webhook-subscriptions

Webhook subscriptions trigger agent runs automatically by creating secure routes that accept event POST payloads from GitHub, Stripe, and other services. You create a subscription that listens for specific event types and forwards the rendered prompt to your chosen adapter.

HMAC validation secures incoming webhook payloads by using per-subscription HMAC-SHA256 secrets to verify the authenticity of each POST request. This ensures that only signed events from authorized sources trigger agent runs on your gateway.

Yes, prompt templating supports dot-notation placeholders to extract nested fields from incoming webhook JSON payloads. If no template is provided, the system falls back to dumping the full payload into the prompt.

Yes, webhook platform enablement on the gateway is required before you can create event subscriptions. Once enabled, you can configure persisted subscription routing and per-subscription HMAC secrets for secure event processing.

Deliver-only mode is an optional direct delivery method that forwards rendered messages to adapters without an LLM loop. It provides zero-reasoning notifications for incoming events when you only need to forward payload data.

The best way to automate CI/CD pipeline alerts is to create a webhook subscription that accepts POST payloads from your pipeline, applies prompt templating to extract event details, and forwards the rendered message to your notification adapter.