Skip to main content
This page walks through the Console UI for inbound webhooks. For the security model, signature algorithm, and API reference, see Inbound webhooks.

​
Before you start

  • A saved workflow in Workflow Studio (draft-only graphs cannot subscribe)
  • project_contributor role
  • At least one API key (PAT) under Settings → API keys — webhooks use this for Authorization: Bearer pat_… on ingress
  • inbound_webhooks enabled on your deployment (default on)
1

Open the workflow

Navigate to Workflow Studio at /workflow/{workflow_id} for the graph you want to trigger.
2

Open the Inbound tab

In the workflow configuration panel, select Inbound. This tab lists subscriptions for this workflow only.
3

Name the subscription

Enter a label (for example shopify-fulfillment or weekly-cron). Names appear in Settings → Inbound webhooks too.
4

Select automation API key

Choose an existing key from the dropdown. Create one first under Settings → API keys if the list is empty.
5

Create

Click create. A dialog shows the signing secret and ingress URL — copy both immediately.
6

Copy curl template

Use the generated curl example to verify HMAC signing and PAT auth before wiring your external system.

​
PAT paste fallback

If the BFF cannot read the PAT secret from Vault (legacy key, Vault unavailable, or pat_secret_not_in_vault), the UI prompts you to paste the PAT secret once. The plaintext is used only for subscription setup and is not shown again. This same fallback appears in Autopilot’s wizard and matches the API’s optional automation_bearer field.

​
Path B — Settings (workspace-wide)

1

Open Settings → Inbound webhooks

Go to /settings?tab=inboundWebhooks for a workspace-wide list of all subscriptions.
2

Review and delete

Use this view to audit subscriptions across workflows or remove unused hooks. Creation still requires a workflow context — use Workflow Studio or Autopilot for new subscriptions.

​
Path C — Autopilot Chat wizard

When you ask Autopilot to trigger a workflow from external events, Chat may render an Inbound webhook card:
1

Open a saved workflow

The wizard requires workflow_id from the workflow open in Studio. If missing, Autopilot shows: “Open a saved workflow in Workflow Studio first.”
2

Fill the card

Set Label, pick Automation API key, and click Create webhook.
3

Copy secrets from success state

After creation, the card shows signing secret, ingress URL, and example curl — same as the Studio dialog.
Ask in Chat: “Create an inbound webhook for this workflow” or “I need a signed URL to trigger this graph from Shopify.”

​
After creation

ItemNotes
Signing secretShown once. Store in your secrets manager. Used for X-Agentruntime-Signature.
Ingress URLPublic POST target. Body becomes workflow input.
Automation PATMust be sent on every ingress request. Tied to the subscription at create time.
Test with the curl template, then map your provider’s webhook fields to workflow input (for example map pull_request.number → pr_number).

​
Example ingress request

curl -X POST 'https://api.agentruntime.io/v1/inbound-webhooks/{subscription_id}' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer pat_…' \
  -H 'X-Agentruntime-Signature: sha256=<hmac-sha256 of raw body>' \
  -d '{"order_id": "5678901234"}'
See API examples — inbound webhooks for programmatic create/list/delete.