---
title: "Trigger webhook"
method: POST
path: "/api/webhooks/{id}/trigger"
tags: ["Webhooks"]
---

# Trigger webhook

`POST /api/webhooks/{id}/trigger`

Externally triggers a webhook action. This endpoint is public but requires a valid
HMAC-SHA256 signature in the `X-Webhook-Signature` header. Sign the exact raw bytes
of the request body; an empty body is rejected.

Compute the signature as: `sha256=` + HMAC-SHA256(raw_request_body, webhook_secret).

Every unauthenticated rejection (unknown id, disabled webhook, missing or invalid
signature, empty body) returns the same `404` response so callers cannot enumerate
webhook ids from the response surface.

## Path parameters

- `id` integer, required

## Request body

- object
  - `action` 'deploy' | 'restart' | 'stop' | 'start' | 'pull' | 'git-pull' — Override the default webhook action. Must be one of the allowed actions.

## Response `202`

Webhook accepted and action queued.

- object
  - `message` string, required
  - `action` string, required

## Other responses

- `400` — Authentication succeeded but the body's `action` override was not in the allowlist.
- `404` — Authentication failed. The webhook is unknown or disabled, the signature header is missing, the body was empty, or the signature did not match. Sencho returns the same response for every unauthenticated case.
- `429` — Rate limit exceeded. The trigger endpoint allows 500 requests per minute per source IP; CI/CD callers behind shared NAT may share that budget.
- `500` — Internal server error.

---

[API](https://skmtc.net/studio-saelix/apis/sencho-api.md) · [All operations](https://skmtc.net/studio-saelix/apis/sencho-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/studio-saelix/sencho-api/versions/f36f82acae1d/schema)