--- title: "Fire a schedule from an HMAC-authenticated external webhook" method: POST path: "/v1/triggers/webhook/{webhook_id}" tags: ["triggers"] --- # Fire a schedule from an HMAC-authenticated external webhook `POST /v1/triggers/webhook/{webhook_id}` No Coasty API key is used. The request is authenticated with HMAC-SHA256 over `.` using the secret from trigger creation. Send either `Coasty-Signature: t=,v1=` or its `X-Coasty-Signature` compatibility alias. Published defaults are a 300-second replay window, 1,000,000-byte body cap, and 60-second identical-(webhook_id, body) deduplication window. Read effective deployed values from GET /v1/models under pricing.schedules. ## Headers - `Coasty-Signature` string - `X-Coasty-Signature` string ## Request body - object ## Response `200` Webhook accepted. - WebhookFireResponse - `received` boolean, required - `schedule_id` string, required - `run_id` string, nullable - `deduplicated` boolean - `message` string, required - `request_id` string, required ## Other responses - `400` — Invalid request body or parameters. - `401` — Missing, malformed, stale, or invalid Coasty-Signature HMAC for this webhook payload. - `402` — Insufficient balance for this operation. Direct metered API calls and managed-machine runtime use the prepaid Developer API wallet; scheduled execution is the documented consumer subscription-credit exception. Follow the operation's billing fields and top up the matching balance in the dashboard. - `404` — Resource not found in this key's namespace. - `409` — The resource state conflicts with this operation. - `413` — Body exceeds 1 MB. - `429` — Webhook per-minute rate limit exceeded. Honor Retry-After. - `500` — Unexpected server error. Retry with exponential backoff. --- [API](https://skmtc.net/coasty/apis/coasty-public-api.md) · [All operations](https://skmtc.net/coasty/apis/coasty-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coasty/coasty-public-api/versions/f50d93b0d8a1/schema)