Webhooks
Trigger webhook
Externally triggers a webhook action. This endpoint is public but requires a valid HMAC-SHA256 signature in the X-Webhook-Signature header. Sign the exact raw bytes of the request body; an empty body is rejected.
Compute the signature as: sha256= + HMAC-SHA256(raw_request_body, webhook_secret).
Every unauthenticated rejection (unknown id, disabled webhook, non-paid licence, missing or invalid signature, empty body) returns the same 404 response so callers cannot enumerate webhook ids or fingerprint the instance's licence tier.
post/api/webhooks/{id}/trigger
Path parameters
idinteger required
Numeric resource ID.
Request body
Response
Webhook accepted and action queued.
Example response
{
"message": "Webhook accepted",
"action": "deploy"
}