Trigger AI agents from webhooks

1. Receive and verify the event

Create an endpoint for the source (GitHub, Stripe, Slack, Linear, or any generic HMAC-SHA256 sender; Sentry is planned). Hooks checks the provider's own signature scheme, stores the raw payload and headers, and normalizes the event into one shape with id, type, actor, subject, and repo or project. Unverified requests never reach your agents.

2. Filter to the events that matter

Each destination carries its own filter rules, evaluated before delivery. Only matching events fan out — an issue labeled bug goes to triage, a @mention goes to the on-call agent, everything else stays in the log without a delivery. Until sender allowlists land, scope filters tightly and review the log for unexpected matches.

{
  "all": [
    { "field": "event.type", "op": "eq", "value": "issue.labeled" },
    { "field": "event.subject.labels", "op": "contains", "value": "bug" }
  ]
}

3. Reshape the payload into a task

Declarative templates render per destination against the normalized event: field paths, defaults, and filters. The same GitHub issue becomes a terse triage prompt for one agent and a full-context brief for another, without touching the source event.

{
  "routineUrl": "https://grok.example.com/routines/abc123",
  "key": "{{secret.GROKBOT_KEY}}",
  "task": "{{event.subject.title}}\n\n{{event.subject.body | truncate:2000}}\n{{event.subject.url}}",
  "repo": "acme/app"
}

4. Deliver with retries and watch the log

Every target gets its own retry schedule: 408, 425, 429, and 5xx responses retry with backoff honoring Retry-After; other 4xx fail permanently with a named code. A 2xx from an agent target means the task was queued, not finished — the delivery log keeps per-attempt status, the rendered request, and the target response, and failed deliveries replay from the original stored event.

5. Keep secrets and payloads safe

Credentials live in project secrets and enter configs only as {{secret.NAME}} references; literal keys are rejected and the authorization header is recorded as [redacted]. Treat the ingress URL itself as a secret, verify signatures before trusting anything, and remember agent targets execute whatever the template renders — filter first, template second.

Frequently asked questions

Reference

• For AI agentshttps://hooks.events/docs/agents.md
• Payload templateshttps://hooks.events/docs/templates.md
• Retries & idempotencyhttps://hooks.events/docs/retries.md
• Secrets & rotationhttps://hooks.events/docs/secrets.md
• Destinationshttps://hooks.events/docs/destinations.md

Keep going