Webhooks

Trigger Agent tasks from external systems via HTTP, or push Agent results to external services.

Inbound Triggers

External systems (Zapier, n8n, custom scripts) can trigger Agent tasks by sending HTTP requests to the Cron trigger endpoints.

Webhook Trigger

curl -X POST https://your-myrm-host/api/cron/trigger/webhook/my-path \
  -H "x-webhook-secret: your-secret" \
  -H "Content-Type: application/json" \
  -d '{"message": "Process this data"}'

Event Trigger

curl -X POST https://your-myrm-host/api/cron/trigger/event \
  -H "Content-Type: application/json" \
  -d '{"message": "new_order_placed", "channel": "ecommerce"}'

System Event Trigger

curl -X POST https://your-myrm-host/api/cron/trigger/system-event \
  -H "Content-Type: application/json" \
  -d '{"source": "monitoring", "event_type": "alert", "payload": {"severity": "high"}}'

Outbound Webhooks

Configure outbound webhooks in Settings > Channels using the Webhook Channel. Agent results are automatically pushed as structured JSON POST requests to your configured URL.

Security

Inbound

Inbound webhook triggers require an x-webhook-secret header that must match the secret configured in the Cron job. Requests without a valid secret are rejected with 401.

Outbound

All outbound webhook requests are protected by multiple security layers:

SSRF Protection: Every outbound HTTP request passes through secure_request() with DNS pinning and private network blocking. Webhook URLs pointing to internal IPs (127.0.0.1, 10.x, 192.168.x, etc.) are automatically rejected.
HMAC-SHA256 Signatures: Outbound webhook payloads include an X-Webhook-Signature header (sha256=...) for receivers to verify request authenticity. Configure a secret per webhook for strongest verification.
Redirect Validation: Outbound requests follow redirects with per-hop SSRF validation — a redirect to an internal address is blocked even if the original URL is public.
Fire-and-Forget Mode: Notification-type hooks (e.g., SessionEnd) can be configured as fire-and-forget — the HTTP call runs asynchronously without blocking the main agent flow, and failures are logged without interrupting the session.

GitHub Integration

The built-in GitHub Channel provides native webhook integration for PR reviews, issue management, and push event handling.

Navigate to Settings > Integrations > GitHub
Enter your Personal Access Token (PAT)
Configure the Webhook Secret
GitHub events (PR opened, issues, push) automatically trigger Agent responses with full context

HMAC-SHA256 signature verification ensures only authentic GitHub payloads are processed. Self-service webhook URL: The webhook URL is displayed directly in the GitHub settings card with a one-click copy button. When you add it in your GitHub repository under Settings → Webhooks, make sure to enter the same Webhook Secret you configured above — otherwise GitHub’s signature verification (X-Hub-Signature-256) will silently reject events with a 401 and PR events will never arrive.

Setup via GUI

Navigate to Settings > Automation (Cron)
Create a new scheduled task
Select “Webhook” as the trigger type
Configure the webhook path and secret
Bind an Agent to execute when triggered

Natural Language Setup

You can also configure webhook triggers via conversation:

“Help me create a webhook trigger that processes incoming data from our payment system”

The Agent will automatically set up the trigger, generate the webhook URL and secret, and guide you through the external system configuration.

​Webhooks

​Inbound Triggers

​Webhook Trigger

​Event Trigger

​System Event Trigger

​Outbound Webhooks

​Security

​Inbound

​Outbound

​GitHub Integration

​Setup via GUI

​Natural Language Setup