)
  .update(`${timestamp}.${body}`)
  .digest('hex');

await fetch(TRIGGER_URL, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-buni-signature': `sha256=${signature}`,
    'x-buni-timestamp': timestamp,
  },
  body,
});

x-buni-timestamp is optional replay protection. When you send it, the signature covers <timestamp>.<raw body> and requests more than five minutes old are rejected. Without it, sign the raw body alone.

ResponsesCopy Anchor Link

OutputsCopy Anchor Link

The next node reads the request as input:

{{state.trigger.type}} is WEBHOOK for the whole run.

ExampleCopy Anchor Link

An online shop posts each paid order:

Webhook Trigger (POST, Async)
  → Filter (input.payload.amount greater than 0)
  → Messaging (WhatsApp to the customer: "Thanks, order ... is confirmed.")

Tips and limitsCopy Anchor Link

• To stop a retried request from running the workflow twice, send an x-idempotency-key header. Without one, every request starts a run.
• If the body has a top-level payload object, the run receives that object (plus a top-level event, if there is one) and other top-level keys are dropped.
• A trigger accepts up to 120 requests a minute per URL by default; more get 429.

RelatedCopy Anchor Link