Webhooks

The webhook endpoint receives events from external services like Stripe, GitHub, PayPal, and Twilio. Each webhook trigger has a unique URL that external services post to.

Verification Flow

1. Connector dispatch — If the trigger has a service field and the connector is available, the webhook is dispatched to the connector for service-specific signature verification and rich event parsing.
2. Built-in verification — If no connector is available, the built-in verifier checks the HMAC signature using the trigger’s secret.
3. No secret — If no secret is configured, the webhook fires but a warning is logged for audit purposes.

Supported Services

Setting Up a Webhook

curl -X POST http://127.0.0.1:7741/triggers \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "webhook",
    "config": {
      "service": "github",
      "secret": "your-webhook-secret"
    },
    "action": {
      "type": "shell",
      "command": "jeriko github hook"
    },
    "label": "GitHub push events"
  }'

{
  "ok": true,
  "data": {
    "trigger_id": "4eae23a1"
  }
}

Failed Verification

If signature verification fails, the endpoint returns 200 OK with the trigger ID but does not fire the action. This prevents external services from retrying indefinitely.