---
title: "Enable webhook HMAC"
method: POST
path: "/dags/{fileName}/webhook/hmac/enable"
tags: ["webhooks"]
---

# Enable webhook HMAC

`POST /dags/{fileName}/webhook/hmac/enable`

Enables HMAC authentication for the existing webhook and returns the generated
HMAC secret exactly once. If enforcementMode is omitted, it defaults to
strict. Developer, manager, or admin only.

## Path parameters

- `fileName` string, regex, required — Name of the DAG file

## Query parameters

- `remoteNode` string

## Request body

- WebhookHMACConfigureRequest — Request to configure webhook HMAC auth mode and enforcement. If enforcementMode is omitted when enabling HMAC, it defaults to strict. If omitted when configuring an existing webhook, the current enforcement mode is preserved for token_and_hmac, while hmac_only always uses strict. Clients should omit enforcementMode when authMode is hmac_only; the server enforces strict mode and rejects observe.
  - `authMode` 'token_and_hmac' | 'hmac_only', required
  - `enforcementMode` 'strict' | 'observe' — How HMAC validation is enforced when HMAC is enabled

## Response `200`

Webhook HMAC enabled successfully

- WebhookHMACSecretResponse — Response when enabling or regenerating webhook HMAC (includes full secret)
  - `webhook` WebhookDetails, required — Webhook configuration details (token not included)
    - `id` string, uuid, required — Unique identifier for the webhook
    - `dagName` string, required — Name of the DAG this webhook triggers
    - `tokenPrefix` string, required — First 8 characters of the token for identification
    - `enabled` boolean, required — Whether the webhook is active
    - `authMode` 'token_only' | 'token_and_hmac' | 'hmac_only', required — Authentication mode for a webhook trigger endpoint
    - `hmac` WebhookHMACDetails, required — Public webhook HMAC configuration details
      - `enabled` boolean, required — Whether HMAC authentication is currently enabled
      - `enforcementMode` 'strict' | 'observe' — How HMAC validation is enforced when HMAC is enabled
      - `algorithm` string — Fixed HMAC algorithm for v1
      - `headerName` string — Header containing the HMAC signature
      - `format` string — Expected signature header value format
      - `secretConfigured` boolean, required — Whether an HMAC secret is configured for the webhook
      - `updatedAt` string, date-time — When the HMAC secret was last generated
    - `profileSelection` WebhookProfileSelectionDetails, required — Runtime profiles that webhook callers may select
      - `allowedProfiles` RuntimeProfileName[], required — Runtime profile names accepted through X-Dagu-Profile. An empty list disables caller selection.
    - `createdAt` string, date-time, required — When the webhook was created
    - `updatedAt` string, date-time, required — When the webhook was last modified
    - `createdBy` string — User ID who created the webhook
    - `lastUsedAt` string, date-time — When the webhook was last triggered
  - `hmacSecret` string, required — Full HMAC secret (only shown once, store securely!)

## Other responses

- `400` — Invalid request or invalid HMAC configuration
- `404` — No webhook configured for this DAG
- `501` — Webhook HMAC is not supported on this node
- `default` — Unexpected error

---

[API](https://skmtc.net/dagucloud/apis/dagu.md) · [All operations](https://skmtc.net/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/93cc41f2018a/schema)