Incoming webhook trigger
Create and operate an HMAC-signed endpoint with timestamp validation, body-size limits, idempotent retries, and one-time secret handling.
Use Incoming webhook when an external system should start an Automation by sending one JSON object. The endpoint authenticates the raw request with an HMAC signing secret; it is not a generic unauthenticated hook.
Create the endpoint
Choose Incoming webhook as the Trigger when creating the Automation. Infra One creates the endpoint after the Automation is saved and shows the Signing secret once.
If an existing incoming-webhook Automation has no endpoint, open it and select Create endpoint.
The real endpoint value is covered by a recorded security mask. A signing secret is never captured; it appears only at creation or rotation.
Sign a request
Build the exact UTF-8 JSON bytes first. Let timestamp be current Unix seconds, then compute:
HMAC-SHA256(signing_secret, timestamp + "." + raw_body)
Send:
POST /api/webhooks/automations/ENDPOINT_ID HTTP/1.1
Content-Type: application/json
X-Infra-One-Timestamp: 1786881600
X-Infra-One-Signature: sha256=HEX_DIGEST
Idempotency-Key: source-environment-event-id
{"event":"release_deployed","version":"1.4.379"}
Do not parse and re-serialize the body between signing and sending. Whitespace changes the raw bytes and therefore the signature.
Request constraints
- Method:
POST - Media type:
application/json - Body: exactly one JSON object
- Maximum body: 256 KiB
- Timestamp: Unix seconds accepted within five minutes
- Signature: lowercase or uppercase hexadecimal HMAC digest after
sha256= - Idempotency key: printable, stable, and no more than 200 bytes
See the complete incoming webhook contract for response and retry semantics.
Rotate or disable
Disable endpoint rejects new deliveries without deleting history. Rotate secret immediately invalidates the old secret and displays a replacement once.
Use a coordinated rotation:
- pause the sender;
- rotate and save the new secret;
- update the sender’s secret store;
- send a test delivery;
- resume the sender.
There is no overlap window where both secrets work.
Success check
An accepted request receives a 2xx response and appears as a Webhook delivery in Run history. Then wait for the action row to succeed. A 2xx response proves durable acceptance, not external completion.