API and automation
Receive signed webhooks
Subscribe an HTTPS endpoint, verify signatures, deduplicate deliveries, and handle retries.
Available events
| Event | When it is emitted |
|---|---|
| task.completed | An organization task completes. |
| task.failed | An organization task fails. |
| deploy.aws.live | A managed AWS deployment becomes live. |
| deploy.aws.failed | A managed AWS deployment fails. |
| member.added | A member is added through an invite or SCIM. |
| member.removed | A member is removed. |
| review.completed | An AI Code Review completes. |
Delivery format
TrigCode POSTs a JSON envelope with id, type, org_id, created_at, and data. The X-TrigCode-Event and X-TrigCode-Delivery headers mirror the event and unique delivery ID. Use the ID as a deduplication key.
{
"id": "delivery-id",
"type": "task.completed",
"org_id": "organization-id",
"created_at": "2026-09-09T12:00:00.000Z",
"data": { "task_id": "short-task-id" }
}Verify the signature
The X-TrigCode-Signature header has t=<unix-seconds>,v1=<hex-hmac>. Recreate HMAC-SHA256 over the exact bytes `${t}.${rawBody}` using the signing secret, compare in constant time, and reject timestamps outside your replay window.
const signed = `${timestamp}.${rawBody}`;
const expected = createHmac('sha256', secret).update(signed).digest('hex');
const valid = timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(received, 'hex'));Retries and endpoint health
After the initial attempt, failed deliveries are scheduled after approximately 1 minute, 5 minutes, 30 minutes, 2 hours, and 8 hours. A delivery becomes dead after the final attempt. An endpoint automatically disables after 10 consecutive failures.
- Endpoints must use public HTTPS URLs.
- Redirects are not followed.
- Respond with any 2xx status quickly after durable receipt.
- Process slow work asynchronously.
- Use the Send test action before enabling production automation.