---
title: "Set who may send to the webhook's public URL"
method: PUT
path: "/dags/{fileName}/webhook/public/sender"
tags: ["webhooks"]
---

# Set who may send to the webhook's public URL

`PUT /dags/{fileName}/webhook/public/sender`

## Request

- Base URL: `http://localhost/api/v1`
- URL: `http://localhost/api/v1/dags/{fileName}/webhook/public/sender`
- Auth: one of:
  - HTTP bearer
  - HTTP basic
  - none

Sets the sender whose signature requests to the public URL must
carry, its signing secret, and the events that start runs. For
GitHub, Dagu makes the secret when none is entered, and returns it
only this once. Admin only.

## Path parameters

- `fileName` string, regex, required: Name of the DAG file

## Query parameters

- `remoteNode` string

## Request body

- WebhookPublicSenderRequest: Who may send to a public URL, and which events start runs
  - `sender` 'github' | 'stripe' | 'slack' | 'standard': A service whose signed requests a public URL accepts
  - `secret` string: The sender's signing secret. Empty keeps the stored secret of the same sender, or, for GitHub, makes one.
  - `generateSecret` boolean: Make a new GitHub signing secret
  - `events` string[]: Events that start runs; empty takes every event

## Response `200`

The webhook with its new sender settings

- WebhookPublicSenderResponse
  - `webhook` WebhookDetails, required: Webhook configuration details (token not included)
    - `id` string, uuid, required: Unique identifier for the webhook
    - `dagName` string, required: Name of the DAG this webhook triggers
    - `tokenPrefix` string, required: First 8 characters of the token for identification
    - `enabled` boolean, required: Whether the webhook is active
    - `authMode` 'token_only' | 'token_and_hmac' | 'hmac_only', required: Authentication mode for a webhook trigger endpoint
    - `hmac` WebhookHMACDetails, required: Public webhook HMAC configuration details
      - `enabled` boolean, required: Whether HMAC authentication is currently enabled
      - `enforcementMode` 'strict' | 'observe': How HMAC validation is enforced when HMAC is enabled
      - `algorithm` string: Fixed HMAC algorithm for v1
      - `headerName` string: Header containing the HMAC signature
      - `format` string: Expected signature header value format
      - `secretConfigured` boolean, required: Whether an HMAC secret is configured for the webhook
      - `updatedAt` string, date-time: When the HMAC secret was last generated
    - `profileSelection` WebhookProfileSelectionDetails, required: Runtime profiles that webhook callers may select
      - `allowedProfiles` RuntimeProfileName[], required: Runtime profile names accepted through X-Dagu-Profile. An empty list disables caller selection.
    - `profileTokens` WebhookProfileToken[]: Additional tokens, each bound to one runtime profile. Remote nodes running versions without profile tokens omit the field.
      - `id` string, required: Unique identifier for the profile token
      - `name` string, required: Label identifying the caller that holds the token
      - `tokenPrefix` string, required: Leading characters of the token for identification
      - `profile` string, required: Runtime profile name.
      - `createdAt` string, date-time, required: When the profile token was created
      - `createdBy` string: User ID who created the profile token
      - `lastUsedAt` string, date-time: When the profile token last authorized a request
    - `createdAt` string, date-time, required: When the webhook was created
    - `updatedAt` string, date-time, required: When the webhook was last modified
    - `createdBy` string: User ID who created the webhook
    - `lastUsedAt` string, date-time: When the webhook was last triggered
    - `public` WebhookPublicSettings: What the webhook's public URL accepts
      - `sender` 'github' | 'stripe' | 'slack' | 'standard': A service whose signed requests a public URL accepts
      - `secretConfigured` boolean, required: Whether the sender's signing secret is stored
      - `events` string[], required: Events that start runs; empty takes every event
      - `createdAt` string, date-time, required: When the public URL was turned on
  - `secret` string: The signing secret Dagu made, shown only this once

## Other responses

- `400`: Invalid sender, secret, or events
- `404`: No webhook, or no public URL, for this DAG
- `default`: Unexpected error

## Changes

> 208 revisions in range; 1 not diffed.

- **2026-10-14** (v1) `4cf3e5ea421d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/dagucloud/apis/dagu/changes/dags/:fileName/webhook/public/sender/put.md)

---

[API](https://skmtc.dev/dagucloud/apis/dagu.md) - [All operations](https://skmtc.dev/dagucloud/apis/dagu/llms.txt) - [OpenAPI document](https://skmtc.dev/dagucloud/apis/dagu/revisions/742c8ecb39ce?raw)