---
title: "Trigger webhook"
method: POST
path: "/api/webhooks/{id}/trigger"
tags: ["Webhooks"]
---

# Trigger webhook

`POST /api/webhooks/{id}/trigger`

Externally triggers a webhook action. This endpoint is public but requires a valid
HMAC-SHA256 signature in the `X-Webhook-Signature` header. Sign the exact raw bytes
of the request body; an empty body is rejected.

Compute the signature as: `sha256=` + HMAC-SHA256(raw_request_body, webhook_secret).

Every unauthenticated rejection (unknown id, disabled webhook, missing or invalid
signature, empty body) returns the same `404` response so callers cannot enumerate
webhook ids from the response surface.

## Path parameters

- `id` integer, required

## Request body

- object
  - `action` 'deploy' | 'restart' | 'stop' | 'start' | 'pull' | 'git-pull' — Override the default webhook action. Must be one of the allowed actions.

## Response `202`

Webhook accepted and action queued.

- object
  - `message` string, required
  - `action` string, required

## Other responses

- `400` — Authentication succeeded but the body's `action` override was not in the allowlist.
- `404` — Authentication failed. The webhook is unknown or disabled, the signature header is missing, the body was empty, or the signature did not match. Sencho returns the same response for every unauthenticated case.
- `429` — Rate limit exceeded. The trigger endpoint allows 500 requests per minute per source IP; CI/CD callers behind shared NAT may share that budget.
- `500` — Internal server error.

## Changes

- **2026-06-04** `d58cf9d6195b` — 4 info
  - removed the `ADMIRAL_REQUIRED` enum value from the `code` response property for the response status `400`
  - removed the `ADMIRAL_REQUIRED` enum value from the `code` response property for the response status `404`
  - removed the `ADMIRAL_REQUIRED` enum value from the `code` response property for the response status `429`
  - removed the `ADMIRAL_REQUIRED` enum value from the `code` response property for the response status `500`
- **2026-05-23** `6aa88c4c8a4f` — 1 info
  - added the non-success response with the status `429`
- **2026-05-23** `3e94162e8e64` — 2 breaking, 9 info
  - request body became required
  - request property `action` was restricted to a list of enum values
  - added the new `deploy` enum value to the request property `action`
  - added the new `git-pull` enum value to the request property `action`
  - …7 more
- **2026-04-05** `7464894ea582` — 4 warning, 4 info
  - added the new `PAID_REQUIRED` enum value to the `code` response property for the response status `401`
  - added the new `PAID_REQUIRED` enum value to the `code` response property for the response status `403`
  - added the new `PAID_REQUIRED` enum value to the `code` response property for the response status `404`
  - added the new `PAID_REQUIRED` enum value to the `code` response property for the response status `500`
  - …4 more

[Change history](https://skmtc.dev/studio-saelix/apis/sencho-api/changes/api/webhooks/:id/trigger/post.md)

---

[API](https://skmtc.dev/studio-saelix/apis/sencho-api.md) · [All operations](https://skmtc.dev/studio-saelix/apis/sencho-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/studio-saelix/sencho-api/revisions/82aac94c016e/schema)