v1
latestOpenAPI 3.1.0MIT2026-08-0481194343.8 KBtriggers
Fire a schedule from an HMAC-authenticated external webhook
No Coasty API key is used. The request is authenticated with HMAC-SHA256 over <unix_ts>.<body> using the secret from trigger creation. Send either Coasty-Signature: t=<ts>,v1=<sig> or its X-Coasty-Signature compatibility alias. Published defaults are a 300-second replay window, 1,000,000-byte body cap, and 60-second identical-(webhook_id, body) deduplication window. Read effective deployed values from GET /v1/models under pricing.schedules.
post/v1/triggers/webhook/{webhook_id}
Headers
Coasty-Signaturestring
Example:t=1714900000,v1=4d2f...e7
Primary HMAC credential. Exactly one supported signature header is required.
X-Coasty-Signaturestring
Example:t=1714900000,v1=4d2f...e7
Compatibility alias for Coasty-Signature. Send one signature header, not both.
Request body
object required
Response
Webhook accepted.