---
title: "Configure webhook HMAC"
method: POST
path: "/dags/{fileName}/webhook/hmac/configure"
tags: ["webhooks"]
---

# Configure webhook HMAC

`POST /dags/{fileName}/webhook/hmac/configure`

Updates the webhook HMAC auth mode or enforcement mode without rotating
the secret. If enforcementMode is omitted, the current enforcement mode
is preserved for token_and_hmac, while hmac_only always uses strict.
Developer, manager, or admin only.

## Path parameters

- `fileName` string, regex, required — Name of the DAG file

## Query parameters

- `remoteNode` string

## Request body

- WebhookHMACConfigureRequest — Request to configure webhook HMAC auth mode and enforcement. If enforcementMode is omitted when enabling HMAC, it defaults to strict. If omitted when configuring an existing webhook, the current enforcement mode is preserved for token_and_hmac, while hmac_only always uses strict. Clients should omit enforcementMode when authMode is hmac_only; the server enforces strict mode and rejects observe.
  - `authMode` 'token_and_hmac' | 'hmac_only', required
  - `enforcementMode` 'strict' | 'observe' — How HMAC validation is enforced when HMAC is enabled

## Response `200`

Webhook HMAC updated successfully

- WebhookDetails — Webhook configuration details (token not included)
  - `id` string, uuid, required — Unique identifier for the webhook
  - `dagName` string, required — Name of the DAG this webhook triggers
  - `tokenPrefix` string, required — First 8 characters of the token for identification
  - `enabled` boolean, required — Whether the webhook is active
  - `authMode` 'token_only' | 'token_and_hmac' | 'hmac_only', required — Authentication mode for a webhook trigger endpoint
  - `hmac` WebhookHMACDetails, required — Public webhook HMAC configuration details
    - `enabled` boolean, required — Whether HMAC authentication is currently enabled
    - `enforcementMode` 'strict' | 'observe' — How HMAC validation is enforced when HMAC is enabled
    - `algorithm` string — Fixed HMAC algorithm for v1
    - `headerName` string — Header containing the HMAC signature
    - `format` string — Expected signature header value format
    - `secretConfigured` boolean, required — Whether an HMAC secret is configured for the webhook
    - `updatedAt` string, date-time — When the HMAC secret was last generated
  - `profileSelection` WebhookProfileSelectionDetails, required — Runtime profiles that webhook callers may select
    - `allowedProfiles` RuntimeProfileName[], required — Runtime profile names accepted through X-Dagu-Profile. An empty list disables caller selection.
  - `createdAt` string, date-time, required — When the webhook was created
  - `updatedAt` string, date-time, required — When the webhook was last modified
  - `createdBy` string — User ID who created the webhook
  - `lastUsedAt` string, date-time — When the webhook was last triggered

## Other responses

- `400` — Invalid request or invalid HMAC configuration
- `404` — No webhook configured for this DAG
- `501` — Webhook HMAC is not supported on this node
- `default` — Unexpected error

---

[API](https://skmtc.net/dagucloud/apis/dagu.md) · [All operations](https://skmtc.net/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/93cc41f2018a/schema)