Webhook triggers
Start a bot from another app: a URL and a secret per trigger, with signatures, event filters and a queue.
A webhook trigger gives a bot its own URL. When another app sends a request to it, such as GitHub, Blotter, a form or a monitoring alert, the bot starts on your instructions, with the request attached as data.
Make one with New webhook trigger under Settings → Routines & triggers: pick the bot, write what it should do with each request, and copy the URL and secret into the sending app.
The URL
| Host | URL |
|---|---|
| This PC | http://localhost:8737/hooks/{id} (the port is set in Settings → Routines & webhooks) |
| A server | https://your-server/hooks/{id} |
Use a server for anything outside your network: it has a public HTTPS address and runs all the time.
Proving the request is real
Each trigger has a secret. A request must carry it in one of these ways:
| Way | How |
|---|---|
| In the URL | ?key=<secret> |
| A header | Authorization: Bearer <secret> or X-InkBot-Key: <secret> |
| GitHub | X-Hub-Signature-256: sha256=<HMAC-SHA256 of the body> |
| Blotter | X-Blotter-Signature: sha256=<HMAC of "timestamp.body"> with X-Blotter-Timestamp (within 5 minutes) |
| Any app | X-Signature-256: <HMAC-SHA256 of the body>, with or without sha256= |
Replace the secret makes a new one, and the old one stops working at once.
Events
Leave Events empty to run on every request, or list the event names to run on. InkBot reads the event from X-Blotter-Event, X-GitHub-Event, X-Event-Type or X-Event, or else from the body's event, type or action field. Other requests are acknowledged and ignored.
Replies to the sender
The answer is JSON with a message:
| Status | Meaning |
|---|---|
202 |
Started, queued (the bot is busy and starts when free), or ignored (not one of its events) |
200 |
Already received: a retry of a delivery already taken (by X-GitHub-Delivery, X-Blotter-Delivery, X-Delivery-Id or Idempotency-Key) |
401 |
No secret or signature, or it doesn't match |
404 |
No such trigger |
409 |
The trigger is switched off |
413 |
The body is over 1 MB (servers) |
429 |
Too many: 60 runs an hour per trigger, and at most 20 waiting |
Send test runs the trigger with a sample request and shows what a sender would be told.