Webhook trigger

A webhook exposes a unique HTTPS URL per workflow (or environment). A valid POST creates a run with the request body in the trigger context.

⚡ URL and method

After activation, Knot shows:

the full URL (copy from the UI; do not guess it);
expected method (POST in most cases);
body format (JSON recommended).

Example partner payload:

{
  "event": "order.paid",
  "order_id": "ORD-2026-0042"
}

Access fields via {{ trigger.body.order_id }} (exact names appear in Simulate inspector).

⚡ HMAC signature

To prove caller identity:

Knot provides a secret (store on the sender side).
The sender computes HMAC-SHA256 of the raw body with that secret.
It sends the digest in a header (X-Knot-Signature or name documented in your version).

Knot rejects requests without a valid signature — typically 401/403.

⚡ Hardening

Measure	Why
HTTPS only	Payload confidentiality
Strong secret	Anti-spoofing
Rate limiting	Abuse protection (version / reverse proxy)
Optional IP allowlist	Fixed partner only

Test with curl from an authorized host before connecting the SaaS tool.

⚡ vs HTTP connector

Webhook (this page) = inbound to Knot (trigger).
HTTP connector = outbound from Knot to an external API.