Webhook Triggers

A webhook-triggered automation runs whenever an external system sends an HTTP POST to the automation's unique URL. This is how you wire PSA/RMM alerts, monitoring tools, or automation platforms (Zapier, n8n, Power Automate) into a StackJack automation.

Set up a webhook automation

1. Create an automation (or edit an existing one) and choose the Webhook trigger.
2. Pick a Payload mode (how much of the sender's request body reaches the agent — see below).
3. Optionally set Max payload size (bytes). Leave blank for the server default of 32 KB; the hard ceiling is 65,536 bytes (64 KB).
4. Save, then open the automation detail page. The Webhook card shows everything the sending system needs.

The webhook URL is a credential

The webhook URL has the form:

https://agents.stackjack.io/webhooks/<automation-id>/<secret>

The secret is embedded in the URL itself — anyone who has the URL can trigger your automation. Treat it like a password:

• Use the Copy button rather than transcribing it.
• Don't paste it into tickets, chat, or documentation.
• If it leaks, click Rotate secrets immediately.

Payload modes — how the body reaches your agent

Whatever payload survives filtering becomes the run's trigger payload — it is given to the agent as the context for that run, and you can see exactly what was received on the run's detail page in the Trigger payload card.

Payloads that exceed the size cap after filtering are rejected with HTTP 413 and no run starts.

Optional request signing (HMAC)

Beyond the URL secret, you can have senders prove the body wasn't tampered with:

1. On the Webhook card, click Reveal next to Signing secret (it is masked by default) and copy it.

2. Configure the sender to compute HMAC-SHA256(raw request body, signing secret) and send the result as a header:

   X-StackJack-Signature: sha256=<hex digest>
   

3. The header is optional — omit it and only the URL-secret check applies. If the header is present, an invalid signature is rejected with 401.

The Webhook card includes copy-paste curl examples — an unsigned one always, and a signed one that renders only after you click Reveal (so the secret never sits hidden on the page).

Rotating the secrets

Click Rotate secrets and confirm. Rotation generates a new URL secret and a new signing secret, and it takes effect immediately — the old URL stops working the moment you confirm, so update every external sender right away.

Delivery limits and response codes

• Rate limit: 10 webhook invocations per minute per automation. Excess requests get 429.
• Transport cap: request bodies over 64 KB are rejected.

What a sender sees:

Webhook receipts (delivery log)

Every webhook attempt against an active automation is logged, whatever the outcome — so you can always answer "did the sender actually reach us, and what happened?" (Attempts against unknown, inactive, or archived automations get a 404 and are not logged.)

• Inline panel: the automation detail page includes a collapsed Recent webhook receipts panel showing the last 20 receipts with a Refresh link.
• Full page: a dedicated receipts page at /automations/<automation-id>/webhook-logs shows up to 500 receipts with a limit selector (50 / 100 / 250 / 500) and a Refresh button. There is currently no menu link to this page — open it by entering the URL directly (take the automation id from your browser's address bar on the detail page).

Each receipt row shows: received time, outcome, the HTTP status returned to the sender, the sender's IP address, payload size in bytes, and a short detail string. Possible outcomes:

Requests aimed at an unknown automation id are deliberately not logged (internet scanner noise); the same applies to inactive and archived automations. A tenant-side kill switch (TenantDisabled) is logged.