Repository navigation
feat(automations): a webhook address per automation trigger - #442
Merged
Merged
Conversation
adeelahmad
force-pushed
the
claude/project-thread-cyhjct
branch
2 times, most recently
from
October 15, 2026 23:43
31e89f3 to
f70b28b
Compare
A trigger {"on": "webhook"} gets a secret address when its automation is
saved (automation_hooks.token_for, revoke for M6). A call to
POST /api/v1/automations/hooks/{token} takes JSON, a form or text up to
64 KB, at most 60 calls a minute per hook, checks a Standard Webhooks
signature when one is sent (or required), and logs a webhook.received
activity once per message id, answering 202 at once.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QewNs6jxSB2vRoag2EvdyX
adeelahmad
force-pushed
the
claude/project-thread-cyhjct
branch
from
October 15, 2026 23:50
f70b28b to
85fc1d3
Compare
adeelahmad
enabled auto-merge (squash)
October 15, 2026 23:50
This was referenced Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before: an automation's trigger could say
{"on": "webhook"}, but nothing gave it an address, and nothing outside Lens (Home Assistant, a phone shortcut, another service) could set an automation off.After: saving an automation with a webhook trigger can make it a secret address (
automation_hooks.token_for, for the automation engine to call;revokewhen the trigger or automation goes). A call toPOST /api/v1/automations/hooks/{token}becomes awebhook.receivedactivity in the event log, which the automation follows like any other.How:
app/domain/automation_hooks.pykeeps oneautomation_hookrow per trigger (token hashed like an import hook's, signing secret sealed with the server key). The route (no session; the token is the credential) reads at most 64 KB, takes JSON, a form's text fields or text, allows 60 calls a minute per hook (429 withRetry-After), checks a Standard Webhooks signature when one is sent (withnotify.sign, five minutes' leeway; a hook madesignedrequires it), and emits with a key fromwebhook-idorIdempotency-Key, so a retried call is logged once. It answers 202{id}at once; in Docker the worker's dispatcher sees it on its next look. The kind is registered in the newevents_streams.py, which the rest of M3 (sensors, chat, system) builds on.Choices taken (reversible): a call while the automation is switched off answers 403, so the caller knows; calling
token_foragain for the same trigger replaces its hook; the automation's name and namespaces are read from theautomationtable when it exists (M6), else it's "Automation " and the activity is for admins; the rate limit counts per API process.Motivation and Context
Workflow studio module M3 (sensors, chat, webhooks and system), first of its pull requests: the webhook trigger that M6 calls when it saves automations.
Types of changes
!in the title)Checklist:
make hookschecks it on commit).docs/accordingly.## UnreleasedinCHANGELOG.md. (n/a: nothing a person sees until the studio stores automations)Done questions (AGENTS.md)
SCHEMA.tests/api/test_automation_hooks.py, embedded and 3.2.4 server), docs (automations.md,api.md,database.md) and the OpenAPI client (make openapi) updated.docs/automations.md: signed answers to the caller, a rate limit shared across API processes, a hook's last call in the studio.🤖 Generated with Claude Code
https://claude.ai/code/session_01QewNs6jxSB2vRoag2EvdyX
Generated by Claude Code